How Threat Modeling and In-Stream Detection Can Make SIEM Monitoring More Cost-Effective
Summary
The article recommends using organizational threat models to prioritize SIEM detections and data collection, and compares running detections in SIEMs, security tools, or data pipelines to balance cost, response speed, visibility, and analyst workflow.
Key points
- The author argues that detection requirements and telemetry growth can outpace SOC budgets, so teams should prioritize the data they collect and the detections they run.
- Build detection priorities from likely attack scenarios, combining threat actor capabilities with organizational context such as industry, systems, geography, past incidents, and critical assets.
- Start with a focused threat model, identify recurring techniques among relevant threat actors, then onboard the data and develop detections needed to cover those targets.
- Detection coverage mapped to MITRE techniques can be incomplete because tools have undocumented capabilities and differing configurations; the author says it remains useful if those limitations are understood.
- Running detections in downstream tools can reduce SIEM ingestion costs and improve detection speed, but may fragment analysts' workflows and limit visibility into vendor-defined logic.
- The author favors in-stream detections as a way to analyze verbose data without storing all of it in a SIEM, while keeping detection logic visible, testable, and centralized for alert handling.
- The article notes that not every detection or data source belongs in a pipeline or SIEM; teams should place each where it best serves its purpose.
Article Details
- Defense Focus
- Plan threat detection around an organization's likely attack scenarios and internal context, then place detections where they best balance effectiveness, response speed, analyst workflow, and cost.
- Detection Methods
- Build and update a threat model using likely threat scenarios, organizational context, and known threat actor capabilities.
- Consult MITRE group listings, identify techniques used by relevant groups, and prioritize techniques that recur across those groups as detection targets.
- Validate detection coverage against realistic scenarios and the organization's different system tiers, security settings, and exclusions.
- Run suitable detections in-stream against telemetry as events pass through the pipeline.
- Data Sources
- DNS logs
- Proxy logs
- Firewall logs
- Raw endpoint telemetry
- Rule Types
- Detection logic stored as code in a repository, version controlled, diffed, and tested in CI
- Platforms
- SIEM
- EDR
- CDR
- IDP
- Telemetry pipeline
- Defensive Actions
- Start with a focused set of detection scenarios informed by organizational context, then update the threat model as understanding improves.
- Onboard data needed for prioritized detections while accounting for analyst workload.
- Run detections in downstream tools or in-stream when appropriate rather than requiring every detection to run in the SIEM.
- Use telemetry pipelines to remove duplicate or unnecessary data and consider tiered storage for rarely accessed data.
- Validate native detection capabilities instead of assuming vendor tools provide complete coverage.