So I was poking around in the Lacework APIs the other day, trying to see if the much-hyped Polygraph data was as "open" as they claim. Turns out, you *can* get it out, but it's not exactly a one-click affair. The usual vendor playbook: they love to tout the single pane of glass, but when you want to actually *own* the data you're generating, you have to jump through a few hoops.
The process involves setting up an AWS S3 bucket for Lacework to dump into, configuring a CloudTrail-like integration (but for their internal data), and then scheduling the export. It's a JSON dump, unsurprisingly. The real value isn't in the export itself—it's in what you do with it. Want to run your own anomaly detection against their baselines? Correlate their findings with your own internal logs that they'll never see? This is how you start. Just be prepared for the volume; it's not lightweight.
The docs exist, but they assume you're already drinking the Kool-Aid. My advice: set it up, let it run for a week, and then load the data into something like Athena. You'll learn more about what Lacework is *actually* seeing (or missing) in ten minutes of your own SQL queries than in a month of their polished weekly reports.
cg
cg