Building a High-Capability SIEM on a Minimized Budget

In India’s enterprise banking sector, digital transformation—enabled by technologies such as UPI, API banking, microservices, and hybrid cloud infrastructure—has advanced rapidly alongside an increasingly sophisticated threat landscape. For Indian banks, a Security Information and Event Management (SIEM) platform is no longer simply a security solution; it has become a critical operational foundation for effective governance, fraud prevention, risk management, and regulatory compliance.

1. Why SIEM Is Essential for India’s Enterprise Banking Sector

   Stringent Regulatory and Compliance Requirements

   Indian financial institutions operate within a highly regulated environment and are subject to rigorous cybersecurity, data protection, and incident-response requirements:

   • RBI Cybersecurity Framework & 2026 Master Directions: The Reserve Bank of India (RBI) requires financial institutions to maintain continuous 24×7 security monitoring through a Security Operations Center (SOC) supported by SIEM capabilities. Regulatory requirements also prescribe strict incident-reporting timelines, including the reporting of critical incidents through DAKSH/RBI-CERT within 6 hours of detection.

   • CERT-In Directions: The Indian Computer Emergency Response Team (CERT-In) requires organizations to maintain synchronized system logs using a reliable Network Time Protocol (NTP) source and retain relevant logs for a minimum of 180 days, enabling effective monitoring, forensic analysis, and incident investigation.

   • DPDP Act (Digital Personal Data Protection Act): The Act introduces significant financial penalties for breaches involving the personal data of Indian citizens. This makes proactive threat detection, continuous monitoring, and timely incident response essential for protecting sensitive personal and financial information.

   Mitigation of India-Specific Banking Threats

   • UPI & Digital Payment Fraud: Real-time correlation helps identify account takeover (ATO) attempts, credential stuffing, and high-velocity mule account creations across mobile applications and UPI payment gateways.

   • Insider Threats: Tracks high-risk, privileged activities across core banking systems (CBS) like Infosys Finacle, TCS BaNCS, or Oracle FLEXCUBE.

   • SWIFT & Payment Gateway Abuse: Isolates unauthorized access or abnormal wire transfers in payment networks before settlement execution.

2. Building a High-Performance SIEM Within a Cost-Optimized Budget

   Enterprise SIEM solutions, typically licensed based on Gigabytes per Day (GB/day) or Events per Second (EPS), can become prohibitively expensive for Indian banks generating terabytes of log data each day. A cost-efficient approach that preserves robust security capabilities can be achieved through a hybrid open-source architecture, complemented by intelligent data tiering and automation to optimize storage, processing, and operational costs.

A. Intelligent Log Ingestion and Noise Filtering — Reduce Licensing Costs by 60– 80%

Not every log event requires real-time SIEM correlation. Feeding high-volume,

low-value debug and routine operational logs into a paid ingestion pipeline can significantly increase licensing and infrastructure costs.

• Deploy Open-Source Log Collectors: Use platforms such as Fluent Bit or Logstash at the network edge to filter redundant or low-value events—such as routine firewall keep-alives, system health checks, and repetitive status messages—before they reach the SIEM.

• Prioritize Data Based on Risk:

  • Hot Tier — Real-Time SIEM: Forward high-value security events, including authentication failures, privilege escalation attempts, API anomalies, CBS administrative activities, and firewall-denied connections, to the active threat-detection engine for immediate analysis and correlation.

  • Cold Tier — Cost-Effective Log Lake: Route lower-risk and high-volume logs directly to economical object storage, such as MinIO or Amazon S3 Glacier, to support long-term retention requirements while minimizing SIEM storage and ingestion costs.

B. Leverage Open-Source and Next-Generation Core Platforms

Rather than relying exclusively on traditional SIEM products with high per-GB licensing costs, organizations can adopt mature open-source platforms capable of scaling horizontally with growing workloads.

• Wazuh / OpenSearch: Use an enterprise-capable, open-source security stack that supports capabilities such as file integrity monitoring (FIM), vulnerability detection, threat monitoring, and compliance reporting, reducing dependence on costly proprietary SIEM features.

• Sigma Rules: Adopt community-driven Sigma detection rules to create portable and standardized threat-detection logic across diverse log sources, reducing reliance on vendor-specific detection frameworks and proprietary threat-intelligence content.

C. Reduce SOC Staffing Costs Through Open-Source SOAR Automation

Maintaining Tier-1 SOC analyst coverage around the clock can represent a significant operational expense. Automation can reduce the volume of repetitive manual tasks and allow analysts to focus on higher-value investigations.

• Automated Incident Response: Integrate open-source SOAR and workflow platforms such as Shuffle or n8n with TheHive for incident management. Automated playbooks can perform predefined response actions—including isolating compromised endpoints, blocking malicious IP addresses at perimeter firewalls, or disabling compromised Active Directory credentials—when specific security alerts are triggered.

3. Cost Optimization Matrix for Indian Banks

Architecture Component	Traditional Enterprise Model	Cost-Optimized, High-Capability Model	Estimated Cost Reduction
Log Ingestion & Indexing	Commercial SIEM platforms with per-GB or EPS-based licensing	OpenSearch / Wazuh combined with edge-based log filtering using Logstash / Fluent Bit	60–70%
180-Day Data Storage	High-cost primary SIEM storage and dedicated disk infrastructure	Hot/Cold data tiering using S3-compatible local storage such as MinIO, supplemented by compressed cloud storage	Up to 80%
Threat Detection Rules	Proprietary, vendor-supplied detection rule packages	Open-source Sigma rules mapped to MITRE ATT&CK and relevant RBI security frameworks	100% license-cost savings
24×7 SOC Operations	Fully staffed in-house SOC covering Tier-1 through Tier-3 operations	Co-managed SOC model combining an internal core team with a hybrid Managed Security Service Provider (MSSP)	40–50%

4. Implementation and Execution Roadmap

Classify Critical Assets and Log Sources: Identify and prioritize mission-critical systems—including Core Banking Systems (CBS), payment switches, Active Directory, and firewalls—and distinguish them from lower-priority or secondary infrastructure.

• Deploy Edge-Based Log Filtering: Implement local log collection and forwarding nodes to filter redundant, low-value events at the source, ensuring that only relevant security telemetry is transmitted to the central indexing and correlation platform.

• Implement Hot/Cold Data Retention: Maintain approximately 30 days of high-value logs within the active SIEM environment for real-time investigation and correlation, while automatically archiving older data for up to 180 days or beyond in compressed, cost-efficient storage.

• Automate Six-Hour Incident Reporting: Configure predefined SOAR playbooks to automatically collect incident details, generate standardized summaries, and initiate reporting workflows, helping the organization meet applicable RBI and CERT-In incident-reporting timelines with minimal manual intervention.