CDN Monitoring for Financial Services With Hydrolix

CDN infrastructure allows customers to connect with their bank’s mobile app, online portal, and customer-facing APIs. That infrastructure absorbs attack traffic before it reaches origin, takes load off core systems, and for banks using multi-CDN architecture, routes around regional failures. Every session, whether started by customers, bots, or malicious actors, begins with a request that passes through one or more CDNs.

However, banks and finservs usually don’t have a complete record of requests passing through the edge. Edge logs can run to terabytes a day, leading to heavy sampling and discarded data. Aggregate data may be retained for dashboards while the underlying raw data is thrown away. 

Even when data is collected, it typically ages out at 30 to 90 days, well short of the timelines that breach investigations usually require. These issues arise because of traditional monitoring architectures that struggle with the log volume that CDNs generate, forcing ops and infrastructure teams to choose between their data and unsustainably high costs.

Hydrolix was designed to solve these problems. It provides real-time analytics on full-fidelity logs and allows teams to retain that data long-term at a fraction of the cost of other platforms, all while keeping data hot for querying regardless of its age.

Complete Visibility Even When Traffic Spikes

Many scenarios can cause a finserv’s edge traffic to spike, from credential stuffing and DDoS attacks to major economic events, tax days, and paydays. Infra teams can plan around some of these events, such as major holiday shopping and tax days, but other events such as malicious attacks cause unpredictable spikes in traffic.

These scenarios put additional pressure on infrastructure, increasing the risk of performance issues and other problems, especially when infrastructure is under attack. Yet when traffic spikes, many monitoring solutions aren’t equipped to handle the load, leading to heavy sampling and dropped data. A single high-volume attack can push months’ worth of normal log data through an ingest pipeline in minutes. While sampling can reduce that log volume, attackers take advantage of the visibility gaps from sampling and dropped logs. These gaps cause delays with incident detection and mitigation during events. The issues are compounded when a breach or incident isn’t detected until months or years later, and the original record is missing because it was never captured in the first place.

Hydrolix ingests full-fidelity data with no sampling, even when streaming tens of millions of logs per second. During incidents or spikes, ingest capacity automatically scales up to ensure that all records are transformed, compressed, and written at full fidelity, with subsecond queries on data regardless of age.

For example, during the 2025 Super Bowl, FOX Sports ran CDN logs from four providers through Hydrolix and ingested close to 200 terabytes in roughly four hours, peaking at 17.4 GB per second, with a time to glass of five to ten seconds and a median query time of 0.481 seconds across 55,000 queries. While banks and finservs typically don’t require Super Bowl capacity, they do need to have the flexibility and capacity to handle volumetric attacks and other events that can spike traffic 10x or more.

Complete Data Access Across Teams for Historical Data

When a breach occurs and customer card data gets stolen, investigators need to trace exactly what happened: which files were tampered with, when, and whose sessions were affected. PCI DSS (Requirement 10.5.1) requires a year of log retention, with the last three months searchable on demand, for every system that touches cardholder data or could affect its security. CDN infrastructure is a critical part of the request path to banking portals, apps, and login pages, which puts it squarely in scope even if requests don’t store card data. If CDN logs are deleted too soon or require extensive rehydration from frozen storage, it’s much harder to answer the questions that matter most: how long has an incident been happening, and who’s affected? As a result, what would have been a contained incident can turn into an open-ended breach notification, resulting in financial and reputational liability instead of a passed audit.

Beyond compliance, new threats surface constantly. The first questions are always the same: “was the business exposed, and for how long?” Because CDN logs capture request-level detail, including source IPs, user agents, and URI patterns, they can help security teams understand whether a known bad actor ever breached or attempted to breach banking portals, apps, or login pages. Threat hunting is only possible when the historical data is available to query. The same applies to credential-stuffing and account-takeover campaigns, which leave traces in CDN logs alongside signals from other log sources.

Increasingly, traditional platforms are addressing these issues, and complex data restoration processes are no longer necessary for solutions like Splunk and Datadog. However, there are significant tradeoffs in terms of functionality. Splunk Federated Search for S3 isn’t intended for real-time or high-frequency searches, and queries are much slower. Meanwhile, Datadog’s Archive Search loses functionality like visualizations and aggregations. These tradeoffs impede threat hunting and scenarios with significant time pressure, such as security investigations and regulatory reports.

