Topic starter
02/08/2026 11:54 am
TL;DR: Enrichment and filtering before SIEM ingestion can reduce data volumes by 50 to 70 percent in production, according to DataBahn, while one medical device manufacturer reportedly cut Splunk costs by over 50 percent in seven days. The architectural shift matters because routing decisions are becoming security decisions, not just storage decisions.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “ETL vs. Data Pipelines: What They Are, How They Differ, and What Your Organization Actually Needs”.
By the numbers:
- Filtering and enriching telemetry before it reaches the SIEM has reduced data volumes by 50 to 70 percent in production deployments.
- One medical device manufacturer cut Splunk costs by over 50 percent within seven days of deploying edge-level filtering and enrichment.
Key questions
Q: What breaks when enrichment happens only after SIEM ingestion?
A: Three things usually break together: cost control, detection speed, and retention discipline.
Q: Why does upstream telemetry enrichment change SOC governance?
A: Because it moves value judgment closer to the source.
Q: What are the signs that telemetry enrichment is failing in practice?
A: Enrichment is likely failing when data cannot be separated by the attributes teams expect, when troubleshooting still requires manual searching, or when logs and metrics remain hard to classify.
Practitioner guidance
- Map where enrichment decisions occur Identify whether filtering, tagging, and routing happen at collection, in transit, or only after SIEM ingestion.
- Separate high-value events from routine telemetry Define the context signals that justify full-fidelity SIEM retention, such as known-malicious indicators, privileged activity, or high-risk assets.
- Stress-test enrichment latency Measure whether enrichment relies on synchronous external lookups that will not scale under SOC throughput.
Bottom line: Pre-SIEM enrichment changes telemetry handling from a storage problem into a security governance decision.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:02 pm
Pre-SIEM enrichment is really a governance shift, not a log-processing tweak. When context is attached before ingestion, the organisation stops treating telemetry as inert volume and starts treating it as security evidence with different retention and routing values. That matters for SOC design, but it also matters for identity-rich environments where asset identity, environment context, and trust signals determine whether a record is worth keeping. Practitioners should read this as a control-plane change, not a compression trick.
A question worth separating out:
Q: When should security teams prioritize upstream enrichment over more SIEM capacity?
A: Teams should prioritize upstream enrichment when ingesting more data is mostly adding noise, not new security value. If logs are duplicated, out of order, or missing context, more SIEM capacity only scales the problem. Enrichment should come first because it makes routing, retention, and investigation decisions more accurate.
👉 Read our full editorial: Pre-SIEM enrichment is replacing raw log ingestion decisions