So realtime security analytics is one of the areas of information security where buzzwords been applied just to make it seem more exciting, but what does it actually mean to be in realtime? So it's really the convergence of three areas, SIEM security incident and event management, forensics, and big data. Big data itself is still an area with a lack of clarity around it, but put simply it's the ability to process large amounts of data very quickly. This makes the investigations carried out by the S IEM technology quicker and more accurate in a shorter period of time.
Whether these investigations are actually real time or just as close as we can currently get is another matter though, relative to existing technologies, they promise quicker identification and resolution, hence their value to security, operations and technology itself. Isn't judged on its speed of operations, however, but by its levels of automation, whether it assists operational staff in their roles and reduces the manual intervention, the tools will need to be integrated and accurate because of this. And it's only when they fail that they'll be judged on the delays they introduce.