SIEM Is Not Dead: How to Use Logs and AI More Intentionally
Summary
A Huntress author argues SIEM remains useful when organizations retain security- and compliance-relevant logs, use AI selectively for correlation and investigations, and divide monitoring and response responsibilities between providers and internal teams.
Key points
- The author argues that ingesting every available log can drive costs and alert noise without ensuring the data is useful.
- On-demand AI log analysis may shift spending from storage to compute, while depending on source retention, API availability and rate limits, and compliance requirements.
- The recommended approach is to retain logs that support threat detection or investigation, and those required by auditors, regulators, or insurers.
- The article suggests applying AI after filtering, for tasks such as correlating endpoint, identity, and log data, summarizing activity, and adding triage context; analysts and detections remain responsible for deciding whether activity is malicious.
- Managed security providers can handle broad threat monitoring, detection tuning, triage, and remediation, while internal teams provide context about approved tools, changes, and unusual activity.
- Organizations should agree in advance on incident-response roles and which containment or business decisions require their approval.
Article Details
- Topic
- SIEM log retention, AI-assisted security operations, and shared responsibility in managed security monitoring
MITRE ATT&CK
T1003.001 · LSASS MemoryThe article describes dumping credentials from memory with Mimikatz.T1110.004 · Credential StuffingCredential stuffing is listed as malicious activity a managed security partner should detect.T1490 · Inhibit System RecoveryThe article cites wiping shadow copies as malicious activity a partner should detect.T1621 · Multi-Factor Authentication Request GenerationThe article describes repeatedly prompting a user for MFA approval until they accept.
Vendors
CiscoThe market has caught on. Cisco bought Splunk, and IBM sold its QRadar SaaS business to Palo Alto Networks. When the biggest names in a category start changing hands, something is shifting.HuntressThat's how we approach it at Huntress. Our smart filtering removes logs that aren't security relevant before they ever hit storage, so you're paying for signal and not chatter. The logs that drive detections andIBMThe market has caught on. Cisco bought Splunk, and IBM sold its QRadar SaaS business to Palo Alto Networks. When the biggest names in a category start changing hands, something is shifting.Palo Alto NetworksThe market has caught on. Cisco bought Splunk, and IBM sold its QRadar SaaS business to Palo Alto Networks. When the biggest names in a category start changing hands, something is shifting.
Products
Huntress Managed SIEMWant to see what a SIEM looks like when it only keeps what matters? See Huntress Managed SIEM in action.Microsoft 365 Apps for Enterpriserunning on a server that same account touched ten minutes later, and then a new inbox rule in their Microsoft 365 account forwarding mail to an outside address. Separately those are three data points. TogetherQRadarFor years, the big legacy players (think Splunk and QRadar) priced on how much data you ingested and how much you stored. That model let them charge what they charged.SplunkFor years, the big legacy players (think Splunk and QRadar) priced on how much data you ingested and how much you stored. That model let them charge what they charged.