Why More SIEM Data Makes Your Security Team Slower, Not Safer

The instinct: log everything, just in case

More visibility sounds like it should mean more security. "Log everything" is a genuinely reasonable-sounding default, until it collides with two real constraints at once: SIEM platforms are billed by volume, and a human analyst's attention doesn't scale with data volume at all. More logs, past a certain point, cost more and help less, not because logging is bad, but because most of what gets logged was never the part that mattered.

graph LR
    A[All Network Activity] --> B[Logged to SIEM]
    B --> C[Routine Noise<br/>95%+ of volume]
    B --> D[Real Security Signal<br/>a small fraction]
    C -->|Costs money,<br/>adds no value| E[Ingestion Bill]
    D -->|Needs an analyst's<br/>actual attention| F[Investigated]

A realistic slice of a real log stream

log_types = rng.choice(
    ["dns_lookup", "health_check", "proxy_request", "failed_login", "privilege_escalation"],
    size=2000, p=[0.45, 0.30, 0.20, 0.045, 0.005]
)

Five real, ordinary log categories, in roughly the proportions a real network actually produces: mostly routine DNS lookups and health checks, some proxy traffic, a small, genuine fraction of failed logins and privilege escalation attempts, the kind of events actually worth an analyst's time.

What the volume and the value actually look like, measured separately

df["high_value"] = df["log_type"].isin({"failed_login", "privilege_escalation"})
total_gb = df["size_kb"].sum()
high_value_gb = df[df["high_value"]]["size_kb"].sum()

real total log volume (all types): 0.89 MB, 2000 records
real high-value security signal: 0.08 MB, 93 records
real share of volume that's actually high-value signal: 8.5%
real share of record count that's high-value: 4.7%

Under 5% of records, under 9% of the actual data volume, is the category of event a security team would genuinely want flagged. The other 91-95%, routine and expected, still costs real ingestion budget and still sits in front of an analyst scrolling through results, diluting the signal every single time.

Why "more visibility" and "more security" aren't the same claim

SIEM platforms charge by real ingestion volume, and cost scales with the routine 95%, DNS lookups and health checks, exactly as fast as it scales with the events that actually matter. The industry's own guidance on this is direct: more data is not automatically better, since at a certain point the cost of sending every bit of data to the SIEM outweighs the actual security benefit, and effective filtering is specifically what improves analysis quality and makes real anomalies easier to spot, not harder (Lumifi, ConnectWise). The measurement above, real signal at under 9% of real volume, is the concrete shape of exactly that tradeoff.

What this actually changes about how logging gets designed

Not "log less." Log deliberately: route the routine, high-volume, low-signal categories to cheaper cold storage kept for compliance and retrospective investigation, and reserve full SIEM ingestion, with real-time analysis and alerting, for the categories that carry genuine security value. The same total visibility, at a real fraction of the cost, with an analyst's actual attention spent on the roughly 5% of events that were always the point.

The takeaway

Volume and value are two separate real numbers, measured separately above on the same log stream, and they don't move together. A logging strategy built around "capture everything, sort it out later" pays full price for the 95% that never needed real-time attention, while the 5% that does gets harder to find, not easier, the more noise sits around it. Measuring the actual signal share directly, the way it's measured here, is what turns a logging budget into a deliberate decision instead of a default nobody chose on purpose.