A regional bank stops rationing which log sources it can afford

Sector

Regional retail banking

Estate

Hybrid cloud, several thousand endpoints

Analytics platform

Cloud SIEM, priced per ingested volume

Component

CyberAIX Pipeline, CyberAIX Relay

Starting point

The bank's daily ingestion had reached its contracted ceiling. Two new sources, a cloud workload protection platform and a set of application audit logs, were waiting to be onboarded, and both were considered important. Onboarding them meant removing something else. Each quarter became a negotiation about which telemetry was least harmful to lose.

Analysts also suspected that much of the daily volume was operational noise: permit logs from firewalls on trusted internal segments, verbose output from a middleware layer, and duplicates caused by two overlapping forwarders.

What was done

Two weeks of observation. CyberAIX Pipeline was placed in front of the SIEM as a transparent pass-through. During this period it profiled every source: event types, field frequency, and which fields were actually read by the bank's live detection rules.

Reduction in stages. Using the profile, the team enabled CyberAIX Relay policies one at a time: deduplication across the overlapping forwarders first, then drop rules for permit events on internal segments, then trimming of debug payload fields that no rule referenced. Every policy was previewed against live traffic with a report showing which detections, if any, read the affected fields.

Nothing discarded. Events removed from the SIEM path were routed to compressed object storage, satisfying retention requirements and remaining reachable through CyberAIX Federated Search.

Result

• SIEM ingestion fell substantially within the first month, with no live detection losing access to a field it read.
• Both waiting sources were onboarded within the existing budget.
• Complete telemetry remained available for investigations and audits from low-cost storage.
• Two vendor schema changes in the following quarter were flagged by drift monitoring before they affected any rule.

What the team pointed to

The preview. Seeing exactly which rules touched a field before turning off that field turned a nerve-wracking change into a routine one.