Huntress opinion piece: SIEM is not dead, but ingest-everything pricing and AI-on-every-log models are flawed
Huntress published a vendor blog arguing that the "SIEM is dead" narrative is marketing, and that what should die is the legacy ingest-and-store-everything buying model rather than SIEM itself. The piece notes market consolidation as evidence of change: Cisco acquired Splunk, and IBM sold its QRadar SaaS business to Palo Alto Networks. It critiques AI-native SIEMs and security data lakes that leave logs at the source and query them on demand via APIs, warning that storage costs are simply swapped for token/compute costs, with added risks around source retention limits (e.g. 30-day windows), API availability and rate limits, and compliance evidence for auditors and cyber insurers. The author recommends a "Detect / Prove / Drop" filtering rule, keeping only security-relevant and regulator-required logs (HIPAA, PCI DSS, CMMC), and applying AI after filtering for correlation, triage enrichment and plain-language reporting. It closes with a shared-responsibility model for managed SIEM. No incident, vulnerability or threat activity is reported.
Detalhes técnicos
The article illustrates correlation value with a hypothetical chain: an improbable-geography VPN login, followed by an encoded PowerShell command on a server touched by the same account, followed by a new forwarding inbox rule in Microsoft 365 — individually weak signals that together form an incident. It also lists activity that is unambiguously malicious in any environment (credential stuffing, MFA fatigue prompt bombing, shadow copy deletion, credential dumping with Mimikatz) versus context-dependent signals customers must judge themselves (unapproved RMM such as ScreenConnect, new domain admin accounts, off-hours logins, service accounts authenticating to VPN, firewall or GPO changes outside maintenance windows).
Linha do tempo
-
Huntress opinion piece: SIEM is not dead, but ingest-everything pricing and AI-on-every-log models are flawed
ler a análise desta fonte ocultar
Huntress published a vendor blog arguing that the "SIEM is dead" narrative is marketing, and that what should die is the legacy ingest-and-store-everything buying model rather than SIEM itself. The piece notes market consolidation as evidence of change: Cisco acquired Splunk, and IBM sold its QRadar SaaS business to Palo Alto Networks. It critiques AI-native SIEMs and security data lakes that leave logs at the source and query them on demand via APIs, warning that storage costs are simply swapped for token/compute costs, with added risks around source retention limits (e.g. 30-day windows), API availability and rate limits, and compliance evidence for auditors and cyber insurers. The author recommends a "Detect / Prove / Drop" filtering rule, keeping only security-relevant and regulator-required logs (HIPAA, PCI DSS, CMMC), and applying AI after filtering for correlation, triage enrichment and plain-language reporting. It closes with a shared-responsibility model for managed SIEM. No incident, vulnerability or threat activity is reported.
Technical Details
The article illustrates correlation value with a hypothetical chain: an improbable-geography VPN login, followed by an encoded PowerShell command on a server touched by the same account, followed by a new forwarding inbox rule in Microsoft 365 — individually weak signals that together form an incident. It also lists activity that is unambiguously malicious in any environment (credential stuffing, MFA fatigue prompt bombing, shadow copy deletion, credential dumping with Mimikatz) versus context-dependent signals customers must judge themselves (unapproved RMM such as ScreenConnect, new domain admin accounts, off-hours logins, service accounts authenticating to VPN, firewall or GPO changes outside maintenance windows).