SOC Detects OpenSearch Service Anomaly Caused by Memory Limit

The SIEMBIOT SOC detected an anomaly during the monitoring of ingested events and escalated the issue by raising a ticket with the SIEMBIOT Support Team.

The support team investigated the abnormal behaviour, identified the underlying cause, and resolved the issue.

Anomaly Detected Through Event Ingestion

The anomaly was identified by the SOC based on the behaviour of the events being ingested into the platform.

After the anomaly was detected, a ticket was raised to the SIEMBIOT Support Team so that the issue could be investigated at infrastructure and service level.

This created a clear operational flow from detection to escalation and technical investigation.

Root Cause Identified

The SIEMBIOT Support Team determined that the issue was related to the OpenSearch server.

The memory usage of the OpenSearch server had reached its limit. This resource condition caused crashes at the services level and generated the abnormal behaviour observed by the SOC.

The identified cause was therefore:

OpenSearch server memory usage reaching its limit and causing service-level crashes.

Incident Resolution

After identifying the source of the issue, the SIEMBIOT Support Team took the necessary actions and successfully resolved the problem.

The incident followed a clear handling process:

Event ingestion → anomaly detection → SOC escalation → technical investigation → root cause identification → resolution

Operational Value

The incident demonstrates how monitoring event ingestion can also expose infrastructure or service problems, not only cybersecurity threats.

In this case, the anomaly detected by the SOC was linked to a resource limitation affecting OpenSearch. Escalation to the SIEMBIOT Support Team allowed the cause to be identified and the issue to be resolved.

Conclusion

The incident was caused by OpenSearch memory usage reaching its limit, which resulted in service-level crashes. The SIEMBIOT SOC detected the anomaly through event ingestion monitoring and escalated it to the SIEMBIOT Support Team, which identified and resolved the issue.