Why SIEM Costs Spiral
- Volume-based licensing — pricing tied to GB/day or EPS means telemetry growth directly drives cost.
- Keep-everything defaults — verbose logs (success auths, component debug, health pings) inflate bills without improving detections.
- Retention inside SIEM — long compliance retention held hot/warm instead of cold/archive tiers elsewhere.
Principle: Route by Security Value
Adopt a pipeline policy: keep detection-critical, investigation-supporting events in SIEM hot; move operational/audit-heavy streams to log management with lifecycle policies; ensure on-demand recall for investigations.
Five Levers to Cut Ingestion Without Losing Fidelity
1. Filter & Deduplicate at the Edge
Drop non-security noise (heartbeat, repetitive info events) and exact duplicates before they reach the SIEM. Maintain allow/deny patterns as code and peer-review all changes.
2. Summarise High-Frequency Events
Aggregate successes by principal/source/time-bucket; keep first, last, count. Create hourly rollups for flows, DNS, and proxy logs — with escape hatches for outliers.
3. Prune Unused Fields
Map detections to required fields; drop everything not referenced by rules or investigations. Standardise on a common schema to avoid storing multiple shapes of the same data.
4. Tiered Retention
Hot (0–30 days) for triage, Warm (30–90 days) for investigations, Cold/Archive (months to years) outside SIEM for compliance. Document restore workflows so analysts can recall detail on demand.
5. Right-Place, Right-Time Routing
Send identity, endpoint, network-security, and cloud control-plane events to SIEM. Send verbose component logs, health checks, and performance telemetry to log management or observability platforms.
What Stays Hot vs What Moves
Keep in SIEM (Hot)
- Authentication failures, MFA prompts, privilege changes
- Endpoint prevention / EDR alerts, process ancestry
- IDS/IPS alerts, deny actions, lateral-movement indicators
- Cloud audit / control-plane changes (IAM, keys, policies)
Prefer Log Management
- Authentication successes at scale (summarised)
- Service health, verbose component / debug logs
- Metrics & traces for reliability / SRE use cases
- Long-term audit copies with lifecycle policies
30-Day Cost-Reduction Plan
- Baseline: build a per-source GB/day and cost map; identify the top five cost drivers.
- Coverage mapping: link critical detections to required fields/sources; mark non-referenced fields for pruning.
- Edge policies: implement drop/dedupe/enrich/summarise in the pipeline; version-control the rules.
- Retention shift: move compliance retention to cold/archive outside SIEM with documented recall.
- Scorecard: track cost/day, high-fidelity alert rate, false-positive rate, and MTTR pre/post-changes.