Insights · Field note · Security assurance and compliance
SIEM without the noise: what to log and why
A SIEM that ingests everything and alerts on everything is ignored. Decide what you need to detect, then log what detects it.
A security information and event management system earns its cost when it collects the log sources that matter, applies rules tuned to the environment, raises alerts someone triages, and retains records long enough for investigation and compliance. The common failure is the reverse: every source ingested, vendor rules left at default, thousands of alerts a day, a queue nobody reads, and retention set by storage cost. Start from the questions the organization must be able to answer, identify the sources and rules that answer them, and measure the SIEM by whether those alerts are seen and acted on.
In detail
What the evidence shows.
Start from detections, not sources
What must the organization notice: a compromised account, privilege abuse, a device isolated by endpoint protection, a backup deleted, data leaving, a new administrator created, a login from an impossible location. Each detection implies sources and rules. Sources that serve no detection add cost and noise.
The sources that matter most
Identity provider and directory authentication. Endpoint detection and response. Email security. Firewall and remote access. Cloud control planes and administrative actions. Backup system administration. Privileged account use. These cover the majority of the detections above. NIST SP 800-92 remains a sound reference for log management practice.
Tuning and triage
Default rules fire on normal activity in every environment. Tuning suppresses what is known to be normal, enriches what remains with context, and sets severity by consequence. Triage is a staffed process with a measured response time, or the SIEM is a storage system. Monthly reporting shows alerts raised, triaged, escalated and the time to each.
Retention and evidence
Retention is set by investigation needs and compliance obligations, protected from modification, and tested by actually retrieving old records. The logs are evidence: of controls operating, of incidents handled, of what an attacker did. See SIEM and log management support and the glossary entry for SIEM.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days