Lion Cipher Lab
Cut SIEM log volume without losing a detection: measure every reduction against every rule
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Every SOC eventually gets the same email: the SIEM (Security Information and Event Management platform -- the system that collects logs from everywhere and runs detection rules over them) is over its ingest budget, because most SIEMs are priced or capped by how many gigabytes of logs you push into them per day. Someone proposes the obvious fix: drop the noisy logs. Sometimes that is exactly right -- a load balancer pinging /health every two seconds is not evidence of anything. But the decision is usually made by looking at a dashboard of event counts, by someone who cannot see which detection…
What you'll learn
- what SIEM ingest volume is, why it is billed or capped, and why 'just drop the noisy logs' is a detection decision, not a storage decision
- measuring a log estate per source in BOTH events and bytes, and why the two rank sources differently
- writing detection rules that DECLARE the source and fields they need, and turning those declarations into a detection-to-source dependency map
- measuring five reduction strategies (drop a source, drop health-check chatter, drop fields, aggregate, sample 1-in-N) for percent volume saved AND detections retained, rule by rule
- spotting the two silent killers: a dropped field that kills a rule with no error, and sampling that breaks threshold and rare-event rules while the dependency map still says everything is fine
- assembling a reduction plan that cuts about two thirds of ingest with every rule still firing, and routing what you cut to cheap compressed storage instead of deleting it
Steps in this lab
- The problem, the words you need, and which labs this is NOT
- Generate one synthetic day of SIEM logs (nothing real is touched)
- Write the measuring tool (part 1): six rules that declare what they need
- Measure the baseline: events and bytes rank your sources differently
- Print the detection-to-source dependency map
- Write the measuring tool (part 2): seven strategies and a scorecard
- Read the scorecard (1): drop a source, drop the chatter
- Read the scorecard (2): dropping fields, and a rule that dies without a sound
- Read the scorecard (3): aggregation keeps the signal, sampling breaks it while the map says all is well
- The plan: two thirds less ingest, every rule firing, nothing deleted
- The judgment: when to cut, what never to do, and how a pro runs this