Elena Vasquez Sample
SOC manager. Twelve analysts, three shifts, one SIEM bill. · member since Mar 2026
Our SIEM bill is the largest line in the security budget and it is driven almost entirely by data we ingest defensively rather than analytically. I know the theory: tier your data, filter at the edge, use cheap storage for the rest. I want to know what people actually do and what it cost them in engineering time.
We are running Splunk for the searches that earn it and pushing bulk archival elsewhere. It works, but maintaining two pipelines is its own tax.
Fatima Sheikh Sample
Fraud and detection. Lives in the SIEM console. · 3 months ago
Same architecture, and yes the two-pipeline tax is real. What made it worth it was writing down, per source, the detection that justifies the ingest. About a fifth of our sources could not justify one, and dropping them was pure saving with no argument.
The hard cases are the sources you keep purely for incident response, where the value is conditional on an incident that may not happen.
Chen Wei Sample
Detection content and purple teaming. · 3 months ago
We went the other way and moved to a cost model that does not charge per GB, which made the architecture simpler at the price of running the cluster ourselves. That is a staffing swap, not a saving, and anyone comparing licence lines without counting an engineer is fooling themselves.
Priya Raghunathan Sample
Detection engineering lead. Writes the rules, tunes the noise. · 2 months ago
A middle path that helped us: summary indexing for the high-volume, low-signal sources. Keep the aggregate for hunting and trending, drop the raw after a short window. Cut about 30 percent without losing a detection.
Elena Vasquez Sample
SOC manager. Twelve analysts, three shifts, one SIEM bill. · 2 months ago
Summary indexing is a good shout, we underuse it. And agreed on the staffing swap point, that is exactly the argument I keep having with finance.