Topic starter
01/08/2026 10:43 pm
TL;DR: Legacy SIEMs become expensive by default when teams route every log source there without a classification framework, even though 70 to 90 percent of enterprise log volume is often low-value noise according to DataBahn. The real governance shift is to decide routing by detection latency, retention need, and query pattern, then treat enrichment as the mechanism that makes those decisions defensible.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “How to Decide What Goes to Your SIEM, What Goes to Cold Storage, and What Gets Dropped”.
Key questions
Q: What breaks when a SIEM is forced to store every log source?
A: Cost and operational complexity rise together.
Q: Why do detection latency, retention, and query patterns matter for log routing?
A: Those three factors describe the real purpose of a log source.
Q: What are the signs that SIEM routing is failing?
A: Common signals include rising ingestion cost, slow searches, a growing share of routine or repetitive logs, and analysts having to hunt through noisy telemetry to find useful events.
Practitioner guidance
- Define routing criteria before ingestion Create a decision model for every new log source using detection latency sensitivity, compliance retention, and query frequency as the only default gates.
- Promote only high-value identity and cloud events to SIEM Keep authentication anomalies, privileged access changes, and cloud IAM modifications in the SIEM, but route bulk successful logins and routine permits elsewhere.
- Enrich telemetry in the pipeline Attach asset ownership, identity resolution, geolocation, and threat intelligence before data reaches indexed storage so routing can be value-based.
Bottom line: Default SIEM ingestion is often a classification failure, not a monitoring strategy, because it treats all telemetry as equally valuable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:52 pm
Pre-SIEM enrichment is really a routing governance problem, not a logging optimisation problem. The article shows that teams fail when they treat the SIEM as the assumed destination instead of a decision point. That matters because telemetry routing now sits on the same governance plane as access scope, retention policy, and operational monitoring. Practitioners should treat enrichment as the mechanism that makes those decisions auditable and repeatable.
A question worth separating out:
Q: Should security teams keep authentication and IAM logs in the SIEM or in colder storage?
A: Keep authentication anomalies, privileged changes, and other high-consequence identity events in the SIEM when they support near-real-time detection. Keep bulk successful logins and routine identity records in colder storage unless a specific investigation or retention rule requires indexed access. The answer depends on how quickly the event must influence response.
👉 Read our full editorial: Pre-SIEM enrichment changes how security teams route telemetry