Go jump in a lake: Data storage for the win

This blog explains how to reduce SIEM costs and improve scalability by using a data lake architecture built on columnar storage (Parquet), Apache Iceberg tables and catalogs, and distributed querying with Apache Spark. It outlines benefits such as compression, faster columnar searches, decoupled storage/compute, and large-scale querying, highlights consumption-based cost risks, and provides a high-level roadmap for building a data lake across ingest, store, process/analyze, and explore/visualize phases, with examples and tooling options.