What SIEM actually costs, and how to stop paying for noise

SIEM budgets rarely break in a single quarter. They break gradually, and then all at once. A new application onboards and adds a log source. A compliance requirement extends retention. A cloud migration triples the volume of platform telemetry. Each increment is individually defensible. Eighteen months later the platform costs three times what was budgeted, and the response is usually to go to market for a cheaper vendor.

That almost never works, because the problem is not the unit price. It is that most organizations have not made an explicit decision about what belongs in the expensive tier.

The three questions logs answer

Every log an organization collects is serving one of three purposes, and they have very different economics:

Detection. Data that actively drives alerts. This needs to be hot, indexed, and correlated in near real time. It is the expensive tier, and it should be the smallest one.

Investigation. Data you query when something has already happened. It needs to be searchable within minutes to hours, but it does not need to be continuously correlated. Warm storage, materially cheaper.

Compliance. Data retained because a regulation says so. It needs to be tamper-evident and retrievable on request. It almost never needs to be indexed at all. Cold storage, cheapest by an order of magnitude.

The default behavior of most deployments is to put everything in tier one, because that is what happens when nobody decides otherwise. A firewall generating billions of accept events per month sits alongside authentication logs in the same hot index, at the same price, delivering a tiny fraction of the detection value.

You are not overpaying for SIEM. You are paying detection-tier prices for compliance-tier data.

Where the volume actually is

In most environments the distribution is lopsided and predictable. Network flow and firewall accept events, verbose endpoint process telemetry, and cloud platform audit logs together typically account for the substantial majority of ingest, yet only a small minority of the detections that actually fire.

Meanwhile the sources with the highest detection yield per gigabyte (authentication events, directory changes, privileged operations, EDR detections, email security verdicts) are usually a modest slice of total volume.

That asymmetry is the opportunity. Filtering, aggregating, or tiering the high-volume/low-yield sources can cut ingest substantially with negligible detection impact, provided the decision is made deliberately and documented.

Doing the tiering without losing coverage

The risk in any cost exercise is cutting something that turns out to matter during an incident. A few practices keep that from happening:

• Map sources to detections before cutting anything. If no detection rule, hunt query, or past investigation has referenced a source in twelve months, it is a tiering candidate. If several depend on it, it stays hot regardless of volume.
• Filter at the collector, not the platform. Dropping known-benign events before they are billed is materially cheaper than ingesting and then archiving them. Most modern agents support this.
• Summarize rather than drop. For high-volume sources, aggregated records preserve the ability to spot anomalies in volume or pattern while cutting the raw event count dramatically.
• Keep a documented rehydration path. Cold-tier data you cannot practically retrieve during an incident is not really retained. Test the restore before you rely on it.

The architectural shift underneath

Newer platforms, including CrowdStrike Falcon Next-Gen SIEM and Microsoft Sentinel's auxiliary and basic log tiers, have started pricing these tiers separately rather than treating all telemetry as one commodity. That is a genuine improvement, but it only helps if somebody does the classification work. A tiered platform with everything still defaulted into the hot tier costs the same as an untiered one.

What good looks like

A well-run program can state, per source: what tier it sits in, which detections depend on it, what it costs per month, and when that decision was last reviewed. That document is usually a single page, it takes a couple of weeks to produce, and in our experience it is worth substantially more than a competitive procurement, because it turns an opaque, compounding bill into a set of decisions somebody can actually defend.