Teams should enrich before routing when the environment produces enough data that raw ingestion is expensive and noisy. Centralising everything first makes sense only when the volume is manageable and the investigation model depends on full-fidelity retention. In modern SOCs, upstream context usually creates better control and better economics.
Why the SIEM Question Is Really About Telemetry Economics
The practical choice is not whether to keep visibility, it is where to spend the cost of normalising, enriching, and retaining it. When raw events are cheap and investigation workflows depend on full-fidelity search, centralising first can be defensible. When volume is high, upstream enrichment usually reduces noise before the SIEM becomes the expensive system of record.
That distinction matters because a SIEM is often optimised for correlation, retention, and investigation, while enrichment is where context such as asset identity, user context, environment, and severity can make events actionable. If that context is added late, teams pay to ingest data they later discard or repeatedly reinterpret.
In practice, the best pattern is usually to route useful context early enough that downstream tools receive higher-signal events, but not so early that you lose the raw evidence needed for later hunts, compliance, or forensic reconstruction. The right balance depends on the investigation model, the telemetry sources, and how much retention pressure the SOC can absorb.
Where Enrichment Before Routing Works Best
Pre-routing enrichment is strongest when telemetry is abundant, repeated, or structurally noisy. Adding lookup data, parsing, tagging, and policy context upstream can collapse many low-value records into a smaller set of security-relevant events, which improves both analyst attention and platform cost.
That approach is especially useful for cloud, identity, endpoint, and application telemetry where the raw record alone rarely answers the operational question. A log line that is only “an event” becomes much more useful when it carries asset criticality, environment, account type, or control-plane context before it reaches the central analytics layer.
Used well, enrichment also creates cleaner routing decisions. High-value alerts can be forwarded to the SIEM, lower-value telemetry can be sent to cheaper storage, and specific pipelines can be reserved for detection engineering or threat hunting. For teams trying to apply incident response standards, that split often makes triage faster without removing evidence from the environment.
When to Centralise Raw Telemetry First
Centralise first when the data volume is still manageable and the organisation genuinely needs the full raw record in one place for search, correlation, or post-incident reconstruction. That is often the case in smaller environments, during early SIEM adoption, or when teams are still discovering what questions they need the telemetry to answer.
This model is also better when enrichment sources are immature or inconsistent. If lookup tables are stale, ownership data is unreliable, or enrichment rules differ across pipelines, then pre-routing can create false confidence and fragmented visibility. In those cases, a central store gives analysts a stable baseline while the enrichment logic matures.
For control frameworks that emphasise logging, auditability, and secure monitoring, the key issue is not “SIEM or enrichment” as a binary. It is whether the pipeline preserves enough fidelity for investigation while still reducing avoidable volume. NIST’s control catalogues make that trade-off explicit through logging, audit, configuration, and access-control expectations, which is why a central platform still matters even when enrichment happens upstream. NIST SP 800-53 Rev 5 Security and Privacy Controls remains a useful reference point for that balance.
How Teams Should Decide the Split
The decision usually comes down to three questions: can you afford to ingest raw data at scale, does your detection logic need the original event untouched, and do you trust the enrichment inputs enough to make routing decisions upstream? If the answer to the first is no, and the second is no, enrichment before routing is usually the better operating model.
Teams should also separate “analysis data” from “evidence data.” Not every source needs to go straight into the SIEM, but important sources should still be retained somewhere with enough integrity to support investigations and replay. That is the practical middle ground: enrich early, keep raw where it is valuable, and reserve the SIEM for correlation, alerting, and analyst workflow rather than indiscriminate storage.
For cloud and NHI-heavy environments, upstream filtering often pairs well with telemetry around credentials, access keys, and service activity because those signals are both noisy and security-sensitive. A real-world example is a compromised credential incident in which customers were told to rotate API keys and stored credentials; the lesson is that identity-related telemetry is often best normalized before it reaches the central analytics layer. Sumo Logic breach 2023 illustrates why raw log volume and credential-driven investigation needs can collide.
Risk and Threat Considerations
Centralising everything first can create cost and visibility risk when raw ingestion becomes so expensive that teams start dropping data, shortening retention, or ignoring important sources. Pre-routing enrichment can also introduce risk if enrichment data is stale or if attackers can manipulate context before the SIEM sees the event.
Failure mechanism: The pipeline either overloads the SIEM with low-value telemetry, or it relies on weak enrichment rules that misclassify important events and send them to the wrong place. In both cases, the organisation loses either scale or fidelity.
Impact: Analysts get slower, detections become noisier, investigations lose context, and some events may never be retained in the system most people expect to search first. In mature SOCs, that can directly affect mean time to investigate and the quality of forensic reconstruction.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Telemetry routing and enrichment hinge on what gets logged and retained. |
| AU-6 — Audit Review, Analysis, and Reporting | The question is about making telemetry useful for analysis and correlation. | |
| SI-4 — System Monitoring | Pre-routing enrichment changes how monitoring signals are filtered and surfaced. | |
| Recommendation — Define logging scope so enrichment and SIEM ingestion preserve the events investigators need. Tune review workflows to prioritize enriched events with the highest investigative value. Use monitoring to route higher-signal telemetry into the SIEM and cheaper data elsewhere. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The answer depends on managing volume, retention, and usefulness of logs. |
| CIS-13 — Network Monitoring and Defense | Selective routing improves the quality of telemetry used for defense operations. | |
| Recommendation — Centralize only the log data that supports detection, investigation, and retention needs. Route enriched telemetry to the monitoring path that best supports alerting and triage. | ||
Practitioner Guidance
What to prioritise: Prioritise high-volume sources where enrichment can materially reduce noise, such as cloud, identity, endpoint, and application telemetry. If a source is already low-volume and high-value, keep more raw detail in the SIEM path.
What to verify: Verify that enrichment rules are deterministic, versioned, and based on trustworthy reference data. If the enrichment layer cannot be audited or replayed, do not let it become the only path to a security decision.
Practitioner takeaway: The right architecture is usually selective, not absolute: enrich early to control volume and improve signal, but preserve raw evidence where investigation depth depends on it.