OpenSearch Security Analytics as a SIEM
Using OpenSearch Security Analytics detectors, Sigma rules, log type mappings and correlations as a self-hosted SIEM, and what it takes to run it in production.
OpenSearch features
OpenSearch plugins and capabilities, all under Apache 2.0, that turn a search cluster into a SIEM, vector database or monitoring platform.
OpenSearch vector search and RAG
Running OpenSearch as a vector database for semantic and hybrid search and retrieval-augmented generation, with built-in embedding generation and memory-saving compression.
OpenSearch alerting and anomaly detection
Setting up monitors, triggers and notifications and Random Cut Forest anomaly detectors on logs and metrics, and tuning them to avoid alert fatigue.
OpenSearch cross-cluster replication
Replicating indexes to a second cluster or data center for disaster recovery, locality or central reporting with the active-passive replication plugin.
OpenSearch audit logging
Enabling OpenSearch Security audit logs, choosing categories and storage targets, and keeping audit records outside the cluster they describe.
