Every SIEM implementation faces the same early question: which logs do we onboard first? Get it wrong and you burn your license on noise while the sources that would actually catch an attacker stay dark.
After years of implementing SIEM platforms for different environments, my answer is consistent: prioritize by detection value, not by how easy the source is to collect.
A practical priority order
| Priority | Source | Why it matters |
|---|---|---|
| 1 | Authentication (AD, VPN, cloud identity) | Nearly every intrusion touches identity |
| 2 | Endpoint (EDR, Sysmon, process creation) | Where execution actually happens |
| 3 | Perimeter (firewall, proxy, DNS) | Command-and-control and exfiltration visibility |
| 4 | Email security | Still the most common initial access vector |
| 5 | Server & application logs | Context and scoping during investigations |
| 6 | Everything else | Onboard when a use case demands it |
Match every source to a use case
A log source without a detection use case is just storage cost. Before onboarding anything, write down the question it answers:
- Domain controller security logs → “Is someone brute-forcing or spraying accounts?” (Event IDs 4625, 4740, 4768–4776)
- DNS logs → “Is a host resolving algorithmically generated domains?”
- Proxy logs → “Did anyone reach a known-bad URL after that phishing wave?”
If you can’t name the question, defer the source.
Watch the ingestion economics
Most SIEM licensing punishes indiscriminate collection. Debug-level application logs and verbose network device messages can consume more quota than every security-relevant source combined. Filter at the collector, not in the analyst’s face.
Frequently asked
Should I onboard everything and filter later? No. “Later” rarely comes, and by then the budget conversation has already soured. Start narrow with high-value sources, prove detection value, expand deliberately.
What about compliance-driven sources? Collect them, but be honest that they serve audit, not detection. Route them to cheaper storage tiers where the platform allows it.
This article was originally published on Medium.