USE CASE · SECURITY ANALYTICS

SECURITY
ANALYTICS
AT SCALE.

Your SOC team spends more time waiting for dashboards than investigating threats. XERJ runs the canonical SIEM query battery — top source IPs, auth-failure clustering, lateral movement detection — at 74× the speed of Elasticsearch, on a single node that costs a fraction of a 4-node ES cluster.

SIEM QUERY BATTERY · P95 LATENCY · 1M EVENTS

XERJ ES 8.13

Top source IPs 0.4 ms 29.8 ms 74.5×

Auth failures / hour 0.3 ms 18.2 ms 60.7×

Lateral movement 1.2 ms 45.1 ms 37.6×

DNS tunneling 0.8 ms 32.7 ms 40.9×

Process tree anomaly 2.1 ms 89.3 ms 42.5×

Data exfil > 10 MB 0.6 ms 22.4 ms 37.3×

Brute force detection 0.5 ms 41.0 ms 82.0×

Geo-impossible login 1.8 ms 67.2 ms 37.3×

THE ELASTICSEARCH PROBLEM

Slow aggregations kill investigations. A terms agg on source_ip across 1M events takes 29.8 ms on ES. In a live incident, that delay compounds across dozens of pivots.
Cluster complexity adds ops burden. A production ES SIEM cluster needs 4+ nodes, dedicated master election, shard tuning, and a team that understands JVM heap sizing. That team costs $150K+ per engineer.
Cost scales linearly with retention. Every day of retention adds shards, replicas, and heap. Compliance says "keep 90 days"; finance says "cut nodes".
Vendor lock-in via licensing tiers. ES paywalls RBAC, SSO, and ML-based detection behind Platinum+. The features your SOC needs most are the ones that cost the most.

THE XERJ ANSWER

74× faster aggregations. The same top-source-IP query runs in 0.4 ms — sub-millisecond, every time, without warm-up.
One binary, zero cluster ops. No master election, no shard calculator, no JVM tuning. A single xerj binary replaces the 4-node ES cluster.
21× less memory at idle. 400 MB RSS vs 8.5 GB across 4 ES nodes. That translates directly to smaller instances and lower cloud bills.
All features in one tier. RBAC, API-key auth, TLS, aggregations, hybrid search — every feature ships in the binary. No Platinum gate.
90-day retention is one config line. [logs] retention_days = 90. No ILM policies, no rollover aliases, no curator scripts.

SEE IT LIVE.

The playbook walks the full recipe — schema, ingest command, queries, and the dashboard. The playground runs on seeded data; benchmarks were measured against Elasticsearch 8.13 on 2026-04-14.

OPEN THE PLAYBOOK → OPEN THE PLAYGROUND →

READY?·REQUEST ACCESS

RUN IT ON
YOUR DATA.

Send us your SIEM event schema and a 24-hour sample. We'll run the head-to-head on your data and send back the numbers — with the reproduction scripts so you can verify.

SECURITYANALYTICSAT SCALE.

THE ELASTICSEARCH PROBLEM

THE XERJ ANSWER

SEE IT LIVE.

RUN IT ONYOUR DATA.

SECURITY
ANALYTICS
AT SCALE.

RUN IT ON
YOUR DATA.