I’m skeptical of how much architectural novelty gets attached to those labels.
Yes, we have new ways of running SIEM. But each implementation comes with tradeoffs, and it doesn’t automatically mean you will get better results. It highly depends on the environment where you run it.
Hot, warm, and cold storage? We’ve had those for years. Separating collection, storage, search, detection, and response? Also familiar concepts. And we don’t need MCP to run SIEM queries.
What is changing is where vendors put these capabilities, how they package them, and who takes responsibility for making everything work together.
You can bring more capabilities into one platform. You can decouple pipelines, storage, detection, and response. You can combine both approaches.
I think the debate in many cases is: do you want real time SIEM, or do you settle for near real time? Measure that against your actual use cases. Neither an integrated platform nor a distributed architecture guarantees the answer.
An integrated platform can simplify operations while increasing dependence on one vendor. A decoupled stack can give you more control while leaving your team responsible for integrations, schemas, permissions, and troubleshooting. Decoupling can reduce vendor lock-in, but it doesn’t magically remove it.
AI adds more queries, more tool access, and potentially more response actions. That matters for architecture and operations. It doesn’t make the underlying storage and detection concepts new.
Today, you can buy a data pipeline with SIEM capabilities. A data lake with SIEM capabilities. A SIEM bundled with EDR, NDR, SOAR, and AI SOC capabilities. Even an AI SOC platform with SIEM capabilities.
SIEM has always been an architecture problem. The packaging keeps changing.
Also we are having interesting discussion next week Machine speed vs. Machine focus
Register Here
Have a siemless weekend ahead!
Read the original post and the comments
Do you have any good write-ups on use cases? It seems like everything I see about SIEMs is SOC-focused, but [bear with me] *back in my day*, detecting attacks was just one use case.