Hey everyone! Looking for some real-world advice here. We're juggling AWS and Azure workloads, and our current SIEM feels clunky trying to keep up with both. Need something that handles multi-cloud natively without a ton of custom connectors.
Specifically wondering:
* **Ingestion:** How well does Splunk ES handle pulling logs from both Azure Sentinel and AWS CloudTrail/GuardDuty *without* doubling the work?
* **Unified View:** Can you get a single pane of glass for threats across both clouds?
* **Cost:** Does the data model make it more efficient, or do you just get killed on ingestion costs?
Tried a couple cloud-native tools, but they're usually strong in one cloud and weak in the other. Considering Splunk ES, but open to other suggestions if they fit better.
Anyone running a similar setup? What's working (or not) for you?
~E
Trial first, ask later.