Julian Guica

You can watch the full video here:
youtu.be/HxCVEowQZLE

What is OCSF?

YouTube video by Julian Giuca What is OCSF?

There's a lot of grumbling about OCSF.

Here's why it's worthwhile:

www.youtube.com/watch?v=HxCV...

What if your SIEM only saw the logs that mattered?

youtube.com/shorts/EeOwf...

YouTube video by Julian Giuca See absolutely everything

You can see your entire data ecosystem like this:

youtube.com/shorts/ELa0W...

The old way...

YouTube video by Julian Giuca You've got data being ingested...

Take 60 seconds and watch this:
youtube.com/shorts/93spR...

Too many security teams blame the rule.

They tweak logic, write exceptions, tune thresholds, and still drown in false positives.

But the problem isn’t the rule. It’s the data feeding it.

Bad data in=bad alerts out.

Filter, shape, and enrich telemetry BEFORE it hits your SIEM.

👉 www.datable.io 👈

Detection engineers may have the hardest job in tech.

Their role is absolutely critical, they're ignored until something is wrong (rarely praised), and they're consistently pulled away from their core competency to solve other problems.

Am I wrong?

My 2 cents.

Do you agree?

The plan was simple:

Build Cribl for Datadog.

Big Problem. Clear Pain. Let's go.

—But no one adopted it.

Now I'm looking to SecOps folks for their opinion.

www.linkedin.com/pulse/one-ca...

Working on a post for Hacker News (the y combinator board).

Wish me luck.

Noisy, redundant security data?

Shape it, enrich it, and route it exactly where it’s needed IN THE PIPELINE—before it drains your SIEM.

Try Datable and make your logs work smarter, not pricier.

Should CISOs report to the CEO?

Usually it's CISO>CIO/CTO>CEO.

But I'm seeing CISOs role bloom into a copilot role more often. (At least in SF.)

YouTube video by Julian Giuca This Tech Company Sent The Largest Bill In History

Video worth watching in 2025:

youtu.be/gaWArqb13B0

Writing a whole article on this tonight.

Shape data in the pipeline, before it gets astronomically slow and expensive to query.

YouTube video by Julian Giuca Why Data Monitoring Got So Expensive (And How to Fix It)

How did data monitoring get so expensive?

Why are observability bills through the roof?

Watch here:
youtu.be/C1ubXpNo7AU

Secret sauce in this guide:

✅ Hidden Observability Costs
✅ Vendor Negotiation
✅ Data Optimization Strategies

Download it here: datable.io

SREs need secure pipelines. Pipelines others can't touch.

But PMs and BI teams need access to the right data, too.

With Datable, everyone gets a pipeline they control—secure, flexible, and theirs alone.

YouTube video by Julian Giuca Smart Observability Explained

REMINDER:

I have a full video explaining how to reduce #observability costs.

Free gold for any engineer who wants to have a massive impact on their company's bottom line.

www.youtube.com/watch?v=ZyN-...

Here's how it works:

This also makes it really easy for us to send the data to third party vendors. If we need to send something out in the Splunk or New Relic format, it’s not a problem.

We take it from that OTel format, transform it into their API, and send it on its way.

By normalizing, you ensure consistency. No more dealing with "user_ID" in one place and "userID" in another.

Since data comes from various sources, Datable supports a wide range of formats and protocols: Syslog, Json, Fluent, and open source protocols like the New Relic and Datadog wire protocols.

We treat everything as an event at my company.

Log data, trace data, metrics—everything.

And we normalize those events into the OpenTelemetry standard, creating a single, unified playing field for all of our data.

Here's why:

And who can blame them? The risk involved.

Developers, business teams—they get completely shut out.

It's a horrible feedback loop where the people who need the data most, can't touch it.

"Hey, I'm taking Apache data and converting it to structured JSON."

Great. No problem.

But the second you introduce multiple inputs, different teams, complex transformations—the whole system falls apart. One mod can break everything.

So what do SREs do?

They lock down the configuration.

OTel isn’t enough anymore. (THREAD)

Nobody tells you what happens when you use these tools in the real world.

Files get EXTREMELY difficult to manage.

They're great at collecting and sending data, but the more responsibility you put into them, the more complex and slower they become...

We normalize events into the OTel standard to create a unified playing field for all our data, regardless of origin.

Datable supports: Syslog, Json, Fluent—AND open source vendor protocols, like NR & DD.

By normalizing all our data, we ensure consistency even as data comes from various sources.

YouTube video by Julian Giuca Logs, traces, spans = Events

Had a video to share today but it's 62 seconds long and there's a hard 60-second limit here.

To see it on YouTube, go here:
youtube.com/shorts/Mz0S2...