SIEM cost reduction
Reduce SIEM ingestion costs on the Windows host, before the bill starts.
Drop, collapse and cap noisy Windows events where they are written, so the reduction lands on your SIEM licence rather than on a processing invoice. Every event removed is counted and attributed to the rule that removed it.
- Filter at the channel
- Keep or drop rules
- Aggregation
- Field trimming
- Rate limiting
In short
The cheapest way to reduce SIEM ingestion costs is to stop sending events nobody searches. DPLens filters, aggregates and rate-limits Windows events on the host that produced them, so there is no separate processing tier to pay for and the saving shows up directly in ingest. Nothing is dropped silently: the console shows what each rule removed and what that is worth at your cost per gigabyte.
Why the edge
Why reduce SIEM ingest on the host?
Most SIEM bills grow with what you send them, whether the meter is gigabytes, events or compute. Reducing after ingestion saves search time but not the ingest itself; reducing in a separate processing layer can, but that layer has its own servers and often its own bill. DPLens is a UK-built, self-hosted log collection and security data pipeline agent for Windows that does the work where the event is written.
01
No extra tier
The agent that collects the event decides whether it leaves the machine. There is no processing cluster to build or license between your hosts and your SIEM.
02
No per-GB cost
DPLens is licensed per agent and per network source (each syslog or NetFlow receiver). Filtering more never costs more.
03
Cheaper downstream too
Events you drop never cross your network, fill a disk cache or take up storage and indexing in your SIEM.
Doing the work on the host only pays if the agent is light. Both figures are from our lab benchmark: lab figures, not a guarantee, since real throughput depends on hardware, sources and pipeline rules.
Techniques
Five ways to send less, from cheapest to bluntest
Each technique further down the list is a broader instrument than the one above it, so start at the top and work down.
| Technique | How | Good for |
|---|---|---|
| Filter at the source | Choose events by severity, Event ID, provider or query on the channel itself. | A whole Event ID or provider you never use: it is never collected. |
| Keep or drop by content | Rules on any field, with equals, contains, pattern, list, address-range and numeric tests, combined however you need. | Dropping one noisy account, process, path or address range within an Event ID. |
| Collapse repeats | Group repeats by the fields you choose over a time window, keeping one representative event. | Bursts of the same event: repeated logon failures, connection storms. One event carries the count. |
| Remove placeholder values | The Optimise stage drops fields whose value carries no meaning: a dash, N/A, null or an empty field. | Windows Security events, which carry many placeholder fields on every event. Leaner events, and the bytes saved are shown on the pipeline. |
| Trim fields | Remove fields no search uses, or keep only the fields you map. | Large events whose extra fields no search uses. |
| Cap the rate | Cap events or bytes per second, with an allowance for bursts. | Protecting a licence or an indexer from one machine that has started shouting. A guard rail for the unexpected. |
Smaller levers help too. By default DPLens sends each event's structured data without the long human-readable message text, which saves bytes on every event; add the text only where your receiver needs it. The Optimise stage removes fields whose value is only a placeholder, such as a dash or 0x0 in a Windows security event, once you tick the values you want gone. Because the stages run in a fixed order (filter, parse, aggregate, optimise, enrich, mask, rate limit), later stages spend their effort only on events you keep. DPLens Manager rolls the same rules out to every host in scope, so a saving proven on one server applies across the estate.
Windows examples
How do I filter noisy Windows events without blinding the SOC?
The Event IDs that dominate volume are often the ones attackers also touch. Dropping a whole ID is the easy saving and the risky one. Drop the noisy part instead, and keep what your detections read.
