This article draws on widely accepted definitions of SIEM and log management plus recent public-sector guidance for prioritising SIEM ingestion. It avoids product-specific recommendations.
What Each System Is For
SIEM (Security Information & Event Management)
- Real-time security analytics, correlation, alerting, investigations, and case workflow
- Integrates threat intelligence and maps detections to adversary behaviours (MITRE ATT&CK)
- Optimised for high-fidelity, security-relevant signals that drive detection and response
Log Management / Observability
- Collection, storage, search, dashboards, and long-term retention for operational and audit needs
- Ideal for verbose telemetry: success auths, health/heartbeat, component logs, metrics, and traces
- Optimised for cost-efficient storage and broad analytics — not real-time threat correlation
Routing Pattern: Put Data Where It Creates the Most Value
Adopt a tiered routing strategy at the pipeline or agent layer. Keep identity, endpoint, network-security, and cloud control-plane events that power detections in SIEM hot storage; send verbose operational logs to log management with lifecycle policies. Enrich at the edge so your detections stay precise while volumes stay lean.
Decision Checklist: Does This Event Belong in SIEM?
- Detection mapping: Is the event referenced by a current or planned detection/use case (ideally ATT&CK-mapped)? If no — default to log management.
- Investigation value: Does the field set materially advance triage/root cause within T+24h of an alert?
- Regulatory requirement: If retention is mandated but detection value is low, store outside SIEM with controlled recall.
- Duplication: Is the same signal represented by another, cleaner source? Keep one; drop or summarise the rest.
- Quality score: Reject events that fail parsing, lack required keys, or violate schema standards.
Cost Levers That Don't Kill Fidelity
- Field pruning: retain only the fields referenced by detections and investigations
- Summarisation: roll up high-frequency successes (auth OK, health) into counts with first/last timestamps
- Sampling: for extremely chatty sources where full fidelity is not required
- Tiered retention: hot days, warm weeks, cold months, archive years — with restore workflows
- Schema standardisation: map to a common schema to avoid storing multiple shapes of the same data
Example Placements
Keep in SIEM (Hot)
- Auth failures, MFA challenges, privilege escalations
- Endpoint prevention / EDR alerts and process ancestry
- Network security denies, IDS/IPS alerts, east-west anomalies
- Cloud audit / control-plane changes (IAM, keys, policy updates)
Prefer Log Management
- Authentication successes at scale (summarised)
- Service health checks, component verbose/debug logs
- System performance metrics and traces
- Long-term audit copies for compliance
FAQs
Will moving data out of SIEM hurt investigations?
Not if you preserve investigative context (IDs, user/asset, timestamps) and support on-demand recall from log management or archive into the SIEM when needed.
How do I prove coverage didn't drop?
Track a simple scorecard: techniques covered, high-fidelity alert rate, false-positive rate, and mean time to detect/respond — before and after the changes.
Request a Discovery Call →
← All Articles