Notifications
Clear all
Topic starter
01/08/2026 9:00 pm
TL;DR: Legacy SIEM cost spikes usually reflect an upstream control-plane failure, not a detection-platform problem. DataBahn argues that filtering, parsing, normalization, enrichment, and routing should happen before ingestion, because the cost and schema risk are already incurred once data enters the SIEM. That shift turns telemetry handling into governed infrastructure, not reactive tuning.
NHIMG editorial — based on content published by DataBahn: Why are Legacy SIEMs a problem?
Questions worth separating out
Q: How should security teams govern access to log data?
A: Treat log access as privileged access, not routine admin convenience.
Q: Why do SIEM costs keep rising even after tuning?
A: Because tuning inside the SIEM acts after ingestion, when storage, parsing, and transport costs are already incurred.
Q: What breaks when schema normalization happens only inside the SIEM?
A: Correlation rules become brittle, field mappings drift across sources, and analyst work increases as each log format demands exception handling.
Practitioner guidance
- Define an upstream telemetry control plane Assign ownership for source selection, filtering, normalization, enrichment, and routing before events reach the SIEM.
- Separate detection value from storage value Classify log sources by investigative value, compliance value, and operational noise, then route each class to the appropriate destination.
- Standardise schema before ingestion Require consistent field mappings and normalization rules in the pipeline so correlation logic is stable across vendors and source versions.
What's in the full article
DataBahn's full article covers the operational detail this post intentionally leaves for the source:
- The precise pre-SIEM pipeline decisions behind filtering, parsing, normalization, enrichment, and routing.
- How the architecture reduces SIEM ingestion volume while preserving investigative fidelity and structured context.
- The operational distinction between storage governance, retention policy, and detection logic in a multi-tool environment.
- Why upstream control changes the economics of log management without requiring constant SIEM tuning.
👉 Read DataBahn's analysis of pre-SIEM log pipeline governance →
Legacy SIEMs and log pipeline governance: what teams are missing?
Explore further
01/08/2026 9:07 pm
Upstream telemetry governance is now a security control, not an engineering convenience. When organisations leave collection, parsing, and routing decisions to SIEM defaults, they inherit cost inflation, correlation drift, and inconsistent identity signal quality. That is not a tooling defect. It is a control failure in the layer that decides what data enters the security programme. The right lesson is to govern telemetry before it becomes an expensive downstream burden.
A question worth separating out:
Q: What should teams do when their SIEM is acting like a data warehouse?
A: They should separate detection workloads from storage and routing decisions. If the SIEM is receiving everything and filtering later, the programme has collapsed two different jobs into one platform. Reintroduce an upstream governance layer so the SIEM sees only telemetry that has already been classified and enriched for value.
👉 Read our full editorial: Legacy SIEM cost problems come from upstream data governance
