Hi everyone 👋
Has anyone else noticed a significant performance hit after applying the latest patch to their Exabeam environment? I just updated our SIEM cluster (we're on version 7.3, patch .1) over the weekend, and since Monday morning, our investigative queries are taking almost twice as long to complete. This is starting to impact our team's incident response times, which is a major concern for our on-call rotations.
Here's what I'm observing specifically:
- **Timeline Searches:** Previously, a 24-hour user behavior timeline for a high-risk account would return in 8-10 seconds. Now it's consistently 18-22 seconds.
- **Rule-Based Alert Correlations:** Our custom rules that join data from multiple log sources are timing out more frequently, where they used to complete within the 30-second window.
- **Dashboard Load Times:** The executive summary dashboards, which auto-refresh, are now causing browser warnings due to extended loading.
I've already done some basic triage on our infrastructure. Our resource utilization *looks* normal—no spikes in CPU, memory, or disk I/O on the data nodes. The queues aren't backing up either. It feels like a query execution plan or indexing issue introduced by the patch.
```bash
# A snippet from our monitoring for the query service node
# Post-patch, the latency percentiles have shifted upwards noticeably
QUERY_LATENCY_P99 before: 1450ms
QUERY_LATENCY_P99 after: 3200ms
```
My current workaround has been to add more aggressive caching for common lookup tables, but that's just a band-aid. I'm curious if others are seeing this and what your approach has been.
- Did you roll back the patch, or push forward with tuning?
- Have you engaged Exabeam Support, and did they provide any specific configuration parameters to adjust?
- Are certain query types (e.g., aggregations vs. raw event searches) affected more than others in your case?
I'm planning to dive into the query engine logs next to compare execution steps. If there's interest, I can share a before/after breakdown of what I find. Slower queries in a security context can have real consequences, so I'm hoping we can pool some insights here.
— francesc
— francesc