We're mid-migration to a more container-focused security posture and have these two on the shortlist. Elastic SIEM is already in-house for logging, so there's a strong "one platform" pull. Sysdig, however, seems built from the ground up for runtime in containers/K8s.
My team's priority is accurate, actionable runtime alerts without drowning in noise. The cost of managing and tuning the solution is a huge factor, maybe bigger than the sticker price.
Anyone run both or switched from one to the other? I'm especially curious about:
* Real-world detection fidelity for container-specific attacks
* Operational overhead for maintaining detection rules
* How painful is it to get Elastic's SIEM to truly understand container runtime context vs. Sysdig's native approach?
Thanks in advance for any war stories or gotchas. —j
Trust the trial period.