Cutting a Splunk Bill by Half Without Losing a Single Detection: A Noise-First SIEM Migration
Per-GB SIEM pricing punishes exactly the telemetry sprawl that modern cloud-native stacks produce - most of which nobody ever searches. The fix wasn't a bigger contract; it was finding out what was actually noise first.
What we were solving
Mid-market financial services firm, legacy per-GB-priced SIEM contract renewing at a steep increase, security team assuming they had to accept the cost or accept a coverage gap - not realizing most of the ingest was never queried.
- Daily log ingest had grown year over year as cloud services multiplied, and the SIEM bill scaled directly with it - regardless of whether anyone ever searched that data.
- The security team assumed cutting ingest meant cutting detection coverage, so nobody had seriously audited what was actually noise versus signal.
- Migrating SIEM platforms outright felt too risky to attempt without knowing which data actually mattered to existing detections.
What we built
- Audited a full week of ingest against actual query and detection-rule usage to classify every log source as signal, occasional-signal, or pure noise - debug lines, duplicate health checks, and redundant heartbeats made up the bulk of it.
- Applied upstream filtering and sampling on the noise sources before touching the platform contract, cutting ingest volume while every detection rule kept the exact fields it depended on.
- Only after ingest was right-sized did the team migrate the reduced, higher-signal stream onto a correlated AI-assisted platform - a smaller, cheaper migration than moving the original noisy volume would have been.
Architecture notes for your engineers
- Filtering happened upstream of the SIEM at the collector/forwarder layer, so source systems and downstream detection logic needed zero changes.
- Every detection rule was replayed against the filtered stream before cutover to confirm no dependent field had been silently dropped.
Key results
- 58% reduction in daily log ingest before any platform change
- Annual SIEM spend cut by more than half at renewal
- Every existing detection rule preserved with zero coverage gaps
- Team could finally explain to the board exactly what was being paid for
What it was built on
Representative tools and patterns — exact vendors vary per client environment.
Ingest analysis
SIEM platform
Validation
What we'd tell the next team
- Most SIEM cost problems are ingest problems, not platform problems - fix the noise before you sign a new contract or migrate anything.
- Debug lines, duplicate health checks, and redundant heartbeats are the recurring villains; auditing usage against ingest usually finds them fast.
- A smaller, cleaner migration is dramatically less risky than moving your full noisy volume onto a new platform and hoping the noise sorts itself out later.
Questions this engagement anticipated
Why cut ingest before migrating platforms?
Per-GB SIEM pricing means noisy ingest is the actual cost driver, not the platform choice - cutting noise first makes any subsequent migration smaller, cheaper, and lower-risk, and often changes whether a migration is even necessary.
How do you cut ingest without losing detection coverage?
By auditing which log fields every existing detection rule actually depends on before filtering anything - noise sources like debug lines, duplicate health checks, and redundant heartbeats can be dropped or sampled without touching the fields detections rely on.
This is one of several case studies on siem & soc modernization.
See the rest of the cluster →Compare your situation to this case.
Bring your constraints - environment, timeline, and budget. We scope before we quote.