Behind the Elastic Stack: Working with USAA

One of the upsides of working in a support capacity for a new and growing software stack is the opportunity to watch a customer installation go from the “green field” stage to become an integral part of their organization.  

At Elastic, each client is assigned a set of dedicated support engineers to assure the continuity of experience that comes from day-to-day familiarity with their installation and use case. USAA’s Cyber Threat Operations Center was one of my first accounts when I joined Elastic, and I was privileged to watch that transition their first year of deployment.

“As they become more comfortable with the products and start attempting harder, bigger, more ambitious things, we’re there to advise them along the way.”

At the beginning, there were a variety of “How do I do this?” and “Why isn’t this working?” types of questions that are common as an organization goes through the first stages of learning and deployment. As they learned how to address common initial production issues that are part and parcel of large deployments and how to design proactively to address them long term, these gradually segued into more complex and difficult items – topics such as “Where did my heap go all of a sudden?”, starting a discussion on how quickly fielddata can consume available memory, and how to use doc_values in your mappings to alleviate it.

And now, a little over a year later they’ve managed to make Elasticsearch an integral part of their threat management strategy – analyzing 2-4 billion security and server events per day originating from over two dozen feeds. They’ve also become evangelists, sharing the story we’ve witnessed internally with the larger Elasticsearch community. It’s a tangible implementation of how someone can utilize the entire Elastic Stack to add a significant business value.

“You want someone who is actively participatory in their solution, because not only does the problem get fixed, but they gain valuable skills and expertise.”

Neelsen Cyrus, the primary architect visionary for this system, is my primary point contact. He and all the other USAA personnel have always been curious, flexible, and engaged during all our interactions, and helping them achieve – and possibly even surpass – their initial goals has been more than gratifying. Meeting Neelsen at Elastic{ON}¹⁶ was one of the high points of the conference for me, and we look to continue building on an already significant achievement in the coming year (I also found out he is our customer with the most rocking tattoos . . . although we’re still waiting for the Elastic cluster logo to show up at some point!).

We took a few minutes to share what it’s been like working together so far in the below video – I hope you enjoy it.

Curious about how you can benefit from engaging further with the Elastic team? Don’t hesitate to contact us so we can tell you more – we’d love to learn more about your project.