Topic starter
11/11/2026 6:02 pm
TL;DR: Security operations still overvalue SIEM centralization, according to Query, even though investigations need access and correlation more than physical consolidation. SOC coverage degrades when telemetry remains trapped in endpoint, identity, SaaS and cloud systems outside the main analytics path.
Editorial analysis by NHI Mgmt Group, based on content published by Query: “The Assumption Nobody Questioned”.
Key questions
Q: What does this mean for agentic AI governance in security operations?
A: Teams need to govern how the agent forms and carries belief about the world, not only what outputs it produces.
Q: What is the difference between centralised logging and federated investigation?
A: Centralised logging copies events into one repository for storage, search, and alerting, while federated investigation queries multiple telemetry sources in place and correlates results across them.
Q: Why does SIEM centralization create blind spots in SOC coverage?
A: SIEM centralisation creates blind spots when only selected logs are forwarded, source systems have local detections that are not ingested, or volume limits force filtering before analysis.
Practitioner guidance
- Define evidence reach targets Set minimum investigative coverage for identity, endpoint, SaaS and cloud telemetry so the SOC can prove what it can query without assuming everything must be centralised.
- Classify telemetry by investigative value Separate high-value data that must remain queryable at source from low-value logs that only justify expensive central ingestion.
- Test AI against missing-data scenarios Run investigations where key evidence stays outside the SIEM and measure whether automation still reaches a defensible conclusion.
Bottom line: Security operations can no longer assume that centralised storage is the same thing as usable investigative coverage.
Glossary terms: Security Information and Event Management (SIEM), Security Operations Center (SOC), Endpoint Telemetry, Identity Provider
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Centralised investigation has become a coverage constraint, not a control objective. The historic reason for SIEM centralisation was operational efficiency in a lower-bandwidth, lower-scale era, but that rationale no longer justifies treating ingestion as the only route to usable evidence. Modern estates spread identity, endpoint, SaaS and cloud telemetry across different systems, so a single repository can never be the whole investigative surface. Practitioners should judge the architecture by evidence reach, not by log volume.
A question worth separating out:
Q: What is the difference between centralised logging and federated investigation?
A: Centralised logging copies events into one repository for storage, search, and alerting, while federated investigation queries multiple telemetry sources in place and correlates results across them. Centralisation simplifies retention and indexing, but federation preserves local context and can cover distributed clouds, endpoints, and applications without requiring every event to be duplicated centrally.
👉 Read our full editorial: SOC coverage does not require SIEM centralization first