> ## Content Index > Fetch the complete content index at: https://plaintext.ghost.io/llms.txt > Use this file to discover other available public pages before exploring further. # # 3. SIEM, SOAR, Log Management - URL: https://plaintext.ghost.io/3-siem-soar-log-management/ - Published: 2026-08-03T06:08:14.000Z - Updated: 2026-08-03T06:08:14.000Z - Author: Chris Roberts SIEM has been "dying" for a decade and yet somehow keeps getting more expensive. SOAR was supposed to fix the analyst shortage and mostly didn't. Log management is where most organizations *actually* live but rarely budget honestly for. Let's untangle it. --- **Context:** SIEM (Security Information & Event Management) collects logs, correlates them, and alerts on bad things. SOAR (Security Orchestration, Automation & Response) automates the responses to those alerts. Log Management is the unglamorous foundation, getting logs in, parsed, retained, and searchable. The market has been consolidating these into "next-gen SIEM" or "security data lake" or "AI-driven SecOps platforms," but the fundamentals haven't changed: **garbage in, garbage out, and the bill scales with your data volume.** Most SIEM disasters aren't about technology, they're about ingest pricing surprises, parsing nightmares, and detection content that nobody owns. --- ### 13 Questions to Ask SIEM/SOAR/Log Management Vendors **1\. "Show me your pricing model in detail, by GB ingested, by EPS, by user, by data source, by retention tier? And what counts as 'ingest' vs. 'indexed' vs. 'searchable'?"** *Why:* This is THE question. SIEM bill shock is the #1 reason CISOs get blindsided. Vendors play games with hot/warm/cold storage tiers, and "ingested but not indexed" data may be effectively unusable without paying more. *Good answer:* Transparent, tiered pricing with worked examples for *your* expected volumes. *Red flag:* "It depends on your usage" with no calculator or commitment. **2\. "If my data volume doubles unexpectedly, say, from a new acquisition or a noisy log source, what happens to my bill, and what controls do I have?"** *Why:* Many SIEM contracts have brutal overage charges. Without volume controls, a misconfigured firewall can cost you six figures. *Good answer:* Volume caps, alerts at thresholds, ability to drop/filter at ingest, fixed annual ceilings. *Red flag:* "We'll just true-up at renewal." **3\. "What detection content ships out of the box, who maintains it, and how often is it updated? Can I see the actual rule library?"** *Why:* A SIEM without good content is just an expensive log bucket. Many vendors ship 50 generic rules and call it a "detection library." Ask to *see* it. *Good answer:* Public or demo-able content library, named detection engineering team, weekly+ updates, MITRE-mapped. *Red flag:* "Our customers build their own content" (translation: you're on your own). **4\. "How do you handle parsing of non-standard or custom log sources, and what happens when a vendor changes their log format?"** *Why:* Parsing is where SIEM projects go to die. Every environment has weird custom apps. The question is whether parsing is your problem or theirs. *Good answer:* Self-service parser builder, vendor-maintained parsers for top 200+ sources, automatic format-change detection. *Red flag:* "Just send us the logs and we'll figure it out" (= professional services bill). **5\. "What's the realistic time-to-value? Show me 3 references who got from contract signature to meaningful detections in under 90 days."** *Why:* SIEM projects famously take 6–18 months to deliver value. If a vendor claims faster, demand proof. If they admit it's slow, at least they're honest. *Good answer:* Named references, deployment methodology, defined milestones. *Red flag:* "Our customers are typically fully deployed in 2 weeks" (almost certainly false at any real scale). **6\. "What's your data retention model, and what does it cost to search across 12 months vs. 30 days of historical data?"** *Why:* Compliance requirements (HIPAA, PCI, etc.) often mandate 1+ years. But "retention" without affordable searchability is useless during an investigation. Frozen/archive tiers can take *days* to rehydrate. *Good answer:* Hot/warm/cold tiers with clear pricing and rehydration SLAs measured in minutes/hours. *Red flag:* "Long-term retention is available" without performance specifics. **7\. "For SOAR, show me 5 real playbooks that customers run today, with the actual integrations and decision logic. Not the demo wedge."