The Challenge
The growth in the number of new data sources and volume of data from existing sources can be overwhelming. Especially if you are on an ingestion or capacity-based license plan and you end up writing increasingly bigger checks to the SIEM and log monitoring vendors as your implementation grows. Most companies are putting in place “data austerity” measures to stay within budget, reducing the amount of data ingested and retaining it for a shorter time than optimal.
