Containerized SIEM Deployment with Ingress Gateways
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions struggle to effectively leverage exponential data growth for timely detection, alerting, and prevention of security events, resulting in significant blind spots in IT security and operations due to inadequate data ingestion and processing capabilities.
Innovation Solution
A containerized application software deployment architecture is implemented, which includes a cloud with multiple hosts forming a stretch cluster across multiple data centers. This architecture optimizes processing, memory, and storage resources to run multiple instances of SIEM application components, such as indexers, within containers, and employs ingress gateways for load balancing and service mesh functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional security solutions are used, then data processing capability is limited, but data ingestion rate cannot keep pace with exponential data growth
Solution Approach 1:
The SIEM application is segmented into multiple independent components (indexers, search heads, forwarders) that can be deployed as separate container instances. This segmentation enables parallel processing of data ingestion tasks, allowing the system to scale horizontally to handle exponential data growth while maintaining high ingestion rates.
Solution Approach 2:
Multiple container instances are nested within the container platform infrastructure, which itself is nested within the cloud environment spanning multiple data centers. This nested architecture allows efficient resource utilization while providing the scalability needed to process large volumes of security data at high rates.
2Productivity
If multiple instances of SIEM components are deployed, then data processing capacity increases, but infrastructure complexity increases
Solution Approach 1:
The container platform is designed as a universal infrastructure that can host multiple SIEM component types (indexers, search heads, forwarders) and multiple instances of each. This multi-functional platform reduces overall system complexity by providing a standardized deployment model rather than requiring separate specialized infrastructure for each component type.
Solution Approach 2:
The container platform acts as an intermediary layer between the cloud infrastructure and the SIEM application components. This intermediary abstracts the complexity of managing multiple instances and provides standardized interfaces for deployment, making the system easier to manage despite the increased number of components.
3Reliability
If data is not ingested and processed timely, then security analytics capability is reduced, but data processing bottleneck remains
Solution Approach 1:
Data is ingested and pre-processed by indexer containers before detailed analysis is performed. This preliminary action of rapid data ingestion and initial processing ensures that data is available for security analytics in a timely manner, preventing bottlenecks in the overall security event detection pipeline.
Solution Approach 2:
Multiple container instances operate continuously and in parallel to maintain uninterrupted data ingestion and processing. This continuous operation across multiple instances eliminates processing gaps and ensures that security events are detected and analyzed without delays, maintaining high reliability of security monitoring.
Data Source
AI summary
Embodiments described herein are generally directed to a containerized application software deployment architecture. According to an example, a system includes multiple hosts that are part of aa stretch cluster spanning multiple data centers. Each of the hosts include a processing resource, a memory, and a storage device. Each host of a first subset of the multiple hosts runs multiple containerized instances of a component of a Security Information and Event Management (SIEM) application within respective containers. At least one host of the multiple hosts is separate from the first subset and is dedicated to running at least one containerized ingress gateway application operable to load balance requests directed to the SIEM application among the multiple containerized instances running on the first subset of hosts.