A hospital network changes SIEM vendors with zero monitoring gap

Sector

Multi-site healthcare delivery

Constraint

Continuous monitoring required

Sources

More than two hundred

Component

CyberAIX Pipeline, CyberAIX Federated Search

Starting point

The incumbent analytics contract was ending and a replacement had been chosen. Regulatory obligations meant monitoring could not lapse for any interval. The team's previous migration had involved a weekend cutover followed by weeks of rebuilding parsers and rules, and nobody wanted to repeat it.

More than two hundred sources fed the incumbent, many configured by staff who had since moved on. Repointing each of them twice was not considered acceptable.

What was done

One repoint, upstream. CyberAIX Pipeline was introduced in front of the incumbent as a pass-through. Every source was pointed at it once. From that moment, adding or removing an analytics platform was an edit to a routing table.

Mirror and compare. The new platform was added as a second destination receiving an identical stream. A daily per-source event count comparison caught several sources whose parsing behaved differently on the new platform, early enough to fix without pressure.

Triage the rulebook. Detection content was sorted into protected, live, and dormant groups. Protected and live rules were translated first; because the pipeline had already normalized fields, most translations were syntactic. The dormant group was reviewed and largely retired rather than carried over.

Prove parity under load. Analysts continued working in the incumbent while every alert was checked for a matching alert in the new platform. Mismatches were tracked to zero. An adversary emulation exercise was run against both platforms simultaneously.

Flip on a criterion. Once mismatches had stayed at zero for an agreed period, analyst workflows moved. The incumbent was removed from the routing table after its contract ended, and its history was retained in object storage, searchable through CyberAIX Federated Search.

Result

• No interval without monitoring coverage at any point.
• Sources were reconfigured once rather than twice.
• The retained detection library was smaller, tested, and documented.
• Historical data stayed queryable without paying for a second platform.

Lesson

Deciding to switch when a measurable criterion was met, rather than when a contract expired, removed the pressure that had made the previous migration painful.