# 3. SIEM, SOAR, Log Management

SIEM has been "dying" for a decade and yet somehow keeps getting more expensive. SOAR was supposed to fix the analyst shortage and mostly didn't. Log management is where most organizations actually live but rarely budget honestly for. Let's untangle it.

Context: SIEM (Security Information & Event Management) collects logs, correlates them, and alerts on bad things. SOAR (Security Orchestration, Automation & Response) automates the responses to those alerts. Log Management is the unglamorous foundation, getting logs in, parsed, retained, and searchable. The market has been consolidating these into "next-gen SIEM" or "security data lake" or "AI-driven SecOps platforms," but the fundamentals haven't changed: garbage in, garbage out, and the bill scales with your data volume. Most SIEM disasters aren't about technology, they're about ingest pricing surprises, parsing nightmares, and detection content that nobody owns.

13 Questions to Ask SIEM/SOAR/Log Management Vendors

1. "Show me your pricing model in detail, by GB ingested, by EPS, by user, by data source, by retention tier? And what counts as 'ingest' vs. 'indexed' vs. 'searchable'?"
Why: This is THE question. SIEM bill shock is the #1 reason CISOs get blindsided. Vendors play games with hot/warm/cold storage tiers, and "ingested but not indexed" data may be effectively unusable without paying more.
Good answer: Transparent, tiered pricing with worked examples for your expected volumes. Red flag: "It depends on your usage" with no calculator or commitment.

2. "If my data volume doubles unexpectedly, say, from a new acquisition or a noisy log source, what happens to my bill, and what controls do I have?"
Why: Many SIEM contracts have brutal overage charges. Without volume controls, a misconfigured firewall can cost you six figures.
Good answer: Volume caps, alerts at thresholds, ability to drop/filter at ingest, fixed annual ceilings. Red flag: "We'll just true-up at renewal."

3. "What detection content ships out of the box, who maintains it, and how often is it updated? Can I see the actual rule library?"
Why: A SIEM without good content is just an expensive log bucket. Many vendors ship 50 generic rules and call it a "detection library." Ask to see it.
Good answer: Public or demo-able content library, named detection engineering team, weekly+ updates, MITRE-mapped. Red flag: "Our customers build their own content" (translation: you're on your own).

4. "How do you handle parsing of non-standard or custom log sources, and what happens when a vendor changes their log format?"
Why: Parsing is where SIEM projects go to die. Every environment has weird custom apps. The question is whether parsing is your problem or theirs.
Good answer: Self-service parser builder, vendor-maintained parsers for top 200+ sources, automatic format-change detection. Red flag: "Just send us the logs and we'll figure it out" (= professional services bill).

5. "What's the realistic time-to-value? Show me 3 references who got from contract signature to meaningful detections in under 90 days."
Why: SIEM projects famously take 6–18 months to deliver value. If a vendor claims faster, demand proof. If they admit it's slow, at least they're honest.
Good answer: Named references, deployment methodology, defined milestones. Red flag: "Our customers are typically fully deployed in 2 weeks" (almost certainly false at any real scale).

6. "What's your data retention model, and what does it cost to search across 12 months vs. 30 days of historical data?"
Why: Compliance requirements (HIPAA, PCI, etc.) often mandate 1+ years. But "retention" without affordable searchability is useless during an investigation. Frozen/archive tiers can take days to rehydrate.
Good answer: Hot/warm/cold tiers with clear pricing and rehydration SLAs measured in minutes/hours. Red flag: "Long-term retention is available" without performance specifics.

7. "For SOAR, show me 5 real playbooks that customers run today, with the actual integrations and decision logic. Not the demo wedge."
Why: SOAR demos look magical. Production SOAR is a graveyard of half-finished playbooks because integrations break, edge cases proliferate, and ownership is unclear.
Good answer: Real customer-built playbooks, common patterns library, honest discussion of maintenance burden. Red flag: "You can automate anything!" (yes, but at what cost?).

8. "How does your platform behave during a major incident when query load spikes 10x, do searches slow, queue, or fail?"
Why: The moment you need your SIEM most (active breach), it's often the moment it falls over. Multi-tenant cloud SIEMs especially can throttle you.
Good answer: Documented performance under load, dedicated query capacity options, customer war stories. Red flag: "We auto-scale" with no specifics.

9. "Where is my data stored, who has access to it, and can I bring my own encryption keys (BYOK)?"
Why: Your SIEM contains your most sensitive operational data, credentials, internal hostnames, user activity, attack telemetry. Data residency and key custody matter for regulators and for breach blast radius.
Good answer: Regional hosting options, BYOK/HYOK support, documented internal access controls, SOC 2 + ISO 27001. Red flag: "Your data is encrypted" with no detail on key management.

10. "When I leave, what happens to my historical data, my custom detections, and my playbooks? Can I export everything in a usable format?"
Why: SIEM lock-in is among the worst in security. Migrations routinely take 12+ months because detections are written in proprietary query languages (SPL, KQL, etc.) and don't port.
Good answer: Open query standards (Sigma, OCSF), bulk export tools, transition assistance. Red flag: "We make it easy to migrate to us" (notice the direction).

11. "How do you handle false positive tuning, is it self-service, or do I need professional services to adjust thresholds?"
Why: Alert fatigue is the silent killer of SOCs. If tuning requires a ticket to the vendor, your team will give up and ignore alerts.
Good answer: Analyst-friendly tuning UI, suppression rules, allowlist management, ML-assisted noise reduction. Red flag: "Our default rules are pre-tuned" (no environment is generic).

12. "Can I run the same detection logic across multiple data sources, or do I rewrite rules per source? What's your stance on Sigma, OCSF, or other open standards?"
Why: Vendor-specific query languages are lock-in by design. Open standards are slowly winning. A vendor's stance on these reveals their long-term posture.
Good answer: Native or import support for Sigma rules, OCSF schema adoption, contribution to open-source. Red flag: "Our query language is more powerful." (Maybe, but at what cost when you leave?)

13. "What does the human side of running this look like? How many FTEs do typical customers my size need to operate it well?"
Why: SIEM/SOAR is not a "set and forget" purchase. The dirty truth is that the tool is often 20% of the cost, humans to run it are 80%. Vendors will rarely volunteer this honestly.
Good answer: Honest FTE estimates by company size, co-managed options, MDR upgrade path. Red flag: "Our platform is so automated you barely need staff."

14. (Bonus) "What's your roadmap for 'AI in the SOC', and which parts are real today vs. demo-only?"
Why: Every SIEM vendor is now claiming AI-driven triage, autonomous investigation, and natural-language querying. Some of it works; most doesn't yet at production scale.
Good answer: Specific shipping features, customer evidence, honest about limitations. Red flag: See Topic 1, apply the entire AI question set here.

🎯 The Meta-Test

• Q1 and Q2 are non-negotiable in writing. Walk away from any vendor who won't commit to predictable pricing.
• Q3 separates SIEM platforms from SIEM products. A platform with no content is a kit car with no engine.
• Q5 and Q13 are the questions that protect your job. Underestimating time-to-value and human cost is how SIEM projects become career-ending boondoggles.

💡 Honest Observation

For mid-market companies (the "regular" companies you mentioned in your scene-setting), the right answer is increasingly not a self-managed SIEM at all, it's MDR + log management, or a co-managed SIEM model. Buying a SIEM you can't staff is the most expensive mistake in this category.