Anyone else notice the source they provide seems a bit light on functional code in multiple areas? Lots of stubs, empty methods, commented-out blocks and such throughout.
Did they neuter it by stripping out core functionality prior to releasing as open source? Sort of disappointing if so.
Almost seems useless in its current state given the degree of missing code (caveat: I have not run it yet, only read through the code in the GitHub repo).
Looking at it deeper I notice the scoring system is less advanced than I would have thought coming from a Netflix-type organization. Etsy released a tool a while back for general anomaly detection that used much more advanced statistical analysis. Would have loved to see more of that in here.
Up until last year, Netflix was using Silverlight for their player. They used to trot out on Microsoft dev conference stages and talk up IIS media streaming capabilities every now and then. For a while, it seemed like every feature microsoft announced for silverlight was basically aimed at Netflix... so not that surprising they have C# talent on staff?
Is this intended to compliment or replace things like alienvault/snort? Can it handle raw nix logs? Logstash? Windows events? It seems like from the post some kind of third party connection is required (LANDesk?), but I may not be reading right.
It doesn't seem like it replaces Snort, which is an intrusion prevention system. It's more akin to AlienVault, which is a SIEM. Netflix shies away from the term SIEM. They call this an incident response software. I'm reading through it trying to figure out how it's different from a SIEM, but there's not a lot of technical details.
It's not trouble ticketing. It's an aggregator of threat analysis responses from multiple sources that they use in the SOC to monitor for security threats and incursions.
Is there already an open source product that does that? That would be interesting to know about since I work in that space.
Did they neuter it by stripping out core functionality prior to releasing as open source? Sort of disappointing if so.
Almost seems useless in its current state given the degree of missing code (caveat: I have not run it yet, only read through the code in the GitHub repo).