# Security data at PB scale, without the SIEM bill

Security teams are the ones asked to search everything and given a budget to keep a fraction of it. CtrlB keeps CloudTrail, WAF, VPC flow, and audit logs on your own object storage and makes all of it searchable in seconds.

## Metadata

- **Canonical HTML**: https://ctrlb.ai/solutions/security-analytics
- **Section**: Solutions — Security analytics

## At a glance

| Figure | What it refers to |
|--------|-------------------|
| 1.3 PB/month | WAF and CloudTrail at Zepto |
| 125 TB | Unique IP search in ~5 s |
| Years | Retention at object storage cost |
| Open Parquet | In a bucket you control |

## The compromise you are making

- Ingest-priced SIEMs make the retention decision for you, so the noisy high-volume sources — WAF, flow logs, CloudTrail data events — are the first to be dropped.
- The data you did keep splits across a hot tier you can search and an archive tier you can only restore from.
- Querying the archive with Athena means a five-to-ten minute wait per question, which ends the investigation long before the questions do.
- Compliance retention and investigative retention end up as two different systems with two different copies.

## What changes

- Every security source lands in your own bucket at object storage prices, so keeping three years is a storage line item rather than a licensing negotiation.
- One tier. The oldest day in the lake answers as fast as the newest, because the index is built at ingest for all of it.
- A unique-IP search across 125 TB of CloudTrail returns in about five seconds, so an analyst follows the trail instead of batching questions.
- Immutable Parquet with object-level locking gives the audit trail and the investigation surface the same copy of the data.

## How it works

1. **Point your sources at your bucket** — CloudTrail, WAF, VPC flow, GuardDuty, Okta, and application audit logs land schema-less. New fields are indexed the moment they appear, so a provider adding a column never becomes a mapping incident.
2. **Search the whole retention window** — Compact inverted indexes make a needle query — one IP, one principal, one request id — a targeted read rather than a full scan, whether the event is from this morning or from two years ago.
3. **Pivot at investigation speed** — Sub-second responses mean an analyst can chase a lead across sources in one sitting, and an agent can do the same unattended.

## Capabilities

- **Needle-in-a-haystack search**: Full-text search over raw log bodies — IPs, ARNs, request ids, user agents — without pre-declaring which fields matter.
- **Schema-less audit sources**: Security providers change their event shape without warning. Nothing is rejected and no migration is required.
- **Immutable, tamper-evident**: Write-once Parquet with object-level locking. No compaction rewrites, so chain of custody stays intact.
- **Detections over streams**: Rules evaluate continuously as data lands, so alerting does not depend on a separate hot store.
- **One copy for audit and analysis**: The compliance archive and the investigation surface are the same objects in the same bucket.
- **No ingest tax**: Cost tracks bytes stored and compute used, not the volume you were brave enough to send.

## FAQ

**Do we have to move off our SIEM?**

No. A common pattern is to keep the SIEM for the detections and workflows your team already runs, and move the high-volume sources and long-tail retention to CtrlB underneath it.

**Where does the data physically live?**

In your own S3 or GCS bucket, in open Parquet, in the region you choose. The index lives beside it in the same bucket.

**How far back can we search?**

As far back as you keep objects. There is no hot/cold split, so retention is a storage decision rather than a query-performance decision.

**What does a real deployment look like?**

Zepto searches 1.3 PB a month of WAF and CloudTrail directly on its own object storage — the full story is on the customer page.

Markdown mirror: fetch `/solutions/security-analytics.md` for this page as plain Markdown.