Case Study: CrowdStrike scales real-time security analytics with StarTree Pinot

CrowdStrike handles 25,000 queries per second with StarTree

The cybersecurity firm CrowdStrike faced the challenge of managing highly variable data loads from its Kafka event streams and needed to perform real-time security analytics to detect threats like data exfiltration. To address this, they partnered with vendor StarTree and implemented the Apache Pinot real-time distributed OLAP datastore to build a scalable analytics and monitoring system.

StarTree's solution involved using Apache Pinot as the core analytics engine, which was fed by a preprocessing layer that converted complex Protobuf events into lean JSON. This allowed CrowdStrike to build a resilient, multi-tenant system that handles 120,000 events per second and supports 25,000 queries per second across more than 10 clusters, enabling real-time threat detection and ensuring system stability.

CrowdStrike