Migrations become infrastructure rebuilds rather than configuration changes. Teams must recreate collectors, validate transformations, and troubleshoot two pipelines in parallel, which extends cutover time and makes future platform changes expensive. Decoupling collection from storage preserves portability and reduces repeat work.
Why This Matters for Security Teams
When telemetry enrichment and routing are welded to one SIEM, the organisation is not just buying a logging tool, it is taking on a dependency that shapes incident response, detection engineering, and future procurement. That coupling can hide for months until the first migration, acquisition, or major data source change forces the team to relearn its own pipeline. Controls that should support resilience instead become a source of operational lock-in.
This matters because enrichment logic often includes parsing, field normalisation, asset context, identity context, and threat intelligence lookups. If those functions live inside one platform, the team risks losing portability of detections, losing auditability of transformations, and creating inconsistent outcomes between the old and new stack. NIST control guidance around logging, system monitoring, and configuration management is clear that telemetry must remain reliable and traceable, not merely collected somewhere. See NIST SP 800-53 Rev 5 Security and Privacy Controls.
Security teams often assume the hard part is centralising logs, but in practice the hard part is preserving meaning as data moves between tools. In practice, many security teams encounter that coupling only after a SIEM change has already started, rather than through intentional telemetry architecture design.
How It Works in Practice
The cleaner pattern is to separate collection, enrichment, and destination routing. Collectors or forwarders ingest source data from endpoints, cloud services, identity systems, and infrastructure. Enrichment then happens in a layer that can be versioned, tested, and reused, such as a log pipeline, stream processor, or parsing service. Routing decides where data lands, which may include a SIEM, a data lake, long-term archive, or detection platform. This separation is valuable because the schema and business logic stay independent of any one vendor.
In operational terms, a decoupled pipeline should preserve the original event, append derived fields in a documented way, and keep enrichment rules under change control. That lets teams validate mappings before cutover, replay samples against a new target, and compare output from both environments during migration. It also supports more defensible governance, because the team can show which transformations happened, when, and by which rule set. For logging architecture and event handling, NIST guidance on monitoring and controlled configuration aligns well with this approach, and CISA’s security logging practices are useful for pipeline planning and resilience. See also CISA incident response planning guidance.
A practical implementation usually includes:
- source-specific collectors that remain unchanged across SIEM migrations
- a transformation layer with versioned parsing and field mapping rules
- routing logic that can send copies of the same event to multiple destinations
- health checks that verify dropped fields, malformed records, and backpressure
- documentation for field provenance so analysts know what was added and why
Where identity data is part of the telemetry, the same separation helps keep account, session, and privilege context available without tying those enrichments to one product schema. These controls tend to break down in high-volume environments with brittle custom parsers and no replay capability because even small mapping changes can corrupt downstream detections.
Common Variations and Edge Cases
Tighter enrichment control often increases engineering overhead, requiring organisations to balance portability against the convenience of product-native features. Some environments accept that tradeoff because a single SIEM may be sufficient for stable, low-change estates. Others need a more portable design because their sources, compliance obligations, or acquisition activity make platform change likely.
Best practice is evolving on how much enrichment belongs at the edge versus in the central pipeline. Edge enrichment can reduce bandwidth and improve local context, but it can also create inconsistent interpretations across teams if the logic is not shared. Central enrichment is easier to govern, yet it can become a bottleneck if every transformation depends on one platform’s proprietary rules. A common compromise is to keep source extraction close to the data and apply higher-order context, such as asset or identity correlation, in a vendor-neutral layer.
The edge cases are usually not technical only. They include mergers, shared-service SOCs, multi-cloud estates, and regulated environments where retention and audit requirements differ by jurisdiction. In those cases, routing must support parallel destinations without duplicating business logic, and enrichment must remain reproducible for investigations and audits. For resilience and control mapping, this aligns with NIST Cybersecurity Framework guidance and, where attack-path visibility matters, MITRE ATT&CK techniques for log evasion and credential abuse are useful for validating detections. In hybrid estates with proprietary ingestion formats and no shared schema contract, the guidance often collapses because each new destination demands a separate transformation chain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM | Telemetry pipelines support continuous monitoring and detection visibility. |
| MITRE ATT&CK | T1078 | Identity-rich telemetry helps detect valid-account abuse in logs. |
Keep collection and routing observable so monitoring survives SIEM changes.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
