Launch HN: Matano (YC W23) – Open-Source Security Lake Platform (SIEM) for AWS
What distinguishes Matano&#x27;d existing or planned products from  Google Chronicle? Would you have any limits on data ingestion or retention?<p>Also, python detections sounds horrible! I love python but it sounds like you haven&#x27;t considered the challenges of detection engineering. This one of my main &quot;expertise&quot; if you will. You should think more in the lines of flexible sql than python. People who write detection rules to the most part don&#x27;t know python and even if they do it would be a nightmare to use for many reasons.<p>I hope someone from your team reads this comment: DO NOT try to invent your own query language but if you do, DON&#x27;T start from scratch. Your product could be the best people who like the fabulous splunk need to also like it. And for a security data lake, you must support Sigma rule conversion into your query&#x2F;rule format. Python is a general purpose language, there are very good reasons why no one else from Splunk,elastic, graylog, Google,Microsoft use Python. Don&#x27;t learn this hard lesson with your own money. Querying it needs to be very simple and most importantly you need to support regex with capture groups and the equivalent of &quot;|stats&quot; command from splunk if you want to quickly capture market share. I have used and evaluated many of these tools and have written a lot of detection content.<p>Your users are not coders, DB admins or exploit developers. They are really smart people whose focus is understand threat actors and responding to incidents -- not coding or anything sophisticated. FAANG  background founders&#x2F;devs have a hard time grasping this reality.