SIEM with Anomaly Detection Using Machine Learning and ksqlDB

This post introduces the integration of Latent Dirichlet Allocation (LDA) machine learning models into ksqlDB via User-Defined Functions (UDFs) for real-time anomaly detection in streaming data. It details a Lambda Architecture approach for training LDA models in batch and scoring incoming osquery logs in real-time. The post explains how ksqlDB queries are used to route scored events into 'GOOD', 'BAD', and 'UGLY' topics based on anomaly scores, enabling SIEM integration and feedback loops for model retraining.