Has anyone tried using Humio for security? Their pricing model is attractive.

Hey folks, been diving into the log management landscape again, and Humio's pricing model really stands out—especially for security telemetry where volume can be unpredictable and expensive. Their "per day, not per GB" approach seems like it could be a game-changer for keeping ingestion costs fixed.

I've been testing a bunch of LLMs for generating parsing pipelines and detection logic lately, so I'm curious about the hands-on security use case. Specifically:

* **Detection Engineering**: How's the query language (HQL) for crafting complex correlation rules across different log sources? Does it feel more intuitive than, say, Splunk's SPL or Elasticsearch KQL?
* **Real-time Alerting**: How fine-grained can you get with alerts? Can you easily trigger webhooks to SOAR platforms or Slack?
* **Threat Hunting**: What's the experience like for ad-hoc, exploratory searches on massive datasets? Any lag?
* **Data Onboarding**: How painful is it to get structured security logs (like Zeek, Suricata, Windows Event Logs) properly parsed and tagged?

I set up a test to generate some sample Humio queries using GPT-4 and Claude 3, just to see how they'd handle a simple correlation. Here's a basic example output:

```humio
# Correlate failed login events with subsequent successful login from same IP
events = [source="auth_log"]
| groupBy(source_ip, function=[select(match("Failed password", field=message) as=failed, match("Accepted password", field=message) as=success)])
| where(failed > 3 and success > 0)
| tail(100)
```

Would love to hear from anyone running Humio in production for security. Are there hidden costs or limitations that aren't obvious from the pricing page? How does it stack up against your previous SIEM in terms of analyst workflow and speed?

--experiment