SIEM selection: the criteria that matter under NIS2 and DORA

Why it matters

A SIEM ships as an empty engine. Its value comes from detection rules, and those rules age: every new attacker technique, every new log format and every change in your environment requires updates. Whether the vendor maintains a curated, MITRE ATT&CK mapped rule set or leaves that work to you is the difference between a product and a project.

Why it matters

The SIEM's time to detect is the sum of ingestion delay, correlation window and rule execution interval, and each of those can hide minutes to hours. An attacker who moves from initial access to domain admin in ninety minutes is not caught by a correlation rule that runs hourly on data that arrived thirty minutes late. NIS2's 24-hour clock starts at awareness, and awareness starts here.

Why it matters

A single failed login is noise; five failed logins followed by a success from a new country and a privilege change is an incident. Correlation turns events into that story, and enrichment adds who the user is, what the asset does and whether the IP is known bad. Without both, the analyst reads raw events and the queue fills with alerts nobody can prioritise.

Why it matters

Detection is only the first step. An alert has to become a ticket, trigger an enrichment, isolate an endpoint through the EDR and land in the incident record the auditor will read. If those handoffs are manual, response time is measured in shifts instead of minutes, and the timeline you later reconstruct has gaps.

Why it matters

A SIEM that raises a thousand alerts a day of which three matter has hidden the three. False positives are not a nuisance, they are the mechanism by which real incidents get closed unread. The tuning effort to get a rule set from noisy to useful is analyst weeks, and it is the cost that never appears in the licence quote.

Why it matters

SIEM licences are priced per gigabyte ingested, per event, per node or per workload, and every model rewards a different behaviour. Per-gigabyte pricing makes every new log source a budget conversation and pushes teams to switch off the verbose sources that are most useful in an investigation. The pilot volume is never the production volume.

Why it matters

A SIEM only sees what you send it, and only detects what it has a use case for. Attackers today move through identity providers, SaaS applications, cloud control planes and, in industrial environments, OT networks. If those sources are not covered by vendor-maintained parsers and detections, the tool covers the servers you already monitored and misses the systems where incidents now start.

Why it matters

Regulatory expectations and your own forensic needs can require security logs to be kept for a year or longer, while SIEM pricing assumes you keep a few weeks in fast storage. And the moment you need the SIEM most is the moment it holds the most data and the most people are querying it: a search that returns in seconds at the demo volume can take minutes or time out against months of retained data.

Why it matters

Your log sources are no longer only syslog from servers in a data centre. Cloud audit trails, container platforms, serverless functions and SaaS applications produce logs through APIs, event streams and object storage, in formats that change with the provider's release cycle. A SIEM built for the syslog world collects those sources through a custom script that breaks the next time the provider changes a field.

Why it matters

Correlation across sources only works if a username in the firewall log and a username in the identity log end up in the same field with the same format. Normalisation and parsing are the unglamorous layer that makes every detection rule work, and when a parser is missing or breaks, the events are stored as text and every rule that depended on them goes silent without an alert.

Why it matters

A SIEM without people is a bill. Someone has to tune rules, triage alerts, run investigations and keep parsers working, and how fast an analyst can pivot from an alert to the related events, the asset, the user and the timeline decides how many incidents a small team can actually handle. The workbench is where analyst hours are won or lost.

Why it matters

The incident record that the auditor reads and the change that fixes the root cause both live in the ticketing system, not in the SIEM. If an alert does not become a ticket with the right fields, the right assignee and a link back to the evidence, the SIEM's timeline and the organisation's timeline diverge, and under NIS2 and DORA it is the organisation's timeline that gets reported.

Why it matters

The three sources that decide most investigations today are the EDR, the identity provider and the cloud control plane. Integration depth means more than ingesting their logs: it means the analyst can see the process tree from the EDR, the user's recent authentications from the IdP and the cloud role changes in one view, and can trigger a containment in the EDR or a session revocation in the IdP from the SIEM.

Why it matters

Threat intelligence is what lets a detection say "this IP belongs to a known ransomware group" instead of "this IP made a connection". Its value in a SIEM depends on whether indicators are matched automatically against every source, how fresh they are, and whether you can bring the feeds of your sector's CERT and ISAC alongside the vendor's.

Why it matters

On-premises gives you the residency question on your own terms and makes you the operator of a data platform with its storage, patching and scaling. SaaS removes that burden and moves the residency and access questions to the vendor. Hybrid collects on premises and analyses in the cloud, and the collector layer is where most hybrid deployments spend their operational effort.

Why it matters

The licence is a fraction of what a SIEM costs. Storage for retention, the collectors and their hosts, the analysts who run it, the professional services for onboarding, the integration work, the training, and the ingestion growth that follows every new source all belong in the number. A three-year total at your current log volume, with growth, is the only figure that can be compared across vendors.

Why it matters

Security logs contain usernames, IP addresses, email subjects and sometimes full payloads, which makes them personal data under GDPR and often confidential business data. Where they are stored is one question; where the vendor's support engineers, managed service analysts and machine learning pipelines access them is another, and it is the one Schrems II is about. The vendor's SOC 2 report is what goes into your supplier file.

Why it matters

NIS2 Article 23 expects an early warning within 24 hours and an incident notification within 72 hours of awareness; DORA requires financial entities to report major ICT-related incidents on a similarly tight timeline. Both need a defensible timeline of what happened, built from logs whose integrity you can vouch for. If the SIEM cannot export that evidence in a form you can hand over, the deadline is missed on paperwork, not on detection.

Why it matters

Switching SIEM means moving years of logs, rewriting every detection rule in a new query language and retraining the team. That switching cost is what lets vendors raise prices at renewal. Before you sign, you need to know how you would leave, and whether the history you are legally obliged to keep will still be readable somewhere else.

Why it matters

You sign for three years, and the SIEM market consolidates faster than most. Whether the vendor invests in the detection content, the cloud sources and the analyst tooling you will need, and whether its AI features do something an analyst can verify, decides whether the platform still fits in year three. It also signals whether the vendor will still exist independently by then.

Why it matters

Per-gigabyte pricing punishes you for the verbose sources that matter most in an investigation. Per-node pricing punishes a large estate of small servers. Flat pricing looks safe until you learn what the flat rate assumes. Each model rewards a different behaviour, and the wrong one turns every new log source into a budget negotiation with your own security team.

Why it matters

The committed volume is set at pilot size and the overage rate is in the small print. One noisy firewall, one debug flag left on, one new cloud source, and the invoice for the month is a five-figure surprise. Predictability is not the list price, it is what happens contractually on the day you exceed the commitment and whether you can see it coming.

Why it matters

At the end, the decision needs one number per vendor that can be compared: the quoted annual licence price at your current log volume, for the configuration you will actually run, over the term you will actually sign. Every other criterion in this catalog feeds into how much that number is worth; this one makes sure it exists and that it is comparable.