point
Menu
Magazines
Browse by year:
June - 2014 - issue > CXO View Point
Harnessing Machine Data for Operational, Security Insights
Kumar Saurabh
Co-Founder & Vice President, Engineering-Sumo Logic
Monday, June 2, 2014
Sumo Logic, provides cloud-based service with real-time interactive analytics and transforms machine data into actionable insights for IT operations, application management, and security and compliance teams. Redwood City, based company,founded in 2010, has received a funding of $45 million from Accel Partners, Sutter Hill Ventures, Greylock Partners and Shlomo Kramer.

At this point, it is safe to guess that everyone in the IT sector has heard mention of Big Data. There is a general sense that all this data is a good thing and that it has the potential to offer information about network infrastructures, user experience and trends that has not been previously been seen. On the security side, especially, enterprises are counting on all this data telling them something about threats, potential points of attack, etc. But in an environment where machine data alone is expected to grow 15 times between 2012 and 2020, it can be daunting for the industry to understand how they can gain actionable insights from it. With industry analyst firm IDC predicting that the Big Data market will grow to $16.1 billion in 2014, there has never been a better time to be seeking for answers to these questions.

Since I was a child, I have been fascinated with chess playing programs. Not long after I abandoned my personal crusade against these programs, a chess program called "Deep Blue" beat world champion Garry Kasparov. Machine learning, the new master of chess, will also arise as the solution to the Big Data challenge. The patterns recognizable to those playing chess are also recognizable in large terabyte-size sets of data.

Starting at my time leading log and analytics within engineering at ArcSight, I saw that a crucial intersection of human intelligence and machine learning has been missing. With log files, the "exhaust data" generated by applications, websites, servers and other IT infrastructure, a meeting of these two elements can offer a wealth of information that help enterprises adjust their supply chain to anticipate market demands, improve user experience, and detect fraud, to name a few. As I work with enterprises today, they see the business value of connecting data with business planning, but need help to see where they should be looking in their data for more valuable information.

A core challenge in the effort to produce analytics that are actionable from Big Data is to quantify the "unknown unknowns". If an enterprise knows what it's looking for, it can easily initiate a query within its log management system and pull the desired information. To look for insights and trends that you don't know are there in the first place is a head-scratcher. But with the right algorithms and technology that maps changes in data patterns, this can become possible. By enabling IT and security teams to detect "anomalies" in their machine data, they can discover critical insights for the business, alert other entities within the enterprise to evaluate the level of threat the anomaly represents, and share knowledge across the organization so that they can collectively learn to manage the issue in the future.

Unlike Deep Blue, machine data analytics should not be viewed as a replacement of or an attempt to supersede human intelligence. Human expertise is critical. Without an IT and security team that can understand the enterprise itself, its players and assets, analytics could not be put into action. No, what enterprises need to be more effective, understand their IT assets better and anticipate what is coming next, is access to their own data in a way that is consumable and intuitive.

One day in the near future, enterprises will have an even greater tool – the ability to work in a community to understand how the challenges within their IT infrastructure compare to those of other enterprises. While mining an enterprise's own machine data can reveal an incredible amount of information that improves operations and helps it improve its security posture, imagine what access to comparative data from other organizations could offer! If an IT professional could see if their system performance matched other similar organizations, or where another enterprise had optimized its infrastructure, that information could be invaluable. Building a "social" element to machine data analytics would represent a significant step forward in bringing collaboration to data that is today viewed in a silo.
Twitter
Share on LinkedIn
facebook