cyber.hendryadrian.com
Security News · reliaquest.com

ReliaQuest Says GreyMatter SIEM-Less Cuts Investigation Time to Under 5 Minutes

· Original article ↗

Summary

ReliaQuest says GreyMatter SIEM-Less reduces investigation time to under 5 minutes using streaming detections, OCSF-normalized logs, indexed searches, federated queries and automated investigation workflows.

Key points

  • ReliaQuest claims GreyMatter SIEM-Less reduces mean time to investigate from 20–25 minutes to under 5 minutes.
  • GreyMatter Transit normalizes logs to OCSF and runs detections while data is in motion, then writes the data to customer-owned cloud storage.
  • GreyMatter Index builds an inverted index as files arrive; ReliaQuest says it rules out roughly 99% of data before searches read it.
  • The product uses on-demand search jobs for investigations rather than sharing search capacity with scheduled detections.
  • Federated search queries connected EDR, identity and email tools directly for current context.
  • ReliaQuest says its IR Analyst Teammate investigates alerts and can initiate actions such as blocking an IP or containing a host; the article claims 99.4% accuracy.

Article Details

Event Type
Cybersecurity product capability announcement
Impact
ReliaQuest says GreyMatter SIEM-Less reduces mean time to investigate from 20–25 minutes to under 5 minutes. The article also claims the IR Analyst Teammate reaches a disposition with 99.4% accuracy; these are vendor-reported performance claims.

Vendors

ReliaQuestwatchers spawn short-lived search jobs on demand, and each one runs, returns its answer, and exits. ReliaQuest runs and scales that compute, so a busy day doesn't mean a slower investigation.

Products

GreyMatter Index (GMIX)writes the normalized data to the customer's own S3, Azure Blob, or Google Cloud Storage. GreyMatter Index (GMIX) picks up each new file and indexes it as it lands.GreyMatter SIEM-LessGreyMatter SIEM-Less brings MTTI under 5 minutes by removing the points in the architecture where an investigation stops and waits. Here are the six pieces that make it possible.GreyMatter TransitGreyMatter SIEM-Less flips that order. GreyMatter Transit parses raw logs, normalizes every event to OCSF, and runs single- and multi-event detections while the data is still in motion. Alerts fire in seconds. TransitIR Analyst TeammateFast queries only matter if nothing else in the investigation slows down. The IR Analyst Teammate picks up every triggered alert as soon as it fires, including GreyMatter detections, custom rules, and native alerts fromUniversal Translatorquestion through its direct connectors to the EDR, identity provider, or email gateway itself. The Universal Translator turns the question into that tool's native query language, and the answer comes back in seconds,

Related Articles