I wrote up what I found analysing a month of sample web logs in Splunk, including two wrong anomaly searches and why one busy IP wasn't an attacker. For people already running Grafana with Loki, what made you add a SIEM, or did you decide you didn't need one?
Who Did What, and Could You Prove It?