XSIAM Ingestion Reduction Under a Renewal Deadline
Northwind Logistics runs a 24/7 SOC with 11 analysts. It has 9,000 Windows and macOS endpoints, 240 servers, and a Cortex XSIAM tenant that ingests endpoint telemetry, 4.2 TB per day of Palo Alto firewall traffic, AWS CloudTrail, and Okta logs. After go-live, the SOC receives 38,000 alerts per day; 71% come from three firewall signatures that fire on legitimate partner VPN traffic. Endpoint coverage is 63% because a legacy Windows Server 2012 group has no agent. XSIAM incidents often contain the same host from firewall and EDR as separate incidents. The CISO has a renewal condition: cut ingested volume by 30% without losing detection of lateral movement or credential abuse. The team has two weeks, one XQL-trained engineer, and cannot change firewall logging this quarter.
1. Which levers should the team pull first to meet the 30% ingestion reduction while preserving lateral-movement and credential-abuse detection? Explain the order and the evidence you would collect.
Read the worked answer
Start by measuring, not deleting. Use XQL to break down ingested bytes and alert counts by data source, signature, and destination, then compare each source with the detection use cases it supports. A defensible order:
- Close the endpoint gap first. The 37% uncovered endpoints are a detection hole, and EDR telemetry is usually higher value per byte than repeated firewall session logs. Deploy the agent to the legacy group before claiming coverage.
- Filter the partner VPN traffic at the broker or ingestion layer, not by disabling the signatures. Scope the filter to the three specific signatures plus known partner source ranges, and keep metadata or a sampled feed for retrospection.
- Remove redundant firewall records, such as duplicate session or repeated deny events, while preserving allow/deny metadata needed for lateral-movement queries.
- Keep Okta and CloudTrail for credential abuse; reduce noise only for known service accounts after validating their behavior. Evidence to collect: bytes per source per day, alerts per signature, alert-to-incident ratio, and detection tests for PsExec/WMI lateral movement and Kerberoasting or LSASS access. Present a before/after table so the CISO can see that volume fell without coverage falling.
2. The team proposes disabling the three noisy firewall signatures outright. What is the risk, and what alternative control would you require?
Read the worked answer
Disabling the signatures globally removes detection for malicious use of the same VPN path, including lateral movement from a compromised partner or a spoofed source. The partner traffic is legitimate most of the time, but the signature may be the only network control watching that path, especially with 37% of endpoints still uncovered. Require a scoped, time-bound exception instead: specific signature IDs, known partner source and destination ranges, and an owner. Keep metadata logging, alert on traffic that falls outside the exception, and review after 30 days. Validate with a controlled test that the exception does not suppress a simulated lateral-movement flow. If the product only allows a broad exception, compensate with an EDR BIOC for the same behavior and restrict the vendor binary by policy. The point is to narrow the blind spot, not to remove the control.
3. How would you use incident grouping and XQL to prove the reduction worked, and what metric would you present to the CISO?
Read the worked answer
Build a baseline for seven days before the change: total GB ingested by source, alerts by signature, incidents per host, and duplicate incident ratio for the same host across firewall and EDR. After the change, run the same XQL queries and compare. Use incident grouping to show that one host producing firewall and EDR signals now creates one incident instead of two. Run detection validation before and after with safe simulations for lateral movement (for example PsExec and WMI) and credential abuse (Kerberoasting and LSASS access). Present one scorecard: ingested GB/day down at least 30%, alerts/day down, duplicate-incident ratio down, and detection tests still passing at the same rate. If a test fails, the volume reduction is not acceptable. The CISO needs a coverage statement, not just a smaller bill.