** *Why:* SOAR demos look magical. Production SOAR is a graveyard of half-finished playbooks because integrations break, edge cases proliferate, and ownership is unclear. *Good answer:* Real customer-built playbooks, common patterns library, honest discussion of maintenance burden. *Red flag:* "You can automate anything!" (yes, but at what cost?). **8\. "How does your platform behave during a major incident when query load spikes 10x, do searches slow, queue, or fail?"** *Why:* The moment you need your SIEM most (active breach), it's often the moment it falls over. Multi-tenant cloud SIEMs especially can throttle you. *Good answer:* Documented performance under load, dedicated query capacity options, customer war stories. *Red flag:* "We auto-scale" with no specifics. **9\. "Where is my data stored, who has access to it, and can I bring my own encryption keys (BYOK)?"** *Why:* Your SIEM contains your most sensitive operational data, credentials, internal hostnames, user activity, attack telemetry. Data residency and key custody matter for regulators *and* for breach blast radius. *Good answer:* Regional hosting options, BYOK/HYOK support, documented internal access controls, SOC 2 + ISO 27001\. *Red flag:* "Your data is encrypted" with no detail on key management. **10\. "When I leave, what happens to my historical data, my custom detections, and my playbooks? Can I export everything in a usable format?"** *Why:* SIEM lock-in is among the worst in security. Migrations routinely take 12+ months because detections are written in proprietary query languages (SPL, KQL, etc.) and don't port. *Good answer:* Open query standards (Sigma, OCSF), bulk export tools, transition assistance. *Red flag:* "We make it easy to migrate *to* us" (notice the direction). **11\. "How do you handle false positive tuning, is it self-service, or do I need professional services to adjust thresholds?"** *Why:* Alert fatigue is the silent killer of SOCs. If tuning requires a ticket to the vendor, your team will give up and ignore alerts. *Good answer:* Analyst-friendly tuning UI, suppression rules, allowlist management, ML-assisted noise reduction. *Red flag:* "Our default rules are pre-tuned" (no environment is generic). **12\. "Can I run the same detection logic across multiple data sources, or do I rewrite rules per source? What's your stance on Sigma, OCSF, or other open standards?"** *Why:* Vendor-specific query languages are lock-in by design. Open standards are slowly winning. A vendor's stance on these reveals their long-term posture. *Good answer:* Native or import support for Sigma rules, OCSF schema adoption, contribution to open-source. *Red flag:* "Our query language is more powerful." (Maybe, but at what cost when you leave?) **13\. "What does the human side of running this look like? How many FTEs do typical customers my size need to operate it well?"** *Why:* SIEM/SOAR is not a "set and forget" purchase. The dirty truth is that the tool is often 20% of the cost, humans to run it are 80%. Vendors will rarely volunteer this honestly. *Good answer:* Honest FTE estimates by company size, co-managed options, MDR upgrade path. *Red flag:* "Our platform is so automated you barely need staff." **14\. (Bonus) "What's your roadmap for 'AI in the SOC', and which parts are real today vs. demo-only?"** *Why:* Every SIEM vendor is now claiming AI-driven triage, autonomous investigation, and natural-language querying. Some of it works; most doesn't yet at production scale. *Good answer:* Specific shipping features, customer evidence, honest about limitations. *Red flag:* See Topic 1, apply the entire AI question set here. --- ### 🎯 The Meta-Test - **Q1 and Q2 are non-negotiable in writing.** Walk away from any vendor who won't commit to predictable pricing. - **Q3 separates SIEM platforms from SIEM products.** A platform with no content is a kit car with no engine. - **Q5 and Q13 are the questions that protect your job.** Underestimating time-to-value and human cost is how SIEM projects become career-ending boondoggles. ### 💡 Honest Observation For mid-market companies (the "regular" companies you mentioned in your scene-setting), the right answer is increasingly **not** a self-managed SIEM at all, it's MDR + log management, or a co-managed SIEM model. Buying a SIEM you can't staff is the most expensive mistake in this category. ---