The bill follows the volume, not the value
Most security information and event management platforms are priced on what they ingest: gigabytes a day, events per second, or a licence tier set by both. That model has a quiet consequence. Every heartbeat, every debug line left switched on after a release, every repeated firewall accept for the same internal flow is billed at the same rate as the authentication failure your analysts actually need to see.
Nobody designs an estate to work this way. It happens because forwarding everything is the safe default when a SIEM is first connected, and because nobody is ever asked to justify a log source once it is flowing. Two or three years later, the security budget is paying premium indexer prices for data whose main purpose is to exist.
Not all events are equal, and that is fine
An honest look at a typical event stream sorts it into three groups. Some events are worth indexing: they feed detections, dashboards and the searches analysts run every day. Some are worth keeping but not indexing: they matter for an investigation next month or an auditor next year, but nobody needs them in the hot path. And some are noise: exact duplicates, health checks, verbose diagnostics that add nothing even to a forensic timeline.
The mistake is to treat this as a choice between keeping and deleting. It is a choice about where each event lives. Data that is not worth indexing can sit in full, searchable, in inexpensive object storage, and come back into the SIEM when an investigation needs it. Our principle is simple: data is not deleted, it stops being metered.
Classify before you index
The practical answer is a pipeline that sits between the systems producing logs and the platform billing for them. It reads every event, decides what it is using rules a person can read, and routes it accordingly. Open-source collectors such as Vector make this straightforward: they parse, enrich, mask, aggregate and route at high throughput, and the configuration is plain text that lives in version control.
A sound design has a few properties that are worth insisting on, whoever builds it:
- Every event reaches a raw archive first, whatever its verdict, so nothing is lost by a classification mistake.
- Only events classified as worth indexing reach the SIEM, and only those are billed.
- Dropping requires an event to be named twice, once as low value and once as noise, so nothing disappears by omission.
- Sensitive fields are masked before any stage downstream sees them.
- Every rule can be replayed against last week's archive before it goes live, showing exactly which verdicts would move.
What the numbers look like
We are careful with figures, so here is the one we can state. On one production estate, classifying events this way sent 86.4% less volume to the SIEM, measured across 7,959,818 events. That figure is verified. It is not a guarantee for every estate: the mix of sources, the detections in use and the retention obligations all change the result, and anyone promising a fixed percentage before seeing your traffic is guessing.
What we can say generally is that the shape of the saving is predictable even when its size is not. Estates with many chatty infrastructure sources, verbose application logging or duplicated forwarding tend to have more room. Estates that already filter at the source tend to have less. The only way to know is to measure on your own data, over a defined period, before committing to anything.
Keeping the analysts on side
A cost project that removes visibility will be reversed the first time an incident goes badly, and rightly so. The security operations team must own the classification, not merely be consulted on it. That means walking through event identifiers with them, recording their verdict next to the pipeline's verdict, and treating every divergence as a finding to resolve rather than a detail to hide.
It also means making retrieval easy. If bringing a week of archived firewall events back into the SIEM takes a ticket and a fortnight, analysts will resist anything leaving the indexer. If it takes a replay from the console, they will happily let the hot path stay lean. Lower cost and better visibility are not in tension when the archive is genuinely usable.