USE CASE · SECURITY ANALYTICS

SECURITY
ANALYTICS
AT SCALE.

Your SOC team spends more time waiting for dashboards than investigating threats. XERJ runs the same search-and-aggregate workload — filters, term lookups, aggregations — measured against Elasticsearch 8.13, on a single node instead of a 4-node ES cluster.

REPRODUCIBLE · ES 8.13 · demo/playbooks/SCORECARD.md

XERJ ES 8.13

Bool query 1.38 ms 15.90 ms 11.5×

Range filter 1.34 ms 4.66 ms 3.5×

Match query 0.57 ms 1.45 ms 2.5×

Terms + avg sub-agg 0.38 ms 1.16 ms 3.1×

Date-histogram agg 0.37 ms 0.88 ms 2.4×

Cardinality agg 1.15 ms 1.92 ms 1.7×

Term query 1.36 ms 2.15 ms 1.6×

Terms aggregation 1.34 ms 1.54 ms 1.15×

P50 · 1M-DOC LLM-TELEMETRY CORPUS · FULL 91-CELL MATRIX AT xerj.org/benchmarks →

THE ELASTICSEARCH PROBLEM

Slow aggregations stall investigations. A terms aggregation on source_ip lags on ES; in a live incident, that delay compounds across dozens of pivots.
Cluster complexity adds ops burden. A production ES SIEM cluster needs multiple nodes, dedicated master election, shard tuning, and a team that understands JVM heap sizing.
Cost scales linearly with retention. Every day of retention adds shards, replicas, and heap. Compliance says "keep 90 days"; finance says "cut nodes".
Vendor lock-in via licensing tiers. ES paywalls RBAC, SSO, and ML-based detection behind Platinum+. The features your SOC needs most are the ones that cost the most.

THE XERJ ANSWER

Faster queries, reproducibly. A full bool filter runs in 1.38 ms vs 15.90 ms on ES (11.5×); the terms aggregation in 1.34 ms vs 1.54 ms — every time, without warm-up.
One binary, zero cluster ops. No master election, no shard calculator, no JVM tuning. A single xerj binary replaces the 4-node ES cluster.
Smaller on disk, no JVM heap. The same corpus is 672.5 MB on XERJ vs 806.7 MB on ES — 1.20× smaller — with no GC pauses to size around.
All features in one tier. RBAC, API-key auth, TLS, aggregations, hybrid search — every feature ships in the binary. No Platinum gate.
90-day retention is one config line. [logs] retention_days = 90. No ILM policies, no rollover aliases, no curator scripts.

READY?·REQUEST ACCESS

RUN IT ON
YOUR DATA.

Send us your SIEM event schema and a 24-hour sample. We'll run the head-to-head on your data and send back the numbers — with the reproduction scripts so you can verify.

SECURITYANALYTICSAT SCALE.

THE ELASTICSEARCH PROBLEM

THE XERJ ANSWER

SEE IT LIVE.

RUN IT ONYOUR DATA.

SECURITY
ANALYTICS
AT SCALE.

RUN IT ON
YOUR DATA.