SOC leaders should decide which events deserve full-fidelity retention based on enriched relevance, not raw volume alone. That means using context to identify high-value events, then sending lower-value telemetry to cheaper storage without losing recoverability. The governance point is to make retention a decision made with context, not an afterthought imposed after ingestion.
How to think about routing before SIEM, not after it
Routing decisions matter because SIEM is expensive when it becomes a dump for everything. SOC leaders should treat pre-ingestion routing as an information value problem: preserve what is likely to support detection, investigation, and later reconstruction, while avoiding blind retention of low-signal telemetry that will never be used. That requires context, not just event count.
The practical shift is to classify events at the boundary. Enrichment can add asset criticality, identity, source trust, business function, or known threat relevance before the event reaches long-term storage. When the context says an event has investigative value, keep it at full fidelity; when it does not, route it to lower-cost retention without making it unrecoverable.
This is also a governance decision. If routing rules are vague, teams tend to over-keep everything “just in case,” which creates cost pressure and weakens analyst attention. If the rules are too aggressive, the SOC saves money but loses the ability to reconstruct an incident path or prove what happened.
What makes an event worth full-fidelity retention?
High-value events are usually those that contribute to detection logic, chain-of-custody, or post-incident investigation. Examples include authentication failures tied to privileged accounts, administrative changes on critical systems, security control alerts with surrounding context, and events from crown-jewel assets or internet-facing services. A routing policy should recognise those patterns early enough to retain detail before normalization or sampling strips it away.
Context can also be negative. Some telemetry is noisy but still useful during live operations, while other data has little investigative value outside a very narrow window. SOC leaders should be explicit about which sources are always retained, which are retained only when enriched risk signals are present, and which are summarized or dropped after a defined window.
That distinction becomes especially important when event volume spikes during incidents. The right question is not whether a stream is large, but whether the stream is likely to matter if the organisation later needs to answer who did what, from where, and against which assets. Pre-ingestion routing should protect that question.
How to design routing so it saves cost without losing evidence
A durable routing model separates decision points by value. One layer enriches and scores the event. A second layer decides whether to keep full payload, keep a reduced record, or send it to cheaper storage. A third layer defines how long each class remains recoverable and under what conditions it can be promoted back into active investigation storage.
The best approach is usually deterministic rather than clever. Use clear criteria such as asset criticality, event type, user or workload trust level, known compromise indicators, and investigative usefulness. Sumo Logic breach 2023 is a useful reminder that credential compromise can quickly turn log and access infrastructure into part of the incident response problem, so routing should preserve enough fidelity to support later review of access paths and key rotation decisions.
Storage tiers should also preserve reversibility. If low-value telemetry is downsampled or archived, the SOC should still know what metadata remains, how quickly it can be retrieved, and whether it can support forensic reconstruction if a detection gap is discovered later. Cheap storage is only useful if the organisation can still answer the questions that matter.
Risk and Threat Considerations
Pre-ingestion routing creates two opposite failure modes. Over-retention raises cost and buries analysts in noise, but under-retention can erase the evidence needed to confirm compromise, reconstruct attacker activity, or validate whether a control worked. The security risk is not the act of filtering itself, it is filtering without a defensible value model.
Failure mechanism: Events are dropped, compressed, or archived before the SOC has enough context to know whether they are relevant to a later investigation, and the organisation cannot reliably recover the missing detail when an incident appears.
Impact: Detection quality drops, incident timelines become harder to prove, and responders may lose the evidence needed for containment, root cause analysis, or regulatory and legal review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.PO-01 — Policy Establishment and Communication | Routing before SIEM is a policy-driven retention decision. |
| Recommendation — Define event-routing policy so retention classes are approved before ingestion. | ||
| NIST SP 800-53 Rev 5 | AU-9 — Protection of Audit Information | Pre-ingestion routing affects whether audit data remains protected and recoverable. |
| AU-11 — Audit Record Retention | The question is fundamentally about what to retain before SIEM ingestion. | |
| Recommendation — Protect routed logs so reduced-fidelity storage still supports later investigation. Set retention rules by event value so important records remain available when needed. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | SOC routing determines which logs are collected, retained, and usable. |
| Recommendation — Prioritise retention for logs that support detection and incident response. | ||
| ISO/IEC 27001:2022 | A.8.15 — Logging | Pre-ingestion routing is part of deciding which logs are preserved and how. |
| Recommendation — Define logging and retention rules that preserve high-value events at full fidelity. | ||
Practitioner Guidance
What to verify: Confirm that every routing class has an explicit retention intent, a recovery path, and an owner who can explain why that class is kept at its chosen fidelity. If the rule cannot be defended as useful for detection or investigation, it is probably a cost rule masquerading as a security rule.
Decision rule: If the event is tied to a critical asset, privileged activity, or an access path that could explain attacker movement, keep the richer record. If it is low-context telemetry with no likely investigative value, reduce it only if the reduced form still preserves enough metadata to reconstruct the event later.
Practitioner takeaway: Good routing is not about preserving everything, it is about preserving the few event classes that would be painful to lose when the SOC is under pressure and the incident is already unfolding.