SIEM bills rarely grow because of new threats. They grow because telemetry grows, and most SIEMs charge by GB/day or events per second. This playbook shows how to bring ingestion down without weakening detection.
Why SIEM costs spiral
- Volume-based licensing ties cost directly to data growth.
- Keep-everything defaults store successful authentications, debug output and health pings that no rule uses.
- Hot retention for compliance: logs kept for regulators sit on the SIEM's most expensive storage instead of an archive.
The principle: route by security value
Keep detection-critical and investigation-supporting events hot in the SIEM. Send operational and audit-heavy streams to log management or a security data lake with lifecycle policies. Make sure analysts can recall archived data on demand.
Five levers that cut ingestion without losing fidelity
- Filter and deduplicate at the edge. Drop non-security noise and exact duplicates before ingestion. Keep filter rules as version-controlled code with peer review.
- Summarise high-frequency events. Aggregate successes by user, source and time window, keeping first seen, last seen and count. Roll up flow, DNS and proxy logs hourly, with exceptions for outliers.
- Prune unused fields. Map detections to the fields they read, drop the rest and standardise on one schema.
- Tier retention. Hot for 0–30 days of triage, warm for 30–90 days of investigation, and cold or archive for months to years of compliance, with documented restore workflows.
- Right-place routing. Identity, endpoint, network security and cloud control-plane events go to the SIEM. Verbose component logs, health checks and performance telemetry go to log management or observability tools.
What stays hot and what moves
| Keep in the SIEM | Move to log management or the data lake |
|---|---|
| Authentication failures and MFA prompts | Summarised authentication successes |
| Privilege changes and lateral-movement indicators | Service health and debug logs |
| EDR alerts with process ancestry | Metrics and traces for SRE teams |
| IDS/IPS alerts and deny actions | Long-term audit copies for compliance |
| Cloud audit changes to IAM, keys and policies | High-volume flow, DNS and proxy detail |
A 30-day cost-reduction plan
- Baseline GB/day and cost per source, and name the top five cost drivers.
- Map critical detections to required sources and fields, and mark unreferenced fields for pruning.
- Implement drop, dedupe, enrich and summarise policies in a security data pipeline.
- Move compliance retention to cold storage outside the SIEM, with tested recall.
- Track cost per day, true-positive rate, false-positive rate and MTTR before and after.
What success looks like
- 30–60% lower SIEM GB/day on non-critical sources.
- Stable or better true-positive rates.
- Faster investigations, because analysts search cleaner data.
Frequently asked questions
Which logs should we never filter out of the SIEM?
Anything referenced by an active detection or used in the first 24 hours of triage: authentication failures, privilege changes, EDR and IDS alerts, and cloud control-plane changes.
Do we need a new SIEM to cut costs?
Usually not. Most savings come from pipeline filtering, tiered retention and licence right-sizing on your current platform. Migration only makes sense with a clear capability or cost case.