In Hydrolix, all data remains hot for queries regardless of age. All functionality, including visualizations and aggregate tables, are available without loss of functionality for older data. Because Hydrolix uses high-density compression and retains all data in object storage, teams can retain data long-term at a fraction of the cost of other solutions. For teams that use their own object storage with Hydrolix, a financial institution storing data in an S3 bucket at 20x compression will pay approximately $1.15 per month per raw terabyte after it is compressed (with a compressed size of approximately 50 gigabytes instead of a full terabyte.  Just as importantly, there are no additional rehydration or query limits on older data.

Maximize the Value of Multi-CDN Infrastructure

Financial institutions that run multiple CDNs typically do so for performance, failover, and price control. For entities in scope of DORA, there’s a regulatory dimension as well: before entering or materially changing a contract for ICT services that support a critical or important function, Article 29 requires a preliminary assessment of concentration risk. Multi-CDN architecture is one approach to mitigating that risk.

To fully benefit from a multi-CDN architecture, though, teams need to be able to evaluate and correlate performance across CDNs. If there’s an outage or high error rate in a specific region, can it be isolated to a particular client ASN, a set of CDN PoPs, or the provider as a whole, and is it worth steering traffic to another CDN? Where in the request path is the issue occurring, and can edge networks be eliminated as a possible issue, making it easier to pinpoint the source of the problem?

Traditionally, comparing performance across CDNs has been a time-consuming manual process. Each CDN has its own schemas, field mappings, and measurements. Meanwhile, JOIN statements across disparate, high-volume data sources are both slow and expensive.

To solve these problems, Hydrolix maps every CDN provider to a common schema at write time through a streaming ETL (extract-transform-load) process, so normalized data lands in one raw table alongside summary tables that provide high-level views across providers and by individual providers. Hydrolix offers CDN Insights, a prebundled solution that provides dashboards across providers with the ability to drill down into raw log data.

The following demo shows how CDN Insights can be used to identify an issue that seems to be specific to a single ASN, but is in fact a problem with a missing asset.

Lower Splunk Costs With No Migration Risk

Many banks and finservs use Splunk for log management and SIEM, but Splunk is a very ghostly choice for ingesting and retaining high-volume log sources. The answer isn’t a rip and replace that takes Splunk out of the equation. Vendor migrations are risky and time-consuming, and many teams prefer using Splunk.

With the Hydrolix Search for Splunk app, teams can ingest high-volume log sources at full-fidelity into Hydrolix and then query that data in Splunk. Splunk users can continue using all of their detections and workflows. The integration uses the hdxsearch command and standard SPL, so Hydrolix queries look like any other search, and existing dashboards work as expected. In addition to CDN logs, teams can offload other high-volume security logs into Hydrolix. For teams using Splunk as a SIEM, this can dramatically reduce the cost of high-volume logs while keeping all logs full-fidelity and queryable for fast searches regardless of age.

Navy Federal Credit Union Cut Incident Resolution From Hours to Minutes

Navy Federal Credit Union is the largest credit union in the U.S., with over 80% of its members banking through mobile or online.

After a round of updates to its mobile and browser infrastructure, the team couldn’t isolate problems between the origin and edge quickly enough. SIEM and observability tooling were separate systems, with no straightforward way to correlate synthetic transactions against security events. A login or server issue opened an incident bridge with roughly 20 people across global regions, each running individual checks against an incomplete view.

Navy Federal considered building a solution in-house, but it would’ve involved a full ELK stack, extra engineering hours, new hires, and ongoing ingest, storage, and compute costs, with no guarantee it would work. Navy Federal was already an Akamai customer, so it evaluated TrafficPeak, a Hydrolix observability service available on Akamai Connected Cloud. The proof of concept took a couple of weeks, with Hydrolix handling configuration and ingest.

Cloud engineering, API engineering, incident management, digital banking, and the C-suite now all work from the same data. The team uses that data to validate releases and roll back bad changes.

Next Steps

With a proof of concept, teams can quickly get started with full-fidelity CDN logs, with full visibility in Splunk, Grafana, or other visualization tools. Most teams have enough evidence to decide within a few weeks. Get a quick value assessment from an expert.