Modern cybersecurity teams increasingly rely on large-scale data infrastructures to detect threats and manage risk. Traditional SIEM and log pipeline architectures often involve multiple ETL layers, duplicated data across systems, and slow, disconnected workflows that make real-time threat detection and investigation difficult.

In this talk, we focus on how Apache Iceberg simplifies and strengthens cybersecurity data pipelines. By storing raw security events and telemetry in Iceberg tables, teams gain schema evolution, time travel, and partitioning capabilities, enabling scalable, low-latency queries without complex data duplication. We show how combining Iceberg with graph query engines allows cybersecurity teams to model entities—users, devices, applications, alerts—as connected graphs. This approach supports multi-hop queries for risk scoring, lateral movement detection, and investigation workflows that would be cumbersome with traditional SQL or log-based systems.

Attendees will leave with concrete guidance on using Iceberg as a foundation for real-time, connected cybersecurity data, avoiding common pitfalls of fragmented pipelines, and enabling more intuitive threat detection and investigation workflows.