
Christopher Witter
Cybersecurity leader specializing in threat hunting and detection & response; former leader of CrowdStrike's Falcon OverWatch; current roles at Dropbox and Nebulock.
1
APPEARANCES
1
PODCASTS
012
DEC 30
JAN 6
JAN 13
JAN 20
JAN 27
FEB 3
FEB 10
FEB 17
FEB 24
MAR 3
MAR 10
MAR 17
MAR 24
MAR 31
APR 7
APR 14
APR 21
APR 28
MAY 5
MAY 12
MAY 19
MAY 26
JUN 2
JUN 9
JUN 16
JUN 23
JUN 30
JUL 7
JUL 14
JUL 21
JUL 28
AUG 4
AUG 11
AUG 18
AUG 25
SEP 1
SEP 8
SEP 15
SEP 22
SEP 29
OCT 6
OCT 13
OCT 20
OCT 27
NOV 3
NOV 10
NOV 17
NOV 24
DEC 1
DEC 8
DEC 15
DEC 22
DEC 29
JAN 5
JAN 12
JAN 19
JAN 26
FEB 2
FEB 9
FEB 16
FEB 23
MAR 2
MAR 9
MAR 16
MAR 23
MAR 30
APR 6
APR 13
APR 20
APR 27
MAY 4
MAY 11
MAY 18
MAY 25
JUN 1
JUN 8
JUN 15
JUN 22
JUN 29
JUL 6
JUL 13
JUL 20
JUL 27
AUG 3
AUG 10
AUG 17
AUG 24
AUG 31
SEP 7
SEP 14
Jun 15, 2026
EP282: Debating Coupled or Decoupled SIEM with Alex Hurtado and Christopher Witter
15:24
15:41
15:50
16:03
16:09
A
15:15Anton ZhivakinHOST
What would it take you to overcome the resistance of no, no, no, I want one vendor, one tool? That's more of a winter question, maybe.

Christopher WitterGUEST
It would come down to like, you know, do I have the people to operate the tooling, right? It would be hard, I would say, because you think about what are the largest data sources for most organizations, right? You know, maybe it's my EDR, a 300,000 employee environment, right? And I don't have a lot of cloud or I'm moving to the cloud.

Christopher WitterGUEST
Like there are still organizations out there that unbelievably are still like on the fence, still have on prem, still, you know, doing their own data centers or something.

Christopher WitterGUEST
And so where is the source of all that data and pain? Because to Alex's point, like if I have someone who can write the parsers and I'm getting it for cheap and free, like I'm now DevOps tied to that forever.

Christopher WitterGUEST
When my firewall vendor moves a field, I break the entire pipeline and I have to dedicate people to that.

Christopher WitterGUEST
And they have to be aware of it, and then they have to fix it in a timely manner and maybe backfill data or whatever.
20 MINS LATER
A
36:43Alex HurtadoGUEST
I mean, unless they're coming out with MCPs, but I don't really see that happening yet.