Because storage, search, and correlation costs rise faster than the quality of the signal. Once teams ingest everything first and decide later, the SIEM becomes a bottleneck for performance, budget, and analyst time. The result is often delayed detection, selective visibility, and too much effort spent managing pipelines instead of threats.
Why This Matters for Security Teams
Legacy SIEMs were designed for a world where log volume was lower, source diversity was narrower, and correlation rules could be managed by relatively small teams. That assumption no longer holds. Cloud workloads, endpoint telemetry, identity events, SaaS audit logs, and application traces all compete for the same ingestion, indexing, and search budget. When the platform cannot keep pace, security teams often reduce fidelity, shorten retention, or exclude sources that actually matter.
This becomes a governance problem as much as a technical one. If detection content is tuned only to fit platform limits, the organisation may preserve compliance-looking coverage while losing meaningful visibility into attack paths. NIST’s control model in NIST SP 800-53 Rev 5 Security and Privacy Controls makes clear that logging is not just about collection, but about the ability to review, correlate, and act on security events in time to matter. In practice, many security teams encounter the limits of their SIEM only after an incident has already exposed blind spots in ingestion, retention, or triage.
How It Works in Practice
The pressure point is usually not a single log source. It is the cumulative effect of high-cardinality events, duplicated telemetry, verbose cloud audit streams, and correlations that require expensive searches across large datasets. Legacy SIEMs often rely on centralized indexing and broad normalization, so every additional source increases CPU, storage, and query cost. Over time, analysts spend more effort suppressing noise than validating threats.
Operationally, teams usually respond in one of four ways:
- Filter aggressively at ingest, which lowers cost but can remove evidence needed for later investigation.
- Keep all data but reduce retention, which preserves short-term hunting at the expense of long-horizon analysis.
- Offload parts of the pipeline to separate storage or analytics layers, which adds architectural complexity.
- Restrict detection use cases to a smaller set of high-value sources, which improves focus but creates coverage gaps.
That tradeoff is why mature logging programmes treat telemetry as a risk-based design problem, not a simple data plumbing problem. Good practice is to define which event classes support prevention, detection, investigation, and compliance separately, then assign each class the least expensive processing path that still preserves the required outcome. MITRE ATT&CK is useful here because it helps teams prioritise which behaviours actually need high-fidelity visibility, rather than collecting everything equally. CISA guidance on implementing logging for cybersecurity also reinforces that useful logging must support both detection and response, not merely archival.
Where identity telemetry is involved, this problem is sharper. Authentication events, privilege changes, API key use, and service account activity often carry the strongest signal for intrusion, but they are also among the most repetitive streams in the environment. If those events are flattened, sampled too heavily, or excluded from correlation, the SIEM may still look busy while missing credential abuse, lateral movement, or misuse of non-human identities. These controls tend to break down when cloud-native estates produce more machine-generated events than the SIEM can index in near real time because search latency and retention pressure force teams to choose between depth and speed.
Common Variations and Edge Cases
Tighter retention and filtering often lowers infrastructure cost, requiring organisations to balance investigative depth against budget and platform performance. That tradeoff is especially visible in regulated environments, where a short retention window may satisfy an internal tolerance but still fail incident review needs or audit expectations.
Best practice is evolving around layered telemetry rather than assuming one SIEM must do everything. Some environments now keep raw or semi-structured events in cheaper object storage, push only prioritised alerts and enriched records into the SIEM, and use separate data lake or search tools for hunting. There is no universal standard for this yet, but the direction is clear: preserve fidelity where it matters most, and avoid forcing the SIEM to act as both long-term archive and real-time analytics engine.
The edge cases are usually high-volume, high-velocity environments such as multi-cloud estates, container platforms, and identity-heavy SaaS stacks. In these settings, even well-tuned rules can fail if the organisation does not control source onboarding, field normalization, and alert deduplication. For security leaders, the practical question is not whether to keep all telemetry, but which events deserve low-latency indexing, which can be queried on demand, and which should be retained outside the SIEM. Useful alignment here also maps to NIST monitoring and logging guidance and the broader logging objectives in CISA’s logging guidance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST-SP-800-53 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM | Telemetry growth directly affects continuous monitoring and event detection capability. |
| MITRE ATT&CK | T1078 | Credential abuse is a common signal that legacy SIEMs miss when volume forces filtering. |
| NIST-SP-800-53 | AU-6 | Security event review and analysis depend on searchable, timely log data. |
Prioritise critical telemetry paths so monitoring stays timely, actionable, and sustainable.
