Dynatrace security AI roots out Log4j, sets tone for roadmap

Dynatrace CTO reveals security goals

Now, Dynatrace executives are explicitly targeting a broader set of dedicated security tools from competitors in their product plans, based on the Grail data management platform the company launched in October.

We are going to revolutionize security analytics for threat intelligence.

"We are going to disrupt how current SIEM [security information and event management] works," said Bernd Greifeneder, founder and CTO at Dynatrace, in a keynote presentation. "We are going to revolutionize security analytics for threat intelligence, because with Grail, we go beyond just logs."

While Dynatrace has aspirations beyond logs, Grail also represents a fresh attempt to improve Dynatrace's support for such data. Log analytics are clearly the first point of attack in the company's competitive plans -- namely, the log analytics vendors that are already established in security, such as Splunk and Sumo Logic.

The new Dynatrace Query Language was designed to appeal to IT pros familiar with Splunk's query language to make migration to Grail easier, Greifeneder said during his presentation, to applause from the audience.

These are long-range plans, added Bob Wambach, vice president of product marketing at Dynatrace, in a later interview with TechTarget Editorial.

"We're not trying to be a SIEM vendor this year," Wambach said. "But there are customers that are looking at the power we have in the data; there's definite market demand."

Some enterprise customers already deeply invested in Dynatrace said they are preparing to consolidate log analytics tools onto Grail and Dynatrace Application Security.

"Retention with Splunk is hard, because it directly ties to cost," said Cabrera, who uses Dynatrace AIOps tools to manage application performance and reliability.

Splunk introduced new pricing alternatives in response to customer cost complaints in 2021, but that hasn't helped in his case, Cabrera said.

"[Splunk pricing] is a reason I am starting to use Dynatrace logging more and more," he said. "With Grail coming, I could have everything under one roof."

Testing Grail's log analytics already has another customer -- Ken Schirrmacher, CTO and senior director of IT at Park 'N Fly, a travel services company in Atlanta -- planning to swap out Sumo Logic. Upcoming enhancements to Grail dashboards and reporting unveiled this week could also help it better compete with Splunk, Schirrmacher said.

These new features include automated and customizable reporting, Notebooks for exploratory data collaboration and more flexible visualizations, all of which Schirrmacher said he'd been waiting for Dynatrace to deliver.

"When we first got [access to Grail], it was a fairly feature-rich environment, but the No. 1 thing it's lacking was the robustness of its reporting capabilities," he said. "What I had suggested [to Dynatrace] was, 'If you could figure out a way to use ML or whatever algorithm you want to automatically build reports and whatever [dashboards] you want, you don't have to have anybody sitting there manually doing any of this coding … and that makes [my] job a whole lot easier.'"

Other Dynatrace customers sounded a more cautious note following a presentation about Grail at a conference keynote this week.

"With these announcements, it's clear we're going to have to have a migration path to take advantage of Grail and SaaS," said Randy Hunter, senior vice president of IT at America First Credit Union, a credit card company based in Ogden, Utah. "But we need to understand more about what Grail does to know where it fits. Right now, we have no plans to replace Splunk."

Security AI push 'just talk' for now

Tech analysts were also cautious about Dynatrace's plans to break into security product categories such as SIEM.

"Few organizations are looking to replace existing security tools with something like this … certainly not yet," Siegfried said. "But there's a lot of low-hanging fruit [for Dynatrace] in DevSecOps, vulnerability management, and software composition analysis -- that's more likely where they would go."

That's only if Grail performs as advertised, pointed out Andy Thurai, vice president and principal analyst at Constellation Research. So far, the data management platform is still adding key features, such as support for distributed tracing and metrics data, which is set to ship next quarter.

"I've got to see proof because it's all just sort of talk to me at this point," he said. "Grail is a good announcement … but I need to see more of it. When I say I'm looking for a log provider, does Dynatrace come to mind first? Absolutely not. Splunk still owns the game, along with newer log analytics players."

Still, enterprises are keen to consolidate the number of tools they use amid turbulent macroeconomic conditions. And while security in general has established incumbent vendors, security AI is still a young enough field for new competitors to break in, said Carlos Casanova, an analyst at Forrester.

"I just look at it as a new vendor entering that market, and I don't expect Dynatrace to be the only one to do it," Casanova said. "At the base levels, they offer very similar capabilities [to security analytics vendors] around detection of activity and devices, collection of sensory and telemetry data across the IT ecosystem and analysis for eventual action."

Beth Pariseau, senior news writer at TechTarget, is an award-winning veteran of IT journalism. She can be reached at [email protected] or on Twitter @PariseauTT.