Topic starter
18/08/2026 2:25 pm
TL;DR: Security data pipelines are breaking under the weight of logs, alerts, enrichment demands, and SIEM costs, according to TENZIR’s analysis of SecDataOps and open, composable pipeline design. The practical shift is from ingest-everything architectures to dynamic preprocessing, which changes how teams control cost, context, and data ownership.
Editorial analysis by NHI Mgmt Group, based on content published by TENZIR: “The SecDataOps evolution: why security data needs its own pipeline”.
Key questions
Q: How should security teams reduce SIEM cost without losing evidence quality?
A: They should move filtering, parsing, and normalization before ingestion, then store lower-value telemetry in cheaper tiers and reserve high-cost analytics for the signals that matter.
Q: What breaks when security teams rely on ingest first, analyze later logging pipelines?
A: When teams rely on ingest first pipelines, they often pay for massive volumes of data that never get used, while critical events arrive too late for meaningful action.
Q: How do organisations know whether their security data pipeline is working?
A: They should track whether clean data reaches detections quickly and consistently, whether identity-related events remain searchable end to end, and whether AI or SIEM workflows make better decisions after pipeline changes.
Practitioner guidance
- Implement upstream filtering before SIEM ingestion Remove duplicates, noise, and irrelevant events before they enter storage or licensing-bound SIEM pipelines.
- Standardise normalization and enrichment steps Define repeatable transformations for field mapping, threat-intel enrichment, and asset-context joins so investigators see consistent event structure across sources.
- Version-control pipeline logic as code Treat parsing rules, routing decisions, and enrichment workflows as code so changes can be tested, reviewed, and rolled back like any other production change.
Bottom line: Security teams are not only fighting more telemetry, they are fighting the cost and rigidity created by ingest-first security architectures.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:15 pm
SecDataOps is really a governance shift, not just a plumbing change. Security teams are discovering that the main failure mode is no longer simple ingestion volume but loss of control over how data is shaped before it reaches detection and analytics systems. The article points to a broader truth: data pipelines now influence cost, context, and investigative speed as much as the SIEM itself. Practitioners should treat pipeline design as part of security architecture, not back-office engineering.
A question worth separating out:
Q: What is the difference between composable security pipelines and a monolithic SIEM model?
A: Composable pipelines process and route security data in modular stages before it reaches analysis tools, while a monolithic SIEM model centralises collection first and transforms later. The practical difference is control: composable design gives teams visibility into each transformation step and reduces lock-in.
👉 Read our full editorial: SecDataOps is reshaping how security teams handle pipeline chaos