Use case: security analytics at scale

SECURITY
ANALYTICS
AT SCALE.

Your SOC team spends more time waiting for dashboards than investigating threats. XERJ runs the same search-and-aggregate workload — filters, term lookups, aggregations — measured against Elasticsearch 8.13, on a single node instead of a 4-node ES cluster.

REPRODUCIBLE · ES 8.13 · demo/playbooks/SCORECARD.md

XERJ ES 8.13

Bool query 1.38 ms 15.90 ms 11.5×

Range filter 1.34 ms 4.66 ms 3.5×

Match query 0.57 ms 1.45 ms 2.5×

Terms + avg sub-agg 0.38 ms 1.16 ms 3.1×

Date-histogram agg 0.37 ms 0.88 ms 2.4×

Cardinality agg 1.15 ms 1.92 ms 1.7×

Term query 1.36 ms 2.15 ms 1.6×

Terms aggregation 1.34 ms 1.54 ms 1.15×

P50 · 1M-DOC LLM-TELEMETRY CORPUS · FULL 91-CELL MATRIX AT xerj.org/benchmarks →

THE ELASTICSEARCH PROBLEM

Slow aggregations stall investigations. A terms aggregation on source_ip lags on ES; in a live incident, that delay compounds across dozens of pivots.
Cluster complexity adds ops burden. A production ES SIEM cluster needs multiple nodes, dedicated master election, shard tuning, and a team that understands JVM heap sizing.
Cost scales linearly with retention. Every day of retention adds shards, replicas, and heap. Compliance says "keep 90 days"; finance says "cut nodes".
Vendor lock-in via licensing tiers. ES paywalls RBAC, SSO, and ML-based detection behind Platinum+. The features your SOC needs most are the ones that cost the most.

THE XERJ ANSWER

Faster queries, reproducibly. A full bool filter runs in 1.38 ms vs 15.90 ms on ES (11.5×); the terms aggregation in 1.34 ms vs 1.54 ms — every time, without warm-up.
One binary, zero cluster ops. No master election, no shard calculator, no JVM tuning. A single xerj binary replaces the 4-node ES cluster.
Smaller on disk, no JVM heap. The same corpus is 672.5 MB on XERJ vs 806.7 MB on ES — 1.20× smaller — with no GC pauses to size around.
All features in one tier. RBAC, API-key auth, TLS, aggregations, hybrid search — every feature ships in the binary. No Platinum gate.
90-day retention is one config line. [logs] retention_days = 90. No ILM policies, no rollover aliases, no curator scripts.

READY?·REQUEST ACCESS

RUN IT ON
YOUR DATA.

Send us your SIEM event schema and a 24-hour sample. We'll run the head-to-head on your data and send back the numbers — with the reproduction scripts so you can verify.

Use case: security analytics at scale

THE ELASTICSEARCH PROBLEM

THE XERJ ANSWER

SEE IT LIVE.

RUN IT ONYOUR DATA.

RUN IT ON
YOUR DATA.