A SIEM developer goes fishing in the data lake. What happens next?

TLDR: he misses a flow-based functional processing language.

Before getting into the topic, let me provide you some background and motivation, especially if you are about to embark on the 'Data Lake' wagon aiming at security use cases (SIEM).

The SIEM is not the default gateway for log data