Engagements
Engagements are paused.
I'm not taking engagements while I work full-time, so for now Security Data Works is research and publications only. The research notebook, the lab, the Capability Matrix, the essays and the book all carry on, and they're free to use, which covers most of what an engagement would have started from anyway.
This page stays up as a record of what the practice offered. Every engagement started from the same view, that a security data platform problem is usually data-engineering debt and the fix is repairing the broken pieces one at a time rather than a bet-the-SOC migration. The offerings below were how that work was scoped, and the public MOAR Reference Stack and the Capability Matrix are the parts you can still use on your own.
If you're working through the same questions, start with the research, the lab, the Matrix or the essays. I'm glad to talk about the research by email, though not to scope paid work right now.
Data Health Validation
Three layers, in sequence. Source health (uptime, drop rate, time-sync drift, capture volume). Flow health (SRE golden signals per pipeline stage). Data quality (DAMA dimensions plus retention, per source). Failures show up before queries do. Methodology originally shipped at Corelight, and it gates everything downstream.
Read the data-health methodology →
Attack Surface Reporting Enablement
Trustworthy sources feed composite entities (Asset, User, Configuration, Vulnerability) mapped across tools. Entity owners certify what they own; coverage gaps are actively measured rather than papered over. The certification rhythm is what turns connected data into demonstrated coverage. Available after Offering 1 has cleared the data-health gate.
Read the engagement detail →
MOAR Architecture Design
MOAR (Modular Open Architecture) is the design track for greenfield or post-Splunk environments. There were two entry points, plus a two-week discovery wedge that fed them. Modernization Discovery was the wedge: a shortlist plus a reference-architecture workshop plus a Splunk billing audit, which sized the assessment before anyone committed to it. The Splunk-to-MOAR Migration Assessment was the main migration analysis. The evidence under the assessment is two-regime, and I report both halves: a schema-on-read index wins the simple indexed lookups, and the lakehouse engines win the hunting-shaped aggregations by 5–62× — 46.8× native / 10.1× Iceberg on the five-query average (Tier B, single host, 10M events, CV-gated, identical answers verified). Among compliant engines the join spread is compressed at SOC scale (every engine under 1.5 s), so the engine recommendation leads with manageability. The Architecture Assessment was the full vendor-neutral review against the matrix, covering storage, engine, 3-year TCO, and a phased roadmap, validated on the client's workload rather than the brochure.
The design track in full: principles, detection strategy, economics, roadmap →
Discovery · 2 weeks
Modernization Discovery
Discovery wedge. Tailored Capability Matrix shortlist plus half-day reference-architecture workshop plus Splunk billing and license audit.
Wedge · 2–3 weeks
Splunk-to-MOAR Migration Assessment
The two-regime benchmark (the lakehouse engines 5–62× faster on hunting-shaped aggregations, the index winning the simple lookups; 46.8× native / 10.1× Iceberg five-query average; Tier B, single host, 10M events, CV-gated) projected against your workload. Quantified TCO, engine recommendation, risk register, phased roadmap, executive deck.
Foundation · 2–4 weeks
Architecture Assessment
Vendor-neutral review against the matrix. 5-step audit, 12-scenario decision framework, component selection, 3-year TCO, phased roadmap.
The Architecture Assessment review runs against the matrix; you can see how that scoring works on the worked scorecard.
Reference Implementation Deployment
The plan was to stand up the open MOAR Reference Stack in your environment: the kit deployed against 2–5 of your own log sources, landing OCSF on Iceberg; the data-health gate running on your telemetry (the first broken-piece fix, live); a working multi-engine query path over the landed data, engine choice per the Matrix bundle; and a runbook with a keep-or-teardown decision at the end, reversible by design. It hadn't been priced before the pause, and it was scoped as a reversible trial rather than a production SOC migration or a managed service.
Implementation Support · Advisory Retainer
Embedded (1–2 days/wk during active migration), advisory (monthly strategy plus async review), or workshop (1–3 days). Continues across whichever of the three offerings are active.
Read the engagement detail →
Partner delivery
The model was that a delivery partner would run the MOAR Reference Stack under their own SLA while Security Data Works verified the architecture, with no reseller margins and no kickbacks, so a partner could accept a "stay and optimize" recommendation against their own implementation margin. No delivery partner was ever named, and that work is paused along with the rest of the practice.
What the public record shows
Measured outcomes from published deployments.
These are publicly attributable numbers from teams running the patterns the matrix recommends. Each one is sourced, whether to the team that published it, a reproducible SDW measurement, or an SDW model labeled as such. Full pipeline detail and trade-offs live on references; the anonymized engagement narratives behind comparable numbers live on case studies.
$70K → $5K/mo
Huntress migrating off Elasticsearch onto ClickHouse Cloud. A reported >90% cost reduction at the analytics tier; throughput grew to 200K records/sec.
ClickHouse · published
46.8× faster
SDW Zeek benchmark (single host, Tier B, 10M events), CV-gated, identical answers verified. Two-regime: the lakehouse engines win the hunting-shaped aggregations by 5–62× over a schema-on-read SIEM baseline (46.8× native / 10.1× Iceberg on the five-query average), and the index wins the simple lookups. Compression on the same corpus: 8.5× Iceberg Parquet vs raw JSONL, 9.0× ClickHouse blanket ZSTD-22.
ClickHouse · reproducible
80% faster TTD
Standard Chartered replaced a traditional SIEM with a self-managed Databricks lakehouse — 80% faster time-to-detect, 92% faster investigation, ~35% cost reduction (bank-reported, DAIS 2025).
Databricks · published
40% volume cut
Yale New Haven Health cut Palo Alto log volume by 40% across 30K endpoints with Cribl Stream while moving its SIEM to Microsoft Sentinel (Cribl customer story).
Cribl Stream · published
64% TCO at 1 TB/day
SDW TCO model for the route-reshape-reduce pattern at exchange-scale workload. 35% savings at 100 GB/day for smaller shops.
Cribl pipeline · modeled
Headline numbers travel; the methodology and caveats travel with them. Each outcome is either published by the deploying team, reproducible via the SDW benchmark methodology, or documented in the research surface, with evidence tier and confidence stated.