Detection Gap After a Logging Budget Cut
A payments processor cut its SIEM ingestion budget by 40 percent after a cost review. To stay within budget, the security team dropped Windows process-creation logs, DNS query logs, and firewall deny logs, keeping authentication logs and endpoint alerts. Three months later, a red team exercise found it could move laterally for six days using remote service creation and DNS tunneling without triggering an alert. The SOC has 4 analysts covering 24/7 with a mean time to acknowledge of 45 minutes on authentication alerts but no playbook for lateral movement. The CISO is asked by the audit committee why the red team succeeded and whether the cuts caused it. Meanwhile, the endpoint tool generates 1,200 alerts per day, of which analysts close 1,150 as benign within seconds.
1. Analyze the root cause of the red team's success. Was the budget cut the cause?
Read the worked answer
The cut is a contributing cause, not the sole cause. Removing process-creation, DNS, and firewall deny logs eliminated the telemetry that detects remote service creation and DNS tunneling - precisely the techniques the red team used. That is a direct, foreseeable consequence.
But the exercise also exposed a detection engineering and triage problem. With 1,200 endpoint alerts daily and 1,150 closed in seconds, analysts are conditioned to dismiss alerts, which suppresses the attention needed for subtle lateral movement. And there is no lateral movement playbook, so even a correct alert would lack a response path.
The judgment point is that visibility cuts interact with analyst behavior. The audit committee should hear both: the cuts removed necessary data, and the SOC's alert economics made the remaining signals less effective.
2. Propose a defensible re-balancing of logging and detection investment within a constrained budget.
Read the worked answer
Prioritize by detection value per dollar, not by log volume. Reinstate the highest-yield sources first: process creation (with filtering to reduce volume) and DNS logs, since both map directly to the observed gap. Firewall deny logs can often be sampled or aggregated rather than fully ingested.
Reduce cost elsewhere: tune out low-value endpoint alerts at the source to cut the 1,200 daily alerts, which lowers both ingestion and analyst load; aggregate repetitive authentication events; retain full-fidelity data in cheaper cold storage with targeted queries.
Invest in two or three high-value detection rules tied to lateral movement techniques, with a written playbook and a defined escalation path. Track mean time to detect on red team scenarios as the success metric.
The judgment point is that logging strategy is a risk decision. The team should present the committee with an explicit statement of which techniques are now detectable and which are accepted as blind spots.
3. How should the CISO answer the audit committee's question about causation?
Read the worked answer
Answer directly and without defensiveness: the cuts removed telemetry required to detect the techniques used, so they materially contributed; they were not the only factor, because alert triage and the absence of a playbook also mattered.
Support the answer with evidence: a mapping of the red team's techniques to the log sources removed, the resulting detection coverage before and after, and the remediation plan with cost. Acknowledge the decision process - whether the risk of the cut was assessed and accepted at the time - and state what will change in future budget decisions, such as requiring a detection impact assessment before removing sources.
The judgment point is that governance bodies reward candor plus a control. Blaming the red team or the analysts would destroy credibility; a clear causal account with a funded fix restores it.