Legacy SIEMs are due for retirement
The world's most popular SIEM was built over 20 years ago. It hasn't changed much since.
Unfortunately, neither has the competition.
If you look at the Gartner Magic Quadrant for SIEM, every vendor present is either running on a variation of the same legacy infrastructure, or on a data warehouse that was never built for logs to begin with.
The rest of the world, however, has changed a lot in 20 years. And with GenAI adoption ramping, the rate of change will accelerate.
Four trends will define the future of the SIEM
At IceGuard, we're betting that four trends will define the future of SIEM:
-
Log volumes will grow exponentially. Logs are generated by actions in your environment. Agents easily take >10x more actions per day than humans, and humans often run multiple agents in parallel, 24/7 in many cases. As a result, log volumes will grow by >10x as well.
-
Query volumes against the SIEM will grow exponentially. Queries used to require a human to formulate the question, craft the query, and interpret the results. With AI, hundreds of queries can be generated by a single prompt. This means the total query volume against your SIEM and other SecOps data stores will grow by multiple orders of magnitude.
-
Attacks will get more frequent, faster, and more creative. AI lowers the barriers for attackers to develop and launch sophisticated attacks against a large number of targets. Advanced techniques such as zero-day exploits, spear phishing, and EDR evasion are becoming commoditized, and attacks can complete in minutes.
-
Security logs will become a highly sensitive data asset. AI traces are one of the most important log sources for security teams to monitor. However, AI traces contain highly sensitive data such as your IP, business processes, credentials, and confidential activity of privileged employees. Unlike traditional audit logs, AI traces must be safeguarded like any other crown-jewel asset. This means they can't be spread across SaaS services and point solutions, but require centralized storage with governed access in your own environment.
If you agree with that list, it's clear that the legacy SIEMs are the wrong solution. They were already too slow and expensive for a pre-AI world.
In an AI world, they'll be obsolete.
It's time we raise the bar.
Unlike what most security vendors will tell you, 10 TB/day is not big data. And it should not require a million-dollar SIEM budget or a decoupled architecture to handle efficiently.
In fact, we believe most security organizations should have the majority of their security data in a single, centralized data store. We call that data platform a Modern SIEM, and it needs to meet the following requirements:
-
Complete visibility. It provides unified, governed access to all your data, without relying on cold stores or federation. You can search months of data and get answers in seconds.
-
Continuous detection. It can run stateful detection logic in near real time, while easily incorporating behavioral baselines to minimize manual tuning. It can seamlessly aggregate, correlate, and enrich detection findings when they're created, so you don't need to spend your investigation time on ETL.
-
Unrivaled efficiency. It can ingest >10x the log volume and run >10x the query volume of your legacy SIEM without throttling or blowing up your budget.
-
Sovereign data. Your data remains in your account, stored in open formats. Your vendor does not have standing data access, and data can be retained indefinitely at object store rates.
Legacy SIEM architectures can't deliver any of those requirements. Neither can general-purpose data warehouses or a security data mesh!
We should stop accepting mediocre incumbents that have stopped innovating, and new entrants who reduce the scope and ambition of the SIEM.
Let's raise the bar!
FAQ
This sounds too good to be true. How is this possible?
The infrastructure underlying data systems has changed substantially over the last 20 years. Object storage lowered the cost of durable storage. Columnar formats, better compression, vectorized execution, and distributed query engines reduced the cost of scanning and aggregating large datasets. Elastic compute made it possible to scale query capacity independently from storage.
Most legacy SIEMs were designed before these advances existed, and only partially benefit from them.
General-purpose data warehouses use many of these advances, but they are not optimized for security logs. Security telemetry is predominantly append-only, time-oriented, and semi-structured, with sparse schemas, high-cardinality fields, large text payloads, and regular schema changes. It also requires a mix of full-text search, aggregations over large volumes of data, and continuous detection over newly arriving data.
A Modern SIEM can use the same underlying infrastructure advances while optimizing storage, indexing, query execution, and streaming specifically for security-specific access patterns.
Do I still need my security data pipelines and query federation engines?
Usually no. With the right technology and pricing, ingesting directly into the SIEM is easier to manage, gives a better user experience, and costs less.
In some cases, there might be an argument for running small pipeline deployments or federating against specific datasets. But these components should not be the core part of your SecOps data platform.
Who offers a Modern SIEM today?
No one, as far as we know. Most others are selling pipelines, federation, legacy SIEM or a thinly wrapped data warehouse. If you're unsure, check your vendor's specs against the requirements above. If they don't meet them, the answer is clear.
We're hoping to be the first to market on this one ;)
