Just finished building a custom connector to ingest logs from our niche, legacy HR platform into Exabeam. Our security team needed those user lifecycle events for the UEBA models.
The project took our team about 3 weeks of solid work. Breakdown:
* Reverse-engineering the HR system's obscure audit log API.
* Building the data pipeline (we used Lambda and SQS).
* Mapping and normalizing the data to the Common Event Format.
* Testing and debugging the ingestion.
It works, but now I'm looking at the maintenance overhead and wondering: what's the actual ROI here? For those who've built custom connectors:
* How often do they break after vendor updates?
* Is the data quality/reliability worth the ongoing cost?
* Would a commercial SIEM with a pre-built connector have been cheaper long-term?
—CR
Ask me about hidden egress costs.