Legacy SIEMs create telemetry sprawl and AI readiness gaps

At a glance

What this is: DataBahn argues that legacy SIEM architectures now create telemetry sprawl, high ingestion cost, and weak AI readiness because security data is handled too late in the pipeline.

Why it matters: This matters because IAM, SOC, and security architecture teams need trustworthy, enriched telemetry before analytics and AI can make reliable decisions.

Context

Legacy SIEMs were built to centralize logs after collection, but modern environments generate too much heterogeneous telemetry for that model to stay efficient. When data arrives duplicated, delayed, and missing context, the real problem is not visibility but whether the pipeline can preserve meaning as it moves from source to analytics.

This article sits at the intersection of SOC operations, data governance, and identity-heavy telemetry because many security decisions depend on context about users, workloads, and access events. The governance gap is that teams often try to fix noisy analytics after ingestion, when the control point should be the pipeline itself.

Key questions

Q: What breaks when a SIEM is still the centre of telemetry governance?

A: A SIEM-centred model breaks when log volume, format diversity, and context loss grow faster than the team can normalize and query data. Detection slows down, costs rise linearly, and analysts spend more time making telemetry usable than responding to threats. The failure is architectural, because the control point sits too late in the data path.

Q: When should security teams prioritize upstream enrichment over more SIEM capacity?

A: Teams should prioritize upstream enrichment when ingesting more data is mostly adding noise, not new security value. If logs are duplicated, out of order, or missing context, more SIEM capacity only scales the problem. Enrichment should come first because it makes routing, retention, and investigation decisions more accurate.

Q: What signals show that telemetry quality is affecting SOC outcomes?

A: Common signals include inconsistent fields across sources, poor parsing rates, dropped events, and repeated analyst work to reformat data before investigation. If teams cannot trust identity or security logs to correlate across tools, the problem is usually not the detection logic itself but the quality of the data layer feeding it.

Q: How should security teams govern data pipelines for SIEM operations?

A: Treat the pipeline as a governed control layer, not a connector. Standardise source classification, enrichment, reduction, and routing so the SIEM receives consistent telemetry and teams can change downstream tools without rebuilding every integration. The goal is operational portability plus better signal quality, not simply more ingest.

Technical breakdown

Why legacy SIEMs become the bottleneck

A legacy SIEM is designed to ingest, index, and query logs after they arrive, which makes it a downstream control plane rather than a data fabric. That works only when source diversity, volume, and schema churn stay modest. In modern environments, proprietary formats, repeated normalization, and index-heavy workflows turn the SIEM into a costly bottleneck. Detection also becomes delayed because decisions happen after shipping, storage, and query. The architectural issue is not just tool sprawl. It is that the system assumes raw telemetry can be made useful later, when the signal quality has already degraded.

Practical implication: Treat ingestion as a governed pipeline problem, not an analytics problem, and decide what must be enriched or suppressed before SIEM storage.

How upstream enrichment changes telemetry governance

Upstream enrichment attaches context before telemetry reaches the SIEM. That context can include asset identity, environment, geolocation, identity resolution, and threat intelligence, which makes filtering meaningful instead of blind. The article’s architectural point is that enrichment and routing are the same control decision. Once data is contextualized, high-value events can be retained at full fidelity while routine activity is routed differently. This reduces noise, lowers storage and license pressure, and preserves the log’s utility for investigation and compliance. The key shift is from volume-first ingestion to value-aware telemetry handling.

Practical implication: Build edge and stream enrichment rules that classify telemetry by business and security value before it enters expensive analytics tiers.

Why AI readiness depends on clean telemetry

AI-driven security systems are only as useful as the telemetry they consume. If logs are inconsistent, duplicated, out of order, or poorly labeled, then reasoning engines and LLM-based workflows inherit the mess and produce fragile outputs. The article correctly frames AI readiness as a data-plane issue, not a dashboard feature. Agentic AI in the SOC depends on structured, enriched, policy-governed telemetry that can be reused across detection, investigation, and compliance. Without that foundation, AI becomes presentation layer automation on top of weak data hygiene.

Practical implication: Standardize telemetry schemas and enrichment at the pipeline layer before expecting meaningful AI-assisted detection or triage.

Threat narrative

Attacker objective: The practical objective is not a single intrusion but persistent operational drag that reduces detection quality and increases the chance that genuine malicious activity is missed.

1. Entry occurs through high-volume, heterogeneous telemetry entering a legacy SIEM without enough upstream filtering or context.
2. Credential and operational signals are diluted by duplicated, delayed, or out-of-order data, making meaningful detection slower and less trustworthy.
3. Impact shows up as analyst overload, higher license and compute cost, and AI tools that cannot reliably reason over the underlying telemetry.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• CI/CD pipeline exploitation case study: Credentials in an exposed .git/config let a researcher edit a Bitbucket pipeline so it planted their SSH key on the server. No victim was named.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Telemetry governance is now a security control, not a plumbing concern. When security teams treat the SIEM as the centre of the architecture, they inherit its cost and latency model instead of governing data quality upstream. The article shows why duplicated, context-poor telemetry weakens both human analysts and automation. Practitioners should treat the pipeline as a control surface that shapes what the SOC can know.

