Every system writes logs, and an attack leaves traces across several of them: a login from a new country in the identity provider, a new process on an endpoint, an outbound connection in the firewall, a permission change in the cloud console. No single log shows the attack. A SIEM puts them in one place, normalises the fields so a username means the same thing in each, and runs rules that fire when a combination appears: the new-country login followed within minutes by a permission change is a detection; either alone is noise. Retention lets an analyst ask, months later, what else that account did, which is the question every investigation eventually reaches.
- Identity provider logs: who signed in, from where, with what factor. The single most valuable source and the cheapest.
- Endpoint telemetry: processes, network connections and file changes on each device. High volume, high value.
- Firewall and proxy logs: who talked to whom, especially outbound. Where command-and-control traffic shows.
- Cloud control plane: every configuration change in the cloud account, which is where modern attackers do their damage.
- Application and database logs: valuable for specific detections and expensive in bulk; add per detection, not wholesale.
The cost model shapes the security model
Most SIEMs charge by volume ingested or by events per second, so every source is a budget decision and teams routinely leave out the expensive ones, which are often the endpoints and the applications. The consequence is a system that knows a login happened and not what the user did afterwards. Decide what you need to detect, then ingest what those detections require, then argue about the bill. Ingesting everything and writing detections later produces the bill without the detections.
The analyst certifications live here. Microsoft's operations exam is built around its own SIEM and the query language that interrogates it; the vendor-neutral analyst paper tests reading correlated events and deciding which alert matters. Both assume the same skill: taking a query, saying what it would return, and noticing what it would miss. That is also the skill that separates a SIEM that finds things from one that stores them.