Most of the data a SIEM ingests is never read by a detection rule. When measured, rules read only of the bytes we paid to ingest. The rest was there for search, for investigations, or for nothing at all. We call that the noise tax: the part of the SIEM bill spent on data that no rule reads and no analyst queries.
SIEM pricing is built on ingestion. By being charged by gigabyte, you’re paying the same amount for every piece of data whether it powers a critical detection or sits untouched until it ages out. As your bill grows, it’s rarely because there are more threats but rather more data and most of it is noise.
In this post, I’ll explain where the noise tax comes from, how to measure it, and how to cut it without breaking the rules that watch your environment.
Where Does SIEM Noise Come From?
SIEM noise doesn’t come from one bad source, it builds up in a few predictable places. These are the sources, what they look like, and why they cost you:
|
Noise source |
What it looks like |
Why it costs you |
|---|---|---|
|
Verbose sources |
Firewall allow logs, DNS, endpoint heartbeats, debug-level app logs |
High volume, low detection value; often the biggest line items |
|
Redundant fields |
The same IP, hostname or timestamp repeated across nested fields |
You pay per byte, so every duplicate field is billed |
|
Duplicate events |
The same event forwarded by two collectors or two tools |
Double ingestion, plus double noise for analysts |
|
Unused sources |
Data onboarded for a project or audit that ended long ago |
Ongoing cost with zero queries against it |
|
Raw, unparsed formats |
Syslog blobs and vendor formats shipped as-is |
Bigger payloads, slower searches, harder correlation |
|
AI and agent telemetry |
Prompt, response and trace logs from AI apps |
AI logs run 3–4x larger than traditional logs, and volume is climbing fast |
The last one is growing quickly. As enterprises roll out AI agents, telemetry volume grows faster than any SIEM contract was sized for. With AI, the noise tax is no longer just a nuisance, it’s a budget problem.
Why Do Security Teams Keep Paying the Noise Tax?
It’s not that CISOs don’t know their SIEM is full of low-value data, rather they’re trying to protect their organization. These reasons are rational on their own but collectively expensive:
- Fear of a blind spot. Dropping data feels like dropping coverage. No one wants to risk filtering logs to save money in the case of a breach.
- Compliance and retention rules. Auditors want raw logs kept. Teams assume that means keeping them in the SIEM, the most expensive place to store anything.
- No map from detections to data. Without knowing which fields each detection rule reads, there's no safe way to decide what to cut. So, teams cut nothing.
- No layer before the SIEM. In most stacks, data flows straight from source to SIEM. There's no middle layer to filter, trim, route or reshape it.
- Team bandwidth. Building and maintaining filtering pipelines by hand is data engineering work. Security teams are already stretched, and that work keeps losing to incidents.
Put these together, security teams choose safety at a steep price.
How to Measure the Noise Tax in Your SIEM
Before you buy anything, you can measure your noise tax with data you already have. To do so, follow these steps:
- Rank sources by cost. Pull ingestion volume by source for the last 90 days. Use the numbers from your billing or license page. The top five or ten sources usually make up most of the bill.
- Map detections to data. For each active detection rule, list the sources and fields it reads. Note which sources appear in no rule, no dashboard and no saved search.
- Score each source. Mark it hot (used by detections or active investigations), cold (needed for audit or occasional hunting) or drop (duplicate or unused).
- Check your retention rules. Confirm what compliance actually requires: retained raw logs, not necessarily logs retained in the SIEM. Cold storage often satisfies the requirement at a fraction of the cost.
- Do the math before renewal. Multiply your cold and drop volume by your per-GB SIEM cost. That number is your noise tax, and should be the starting point for your next renewal conversation.
By the way, if step 2 stalls because nobody can map detections to fields by hand, that's the signal you need a pipeline layer that does it for you. Keep reading to learn more about how Fleak can help.
How Do You Cut SIEM Costs Without Losing Detection Coverage?
- Start with sources that have no rules and no searches. These are the cheapest decisions. Confirm with the source owner, then stop sending them or route them to archive.
- Drop duplicates before they reach the SIEM. Deduplicate on a stable event ID or a hash of the raw event. This cuts cost without removing a single unique event.
- Trim fields, not events. Remove raw message copies and fields with no rule or search reads. Keep every field a rule reads, plus the fields an analyst needs to investigate an alert.
- Filter high-volume, low-signal events only where no rule reads them. Check each filter against your rule list. A rule that watches for unusual List* calls breaks if you drop all List* calls.
- Keep what you cut in cheap storage. Send the full stream to object storage so you can search or rehydrate it after an incident.
This process should occur in the pre-SIEM data layer aka a security data pipeline. If your team doesn’t have the headcount or time to facilitate this process, Fleak can do it for you.
What Is Fleak?
Fleak is a security data pipeline platform that sits between your source and the SIEM, and allows you to automate the process of cutting the noise tax. Fleak uses AI to generate and maintain pipelines, so new sources are onboarded quickly rather than through weeks of manual parsing. The pipelines themselves run deterministically, with change control and full audit trails.
What the Savings Look Like
Our customers have seen 30–40% lower SIEM costs and up to 70% less log volume, with savings showing up in 2–4 weeks. With Fleak, a team spending $5M a year on Splunk could save around $1.5M without removing a single detection.
FAQ
Can You Cut Splunk Costs Without Losing Detection Coverage?
Yes. Filtering starts from your existing detections and keeps every field those rules read. Only data no detection depends on is trimmed, tiered or dropped.
How Do You Decide Which Logs Are Critical?
By analyzing your SIEM detections to see which sources and fields they use, then assessing each event as it arrives. Critical data goes to the SIEM; the rest goes to cheaper storage.
Do We Still Keep Raw Logs for Compliance?
Yes. With split-stream routing, 100% of raw logs go to low-cost storage for audit and rehydration, while only processed, detection-relevant data goes to the SIEM.
Does Pre-Processing Logs Add Latency?
Not meaningfully. Fleak processes data with sub-second latency, so detection and response times aren't affected.
Can This Run On-Prem?
Yes. Fleak runs in the cloud, hybrid (data plane on-prem) or fully on-prem and air-gapped, with no data egress.
Does a Pre-SIEM Data Layer Replace My SIEM?
No. It sits in front of your SIEM and makes it cheaper and more effective. Your SIEM remains untouched
Stop Paying Premium Prices for Data You Never Query
The noise tax isn't a cost of doing security. It's a cost of not deciding what your data is worth before you pay to store it. Fleak automatically categorizes data and determines if it needs to be stored at all, before you incur storage costs.
Want to know your number? Fleak's free data audit maps your detections to your data and shows what you could save in 2–4 weeks. Start at fleak.ai/audit.