A collection stack is the set of agents, connectors, parsers, certificates, and routing components that move telemetry from sources into a security platform. During SIEM migration, the stack often becomes the most fragile part of the programme because changes to collection alter what evidence the destination system can actually see.
What the collection stack is and why it matters
The collection stack is not the security platform itself, but the pathway that feeds it. It includes the components that discover, transform, encrypt, and route telemetry so logs, events, and alerts arrive in a usable form.
That distinction matters because a migration can succeed on paper while failing in practice if the collection layer drops fields, changes formats, or breaks trust relationships. When collection changes, the destination system may still be online, but its visibility can shrink.
How collection components work together
A collection stack usually spans multiple layers: source-side agents, network connectors, parsers, certificates, queues, forwarders, and routing rules. Each layer has a different job, and each one can become a point of failure if it is misconfigured or replaced without understanding upstream dependencies.
Agents often gather telemetry close to the source, while connectors and forwarders move it across trust boundaries. Parsers standardise structure so the security platform can index and correlate events correctly, and routing components decide which data goes where. If one layer changes its output or timing, the downstream system may interpret the evidence incorrectly or not at all.
In practice, the stack should be treated as a chain of evidence handling, not a single product. The operational question is not only whether data arrives, but whether it arrives complete, timely, authentic, and in the expected schema.
Collection stack fragility during SIEM migration
During SIEM migration, collection is often the most fragile part of the programme because it sits between many source systems and the new destination. Source systems may depend on certificates, proprietary parsers, old transport paths, or agent versions that were tuned to the previous SIEM.
That fragility shows up in subtle ways: dropped events, duplicate ingestion, broken normalization, delayed delivery, or silent loss of metadata needed for detections and investigations. A migration can therefore preserve the volume of data while still degrading the quality of the evidence the new platform can use.
Teams also underestimate how much detection logic depends on collection-side shaping. If parsing or routing changes, correlation rules may stop matching, even though the raw event source has not changed.
Trust, integrity, and visibility in telemetry collection
The collection stack sits on the trust boundary between observed systems and the security platform, so integrity controls matter as much as transport reliability. Certificates, authentication material, and routing permissions determine whether telemetry is accepted as genuine and whether it can be moved without interception or tampering.
Visibility also depends on what the stack chooses to preserve. If the collection path strips fields, truncates payloads, or normalizes too aggressively, the platform may lose the context required for investigations, hunting, or compliance evidence.
For that reason, a healthy collection design preserves both transport integrity and semantic fidelity. It should move telemetry without changing the meaning of the source record more than necessary.
Risk and Threat Considerations
Collection stacks create concentrated exposure because they control what the security platform can see, and attackers benefit when visibility is reduced. A fragile collector, parser, or routing tier can hide malicious activity just as effectively as it can create operational noise.
Failure mechanism: Misconfigured agents, expired certificates, broken parsers, or unsafe routing changes can silently drop or reshape telemetry, weakening detection and investigation coverage. An attacker does not need to defeat the destination platform if they can exploit the collection path or the assumptions around it.
Impact: The organisation may lose auditability, miss signs of compromise, or make incorrect response decisions because the security platform is operating with partial evidence. In a migration, that risk is amplified because collection changes are often broad, time-sensitive, and hard to validate exhaustively.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0, NIST SP 800-63 and SLSA set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Collection stacks determine what audit events are captured and forwarded. |
| AU-6 — Audit Review, Analysis, and Reporting | Lost or reshaped telemetry weakens the analysis that depends on collected logs. | |
| SI-4 — System Monitoring | The collection stack is a core monitoring path for security visibility and detection. | |
| Recommendation — Define required telemetry sources and event types so collection preserves audit coverage. Validate that collected telemetry still supports review, correlation, and alerting. Monitor the collection pipeline for gaps, failures, and abnormal telemetry flow. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find potentially adverse events | Collection stacks are the mechanism that often supplies monitored telemetry. |
| PR.DS-01 — Data-at-rest is protected | Collected telemetry often contains sensitive security data that must remain protected. | |
| PR.DS-10 — Data-in-transit is protected | Forwarders, connectors, and certificates secure telemetry as it moves. | |
| Recommendation — Confirm monitoring coverage still receives the telemetry needed to spot adverse events. Protect stored telemetry and intermediate collection stores from unauthorized access. Use protected transport for all telemetry collection and forwarding paths. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Collection components often rely on certificates, tokens, and other secret material. |
| NHI-06 — Insecure Cloud Deployment Configurations | Cloud-hosted collectors and routing services can fail through unsafe deployment settings. | |
| Recommendation — Protect collector secrets and rotate them when migration changes trust paths. Review deployment settings for collection services so telemetry paths remain trusted. | ||
| NIST SP 800-63 | IAL2 — Identity Assurance Level 2 | When collectors authenticate systems or operators, assurance affects trust in telemetry sources. |
| Recommendation — Use strong assurance where collection access depends on authenticated identities. | ||
| SLSA | SLSA — Supply-chain Levels for Software Artifacts | Collector agents and parsers are software components whose provenance affects trust. |
| Recommendation — Verify provenance for collection software before deploying it in production. | ||
Practitioner Guidance
What to watch for: Treat collection as a governed dependency, not a plumbing detail. The key practitioner judgement is whether the stack preserves source fidelity, delivery assurance, and routing intent across the migration boundary, especially where certificates, parsers, and field mappings change.
Common misunderstanding: A successful ingestion test does not prove the stack is safe. You need to confirm that the right fields, timestamps, identities, and event types still survive end to end, otherwise the platform may appear healthy while losing critical security context.
Practitioner takeaway: Validate the collection path with real telemetry and detection use cases, not just transport checks, because visibility failures usually surface first in investigations, not dashboards.
Related resources from NHI Mgmt Group
- How should teams combine metrics collection and dashboarding in an observability stack?
- What is the difference between an integrated Kubernetes security stack and a collection of open-source point tools?
- When does just-in-time access help most in DORA evidence collection?
- How can organisations reduce manual effort in access certification and evidence collection?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 13, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org