Big SIEM Energy at micro-SIEM cost

The speaker, a security architect at a cloud-native startup, explains why a full commercial SIEM or a self-hosted stack was a poor fit for a small team with a tight budget. Managed SIEMs often price by data volume or event count and ship with broad rule sets that create noise in environments they were not built for. The alternative presented is to start from a threat model, identify the few events that matter most, and write narrow detections for them.

The main example is an alert that fires when the AWS root account signs in. CloudTrail management events supply the data, and an EventBridge rule matches successful sign-ins from a default AWS service, which avoids per-event evaluation charges. The rule publishes to an SNS topic that AWS Chatbot forwards to Slack. The stack is defined in Terraform, and Chatbot is restricted with deny-all guardrails so it only delivers messages and cannot run commands from the channel. In a live demo, the infrastructure was deployed and an alert appeared in Slack roughly fifteen seconds after a root login. Questions covered chaining rules to create thresholds, using a custom event bus for cross-region delivery because sign-in events route through one region, and running simple Lambda remediation.

The takeaway is that this approach trades breadth for control and low cost. It suits teams with a well-understood threat model and a small number of critical detections, and maintenance grows quickly as rule counts rise, which is the point where a fuller product becomes worth considering. Because many vendors read events from S3, migrating later is described as feasible.