AI readiness fails at the data layer long before it fails in the model layer. LLMs and reasoning engines cannot compensate for logs that are noisy, unordered, or poorly normalized. That means AI security programs need telemetry governance, schema discipline, and enrichment before they need more model features. The practical conclusion is that AI security is only as mature as the evidence feeding it.

Pre-SIEM enrichment creates a new operating concept: telemetry triage. This is the point where logs are evaluated for security value, business value, and retention need before they consume analytics capacity. The article’s strongest insight is that filtering without enrichment is blind, while enrichment without routing is wasted effort. Teams should make telemetry triage a named design principle in SOC architecture.

Legacy SIEM sprawl exposes a broader governance gap in SOC design. Security leaders often optimize for ingesting everything because that is how the commercial model is priced, not because it improves outcomes. That assumption no longer holds in cloud-heavy and AI-assisted environments. The discipline now is to manage evidence quality first, then analytics scope, then storage cost.

Identity and access telemetry becomes more valuable when it is contextualized before analysis. User, workload, and service activity only matter operationally when the pipeline can attach asset, environment, and trust context early enough to support response. That intersection between telemetry governance and identity data quality is where SOC maturity now gets measured. Practitioners should align pipeline design with identity-rich detection use cases.

What this signals

Telemetry triage is becoming the decisive SOC pattern. Security teams can no longer assume that all useful data belongs in the SIEM first and in context later. The practical change is to decide earlier which telemetry deserves expensive retention, which should be enriched in stream, and which can be safely downgraded without losing investigative value.

AI-assisted SOC operations will expose weak data governance faster than they expose weak models. If the pipeline cannot deliver structured and trustworthy telemetry, LLM-based analysis will amplify confusion rather than reduce it. That makes telemetry schema discipline, enrichment, and routing part of AI governance for security teams, not just an engineering preference.

Identity-rich telemetry needs upstream context to be operationally useful. User, service, and workload events are only actionable when the pipeline can attach identity, asset, and environment meaning before analysis. Teams that cannot do that will struggle to make access events usable for detection, compliance, and response.

For practitioners

• Govern telemetry at the pipeline layer Define what data must be enriched, filtered, or suppressed before SIEM ingestion, then make routing decisions based on security value rather than raw volume.
• Standardize on open telemetry schemas Adopt a common schema such as OCSF so logs can be reused for detection, investigation, and compliance without repeated normalization work.
• Move enrichment upstream of analytics Attach asset identity, context, and threat intelligence as data flows through the edge and stream layers, not after indexing.
• Separate retention tiers by context Route high-value telemetry to the SIEM at full fidelity and send routine data to lower-cost storage that still supports retrieval when needed.
• Treat AI readiness as telemetry hygiene Validate that logs are clean, ordered, and structured before enabling AI-assisted detection, triage, or investigation use cases.

Key takeaways

• Legacy SIEM architecture now creates a governance problem because telemetry volume, latency, and context loss undermine the SOC’s ability to act on evidence quickly.
• The article’s core evidence is architectural, not just operational: ingestion scales faster than security value, so the cost of raw telemetry keeps rising while usefulness does not.
• Teams should move enrichment, filtering, and schema normalization upstream so the SIEM can focus on analysis rather than compensating for poor data hygiene.

Key terms

• Telemetry sprawl: Telemetry sprawl is the accumulation of too many logs, metrics, and events across too many systems for security teams to use effectively. It usually happens when collection decisions are driven by fear of missing something rather than by a clear detection or investigation purpose.
• Pre-SIEM Enrichment: Pre-SIEM enrichment is the process of attaching security context to telemetry before it reaches the SIEM. That context can include identity data, asset ownership, geolocation, or threat intelligence, allowing teams to make a routing decision before they pay indexed-storage costs.
• Telemetry Fabric: A telemetry fabric is the pipeline layer that moves, filters, enriches, and routes security data before analytics consume it. It treats telemetry as governed data rather than raw exhaust, so teams can apply policy and context before the SIEM, data lake, or AI system sees it.
• AI-Ready Security Data: AI-ready security data is telemetry that has been cleaned, normalized, enriched, and structured enough for automation or reasoning engines to use reliably. Without that preparation, AI tools inherit log noise and produce brittle or misleading outcomes.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, machine identity security, and secrets management through the industry's only accredited NHI security programme. It helps practitioners connect identity controls to the broader security architecture their programmes depend on.