CloudTail: Making Heads or Tails of Selectively Retaining Multi-Cloud Logs (w/o a SIEM!)
Ela Dogjani
BSides NYC 2024 · Day 1 · Tech - Blue
In the increasingly complex landscape of cloud computing, effective log management stands as a cornerstone of robust security and operational resilience. However, the proliferation of services and the adoption of multi-cloud strategies have transformed this essential task into a significant challenge, often characterized by overwhelming data volumes, prohibitive costs, and fragmented visibility. This talk, delivered by Ela Dogjani, an Associate Threat Researcher at Permiso Security, introduces **CloudTail**, an innovative open-source tool designed to address these pervasive issues by enabling selective, long-term retention of high-value multi-cloud logs without the necessity of a traditional, expensive Security Information and Event Management (SIEM) solution.
AI review
Competent first-time talk from a junior researcher introducing a practical open-source tool for selective multi-cloud log retention. CloudTail solves a real pain point — the cost/noise tradeoff of ingesting everything into a SIEM — but the solution space here is crowded and the talk doesn't substantially advance the state of the art beyond 'here's a tool we built.'