| Event ID | What it records | Safer reduction | What you lose if you drop it all |
|---|---|---|---|
| 4662 | An operation was performed on an Active Directory object. Driven by Directory Service Access auditing and object SACLs; heavy on domain controllers. | Keep events whose Properties carry the directory replication rights GUIDs and any objects you alert on; drop the rest in the pipeline. | DCSync detection and the access trail for sensitive directory objects. |
| 4663 | An attempt was made to access an object: a file, registry key or kernel object with an auditing SACL. | Narrow the SACLs in Windows first. Then drop known bulk readers (backup, antivirus, indexing) by ProcessName, and keep sensitive paths by ObjectName. | Evidence of data access for exfiltration and ransomware investigations, and any file-access audit you rely on. |
| 5156 | The Windows Filtering Platform permitted a connection. | Drop loopback traffic with a CIDR test; aggregate the rest by application, destination address and port over a short window. | Per-process connection history for beaconing and lateral movement, unless Sysmon Event ID 3 or your EDR already covers it. |
| 5158 | The Windows Filtering Platform permitted a bind to a local port. | Often a candidate for exclusion at the source as a whole ID, once you have checked no detection uses it. | Which process opened which local port: useful when hunting for unexpected listeners. |
| 4688 | A new process was created, with its command line if that policy is on. | Do not drop it wholesale. Drop specific, verified-benign process and parent pairs, such as a monitoring tool polling. If Sysmon Event ID 1 already covers process creation for you, decide which one you pay for. | The backbone of most endpoint detection content. |
For example, a pipeline rule for Event ID 4662 can drop it unless it carries one of the three directory replication rights (DS-Replication-Get-Changes, -Get-Changes-All and -Get-Changes-In-Filtered-Set), the rights a DCSync request uses. Check the result on Live stream before you rely on a rule, and extend the keep list with any other objects your detections watch. The guide to noisy Windows Security Event IDs goes through each ID in more depth.
Savings calculator
How much could I save?
The starting values (800 GB/day collected, 55% reduced at the edge, £180 per GB/day per year) are illustrative assumptions, not results from any customer. Replace all three with your own figures.
What edge processing takes off the bill
Filtering, aggregation and routing happen before delivery, so reduction lands on your licence, not on a processing invoice. Move the sliders to your own figures: the defaults are illustrative assumptions, not a quote.
Finding your rate
The calculator's rate is the annual SIEM cost per GB/day of ingest: your annual licence or ingest cost ÷ your average GB/day. Include storage and infrastructure you size by volume in the annual cost. If you are billed per event or per unit of compute, convert using your average event size and treat the result as an estimate. For the reduction percentage, measure rather than guess: run DPLens on a representative machine and read In / Out on the Pipeline page.
The console's own Ingest cost setting uses a different unit, the cost of a single gigabyte: divide the calculator's rate by 365 to get it. Overview and Pipeline then show what the reduction is worth. The savings calculator page explains the method and caveats.
Accountability
Can I prove what was dropped?
Yes. A saving you cannot explain is a gap you cannot defend, so DPLens drops nothing silently: every drop, mask, aggregation, failover and policy change increments a counter, attributed to the rule that caused it.
Stage ribbon and funnel
Each stage shows events in and out, measured rather than estimated. The Overview funnel runs from Collected through the pipeline stages to Delivered, with estimated GB a day out and the reduction in pounds once you set a cost.
Losses and Live stream
Losses from other causes, such as a full cache under a drop policy, are broken down with counts. On Live stream, a chip shows how many events a filter, aggregation or rate limit removed before the chosen destination.
Secure by design
An agent you can defend in a security review.
FAQ
Questions buyers ask
Will filtering break my detections?
It can, if you drop what a detection reads. List the Event IDs and fields your detection content uses before you write a rule, prefer dropping the noisy part of an Event ID over the whole ID, and run DPLens alongside your current agent while you compare results.
How much can I expect to save?
It depends on your sources, your audit policy and what your detections need, so measure it: run DPLens on a representative machine, read In / Out on the Pipeline page, and put that percentage and your own cost per GB into the calculator.
Does DPLens charge per gigabyte?
No. It is licensed per agent and per network source (each enabled syslog or NetFlow receiver), with no per-GB ingestion cost. See the licensing model.
Can I send the reduced stream to an OpenTelemetry Collector?
Yes. DPLens can deliver over OTLP/HTTP (protobuf, conventionally port 4318) to an OpenTelemetry Collector or any OTLP endpoint, alongside or instead of your SIEM. See the OpenTelemetry integration.
How does this compare with reducing in Splunk Edge Processor?
Both aim to send less to the indexer; the difference is where the work runs. See our Splunk Edge Processor comparison.
Related
Where to go next
Windows Event Log collection
Channels, filtering at the source, and collection that resumes where it left off.
Read more →Splunk Universal Forwarder replacement
Cooked S2S and HEC, with reduction before the indexer.
Read more →SIEM integrations
Splunk natively, any SIEM that accepts syslog or JSON, or an OpenTelemetry Collector.
Read more →See it on your own logs
Try DPLens on one Windows server before you talk to anyone.
Book a demo, or request an evaluation licence and install it on a test host. The documentation covers everything from requirements to Group Policy rollout.