- 01Sending raw logs directly into a SIEM is an expensive way to learn what your SIEM costs at scale. The modern security data stack is a multi-tier pipeline that separates collection, routing, enrichment, storage, and analysis.
- 02Five layers: collection (agents, syslog, APIs, cloud-native streams), routing and shaping (Cribl, Vector, vendor pipelines), enrichment (identity/asset/threat-intel context attached at the pipeline), storage (hot SIEM / warm data lake / cold object storage), analysis (SIEM for hot, federated query for warm/cold).
- 03What routing and shaping does for you: drops noise before it costs you, reduces a 1KB event to the 200 bytes that matter, splits the same event to multiple destinations (full-fidelity to lake, summary to SIEM), adds metadata downstream queries depend on. Cost savings typically 30-60% of SIEM ingest with no investigative loss.
- 04Federated query model: detections that need real-time response live in hot SIEM; investigations that need historical depth federate to warm and cold tiers. Done well, the analyst experience is one query interface across all tiers; the cost picture is dramatically different from all-hot architectures.
Sending raw logs directly into a SIEM is an expensive way to learn what your SIEM costs at scale. The modern security data stack is a multi-tier pipeline that separates collection, routing, enrichment, storage, and analysis.
The five layers
- 01Collection — agents, syslog, APIs, cloud-native streams
- 02Routing and shaping — tools like Cribl, Vector, or vendor pipelines
- 03Enrichment — identity, asset, threat-intel context attached at the pipeline
- 04Storage — hot tier (SIEM), warm tier (data lake), cold tier (object storage)
- 05Analysis — SIEM for hot, federated query for warm/cold
What routing and shaping does for you
Drops noise before it costs you. Reduces a 1KB event to the 200 bytes that actually matter. Splits the same event to multiple destinations (full-fidelity to the lake, summary to the SIEM). Adds metadata that downstream queries depend on. The cost savings are typically 30-60% of SIEM ingest, with no investigative loss.
The federated query model
Detections that need real-time response live in the hot SIEM. Investigations that need historical depth federate to the warm and cold tiers. Done well, the analyst experience is one query interface across all tiers; the cost picture is dramatically different from all-hot architectures.