Engineering
Platform health & capacity
The detection platform is itself an asset that fails. Saturated ingest nodes drop events, full hot tiers shorten your search window, and both failures look like a quiet day on the dashboards.
Cluster state
Degraded
2 of 6 nodes above threshold
Peak ingest
15.2k EPS
Friday 09:00–10:00
Search latency p95
1.9 s
90-day range queries
Hot tier used
71%
8.4 of 12 TB
Nodes
Resource pressure by role.
| Node | Role | CPU | Memory | Disk | State |
|---|---|---|---|---|---|
| ingest-01 | Ingest | 62 | 58 | 44 | Healthy |
| ingest-02 | Ingest | 81 | 74 | 47 | Degraded |
| index-01 | Index / hot | 55 | 69 | 71 | Healthy |
| index-02 | Index / warm | 31 | 47 | 83 | Degraded |
| rules-01 | Correlation | 77 | 61 | 22 | Healthy |
| api-01 | Query / API | 40 | 52 | 18 | Healthy |
Daily volume & peak rate
Weekday volume runs roughly 60% above the weekend. Size ingest for the Friday peak, not the weekly average, or you will lose events exactly when the estate is busiest.
Retention tiers
How far back you can actually investigate.
Hot · 14 days
8.4 / 12 TBLive triage and dashboards
Warm · 90 days
22.1 / 30 TBInvestigation and hunting
Cold · 365 days
61.7 / 120 TBCompliance and retrospective hunts
Symptoms that mean platform, not attackertriage›
- Event volume drops estate-wide at a round-numbered time — that is a collector, not calm.
- Alerts arrive in bursts after a gap — a queue drained, so your timestamps are late.
- A saved search that always returned results now returns none — check parsing before you celebrate.
- Searches slow only on long ranges — warm-tier pressure, not a query problem.
Learn this capability
Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.
Intermediate · Simulation · 25 min
Diagnosing a silent log source
The domain controller source has sent no events for two hours. Detection coverage for authentication is effectively off.
Intermediate · Theory · 18 min
SIEM architecture overview
You keep the SIEM healthy. Everything analysts do depends on data arriving, parsing correctly and being searchable.
Advanced · Guided Lab · 25 min
Workload and queue management
The queue has grown by 40% this week and two analysts are on leave. Something must give — you decide what.