Use incident history and SOC workflows to identify the attributes that appear in repeated filters, correlation steps, and escalation decisions. Those fields are the best candidates for facets because they carry the most operational value. If a field rarely drives a question, it does not need to consume indexing priority.
Why This Matters for Security Teams
Facet decisions shape whether telemetry helps analysts answer questions quickly or merely increases storage and indexing cost. The practical issue is not whether a field is interesting, but whether it repeatedly supports triage, hunt, and escalation. Fields that map to common investigative pivots such as source, actor, resource, action, outcome, and time often deserve priority because they reduce mean time to understand what happened. NIST guidance on logging and monitoring in NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces that logs need to support detection, analysis, and accountability, which is the real test for facet value.
The mistake many teams make is assuming that every structured field should become a facet because it is available in the schema. That creates noisy search experiences, slower queries, and brittle dashboards that reward catalog depth over operational usefulness. A better approach is to treat facets as workflow shortcuts: they should reflect the questions analysts actually ask under pressure, not the metadata that looks complete on paper. In practice, many security teams discover weak facet design only after an incident has already exposed how often analysts had to pivot manually across tools.
How It Works in Practice
Facet treatment works best when telemetry design is anchored in real investigation paths. Start by reviewing recent incidents, alert triage notes, threat hunting queries, and SOC handoffs to find the fields analysts repeatedly filter on. Then test whether those fields are stable, consistently populated, and precise enough to group records without creating misleading buckets. A facet should usually be low ambiguity, relatively bounded in cardinality, and meaningful across more than one use case.
Security teams often combine operational evidence with control requirements. For example, audit-oriented logging under NIST SP 800-53 Rev 5 Security and Privacy Controls supports event review, while search engineering determines which attributes deserve fast filters. The two concerns overlap, but they are not identical. A field can be useful for forensic retention and still be a poor facet if it is highly variable, sparsely populated, or too expensive to index at query time.
- Prioritise fields that appear in repeated analyst questions.
- Prefer facets with consistent values and minimal formatting drift.
- Avoid promoting free-text fields unless they are normalised first.
- Check whether the field supports detection, triage, or root-cause analysis.
- Validate usefulness against real incidents, not only schema completeness.
It also helps to compare candidate facets against structured detection content from MITRE ATT&CK, because attack technique mapping often reveals which telemetry dimensions matter for hunting and correlation. If a field helps distinguish one technique, user, asset, or process state from another, it may be worth faceting. These controls tend to break down when event sources are inconsistent across business units because the same field name carries different meanings or values in each pipeline.
Common Variations and Edge Cases
Tighter facet design often increases implementation overhead, requiring organisations to balance analyst speed against indexing cost and schema governance. That tradeoff becomes sharper in environments with very high event volume, unstable telemetry schemas, or heavy use of vendor-specific log formats. In those settings, current guidance suggests starting with a short list of high-value facets and expanding only after usage proves they are worth the operational cost.
There is no universal standard for facet selection, especially for emerging telemetry sources such as cloud control plane logs, SaaS audit feeds, and identity-rich event streams. Some teams over-facet identity attributes because they are analytically convenient, but that can create privacy and retention concerns if the values are sensitive or overexposed. The better pattern is to pair the search design with data governance and access controls, then confirm whether the field remains useful after normalisation and enrichment.
For investigation platforms that support enrichment from threat intelligence or CMDB data, a field may become facetable only after transformation rather than at ingest. In practice, teams should revisit facet choices after major changes in detection logic, data sources, or analyst workflow. If a field rarely drives search, correlation, or escalation, it should remain searchable data rather than a promoted facet.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.AE | Facets support anomaly detection and event analysis by making telemetry easier to query. |
| MITRE ATT&CK | T1078 | Credential and account abuse investigations often pivot on identity and actor fields. |
| NIST SP 800-53 Rev 5 | AU-6 | Log review needs queryable fields to support effective analysis and accountability. |
Promote fields that speed event analysis and detection workflows, then measure whether they improve triage.
Related resources from NHI Mgmt Group
- How do security teams decide whether telemetry is good enough for enforcement?
- How should security teams decide where to use OCSF in a telemetry pipeline?
- How should security teams decide which telemetry sources to retain in XDR programmes?
- How should teams decide between a data lake and a data warehouse for security telemetry?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
