Case Study: ClickHouse builds a fast, scalable SIEM with RunReveal

ClickHouse replaces n+ many ETL pipelines with RunReveal to build a scalable SIEM

The customer, ClickHouse, faced a challenge with its in-house security logging program. Its original architecture relied on complex, custom Lambda ETL pipelines for each data source, which was difficult to scale and maintain. This engineering complexity prevented the security team from focusing on building effective threat detections. ClickHouse turned to the vendor RunReveal and its security data platform to overcome these obstacles.

RunReveal implemented a solution that replaced the many custom ETL pipelines with a singular, abstracted ingestion engine. This made adding new data sources incredibly easy and provided normalized, enriched logs. The results included a significantly simplified architecture, rapid visibility into critical infrastructure like VPC flow logs, and the ability to quickly stand up a security monitoring program with RunReveal's out-of-the-box detections.

ClickHouse