Some SIEM business models are heavily dependent on the volume of data ingested.
This could create a problem:
The more logs a company collects, the higher the cost.
Therefore, a smart strategy needs to be built.
The goal is not:
“Send everything.”
But rather: “Collect what is necessary to achieve our security, compliance and investigation objectives.”