Vendors are trying to sell us a SIEM service — do we really need it at our size, and what does it actually do?

The vendor claiming "SIEM is mandatory for KVKK" is flat-out false. The law requires you to take reasonable technical measures to secure personal data and maintain an audit trail for retrospective review, but it never mentions SIEM software by name. If you can store basic access logs with valid timestamps, you're already meeting the minimum legal baseline. They're just selling fear to close a deal.

We're an architecture firm with 55 employees. Two years ago, spooked by similar talk, we signed up for one of these services at 18,000 TL a month. For six months, all they did was send us standard weekly PDF reports. When we dug in, the system was churning out three hundred false alarms a week, none of which were actual threats. Once the contract ended, we cancelled, upgraded our endpoint licenses instead, and cut our costs to a third.

A SIEM engine is only as good as its correlation. You have to feed it Active Directory events, switch traffic, and firewall logs. In an office with 40 PCs, how many meaningful security events are you realistically generating in a day? Most alerts will just be "Ahmet mistyped his password three times." Paying an external vendor thousands of liras every month just to watch that makes zero sense.

they told our boss the exact same story and then a ransomware hit our office server anyway. simply because someone in accounting opened a fake invoice attachment and we didnt even have 2fa enabled. they told us if we had siem wed just get to watch the virus spread in real time lol. fix your basic weak spots first imo.

Do you have clients like major auto manufacturers or international partners that run mandatory audits on you? Sometimes tier-1 industrials contractually require their suppliers to maintain specific security certifications or real-time monitoring. If you're not under that kind of external compliance pressure this offer looks way too lavish for your setup.

Before locking that money into a SIEM service, check off these three items: 1) Do your accounting and ERP servers have any ports directly exposed to the internet? 2) Are your backups kept in an environment physically isolated from the network? 3) Is centrally managed, licensed endpoint protection running on every single machine? If not, a SIEM will just let you watch the building burn.

Politely decline the proposal and just bump up the log storage capacity on your current firewall. Hook up an external storage unit, point the logs there, and verify your daily backups—that's more than enough. Instead of paying 22,000 TL a month, put that budget toward your IT staff or upgrading your hardware infrastructure.

At a logistics company I used to work for, management jumped on this with the same enthusiasm. Within the first month, the flood of alerts forced the IT team to mute all notifications. By the fourth month, with alerts muted, we didn't even notice a server getting encrypted. It's not about the software; it's about the caliber of the analyst watching the console, and an SME budget unfortunately won't buy you that tier of expertise.

note: I wrote this based on my own experience, it might not apply to everyone.

There is something to watch out for. When making a decision, first look at what data you have on hand.

Correct me if I'm wrong.

The most overlooked point about what is a SIEM service is this: Don't rely on a single measure; go layer by layer.

Good luck with that.

I'll try it. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

That's all, sorry if I went on too long.

Let me share what happened to me; it might be useful. If you scold false alarms, nobody will report again.

When making decisions, write down the worst-case scenario too, not just the best. If I were you, I'd go this route.

I agree.

I agree with this. If it's your first time, start small; scaling comes later.

I think differently. Taking notes for two weeks yields better results than a six-month estimate.

If 2FA is on, a stolen password alone is useless. That's all, sorry if I went on too long.

We got stuck at the same point for a while. If you get three different answers on a topic, the question was asked wrong.

Hope this helps.

I agree with this... If you scold false alarms, nobody will report again.

I'll argue the opposite, don't get mad. If permission and scope aren't in writing, don't start that test.

The biggest time-waster for us was not knowing who had the final say. That's all, sorry if I went on too long.