Topic starter
02/08/2026 12:14 pm
TL;DR: Indian SOC teams are being pushed into a compliance-versus-cost trade-off as log volumes grow by 25%+ annually and CERT-In requires 180-day retention within India, according to DataBahn. The real issue is not storage alone, but how much telemetry is forced into premium SIEM paths before value is established.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “CERT-In Compliance Without SIEM Sticker Shock: How to Halve Your SIEM Costs and Keep Every Log”.
Key questions
Q: How should security teams balance SIEM cost reduction with log retention?
A: Teams should reduce SIEM cost by filtering hot alerting data, not by discarding evidence.
Q: Why does sending every log to the SIEM create more risk and cost for security teams?
A: Sending everything to the SIEM creates risk because much of the data is badly formatted, redundant, or irrelevant, which lowers signal quality and makes detections harder to trust.
Q: What are the signs that a SOC telemetry strategy is failing?
A: Common signals include rising licence spend, analysts spending large amounts of time on low-value alerts, and pressure to disable noisy sources or archive data outside the detection path.
Practitioner guidance
- Map telemetry by security value before SIEM ingestion Separate authentication, privileged activity, infrastructure noise, and compliance-only logs so each class follows a different storage and analysis path.
- Preserve identity and access logs in hot paths only when needed Keep logs that support detection and investigations in SIEM, but route routine and low-value records into cheaper retention tiers for the 180-day period.
- Add upstream enrichment to routing decisions Attach asset context, source classification, and threat indicators before logs hit the SIEM so routing is based on value, not raw volume.
Bottom line: SIEM cost pressure is forcing SOC teams to redesign telemetry flow, not just trim storage spend.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:16 pm
Telemetry governance has become part of SOC resilience. When organisations pay premium prices for every ingested byte, telemetry architecture starts shaping security outcomes as much as detection logic does. The real decision is no longer whether to collect logs, but how to tier them without sacrificing evidence or response capability. Practitioners should treat log routing as a control plane, not a storage afterthought.
A question worth separating out:
Q: Should retention data and detection data live in the same storage tier?
A: No. Retention data only needs to stay accessible and auditable, while detection data needs fast search, correlation, and alerting. Keeping both in the same premium SIEM tier forces the organisation to pay detection prices for compliance-only records.
👉 Read our full editorial: Legacy SIEM cost pressure is reshaping SOC telemetry strategy