Notifications
Clear all
Topic starter
02/08/2026 12:14 pm
TL;DR: Indian SOC teams are being pushed into a compliance-versus-cost trade-off as log volumes grow by 25%+ annually and CERT-In requires 180-day retention within India, according to DataBahn. The real issue is not storage alone, but how much telemetry is forced into premium SIEM paths before value is established.
NHIMG editorial — based on content published by DataBahn: Why are Legacy SIEMs a problem? The Cost & Compliance Crunch for Indian SOCs
By the numbers:
- Logs are piling up at 25%+ annual growth.
- CERT-In’s directive now mandates 180-day log retention (within India) for compliance.
- Many enterprises spend crores on SIEM licensing, only to have analysts waste 30% of their time chasing low-value alerts.
Questions worth separating out
Q: What breaks when a SOC treats every log as equal in the SIEM?
A: Cost, visibility, and investigation speed all degrade at the same time.
Q: Why do retention mandates become expensive so quickly in SIEM-centric SOCs?
A: Retention mandates force organisations to keep more data for longer, but ingest-priced SIEMs charge for volume at the front door.
Q: How do you know if log filtering is harming investigations?
A: Look for gaps in incident reconstruction, missing authentication trails, and analysts needing to reassemble context from multiple systems after an alert.
Practitioner guidance
- Implement pre-ingestion telemetry triage Classify logs before they enter the SIEM so high-value security events go to premium analytics and low-value data moves to lower-cost retention tiers.
- Separate retention from detection storage Keep 180-day compliance archives distinct from hot investigation storage so auditability does not force every event into expensive ingest-priced tooling.
- Preserve identity and privileged-access telemetry Protect authentication, PAM, and NHI-related logs from blanket suppression because those records are often the first evidence needed in an investigation.
What's in the full article
DataBahn's full article covers the operational detail this post intentionally leaves for the source:
- How its 900+ filtering rules are applied before SIEM ingestion to reduce volume without losing log retention.
- Examples of selective routing between hot SIEM storage and low-cost compliance archives.
- The mechanics of enrichment and normalization in motion so analysts receive more context per event.
- Reported cost and volume outcomes from deployments that reduced ingest and storage spend.
👉 Read DataBahn’s analysis of SIEM cost pressure and CERT-In retention compliance →
Legacy SIEM cost pressure: what Indian SOC teams need to change?
Explore further
02/08/2026 1:16 pm
Legacy SIEM pricing creates governance debt: when every ingested byte is monetised, security teams begin making architectural decisions around cost rather than risk. That distorts telemetry strategy, because the cheapest way to reduce spend is often to reduce visibility. In practice, that means the organisation inherits a governance gap: logs exist somewhere, but not necessarily where analysts can use them in time. The practitioner conclusion is that telemetry economics have become a control issue, not just a procurement issue.
A question worth separating out:
Q: Who is accountable when telemetry is archived outside the SIEM?
A: The SOC and security governance owners remain accountable for availability, integrity, and searchability of the archived logs. Moving data out of the SIEM does not reduce compliance responsibility, it changes where controls must exist. Teams need retention policies, retrieval testing, and ownership clarity so archives are usable during audit or incident review.
👉 Read our full editorial: Legacy SIEM cost pressure is reshaping SOC telemetry strategy
