Our IT contractor wants to set up a SIEM system, what is it exactly and do we really need it?

Pitching a SIEM to an 18-person office is pure overkill—literal swatting a fly with a cannon. Unless you have dedicated, full-time security staff reading logs, a SIEM just becomes an overpriced hard-drive filler. The contractor is just looking to lock in a monthly recurring invoice for themselves; politely decline the proposal.

When I worked at a similar-sized import business, we fell for the exact same pitch. We paid 45,000 RUB a month for 6 months. Throughout that entire time, every single alert that popped up was a false positive, and no one ever read the reports anyway. By the seventh month, we canceled the contract and put that budget toward dedicated backup hardware instead.

A SIEM is utterly useless without finely tuned correlation rules. The firewall and Windows boxes in your office alone will generate hundreds of thousands of log lines a day. Just storing those logs requires massive amounts of disk space. What your contractor wants to roll out is probably nothing more than spinning up an open-source tool and leaving it on autopilot.

Selling a SIEM to an office with 18 PCs is certainly an impressive display of sales audacity. Don't be surprised if their next proposal includes 24/7 armed security guards and a fingerprint-activated turnstile at the front door.

mate definitely not worth it total waste of money. set up proper firewall rules enable 2fa for everyone and back up your data regularly, that's it. siem is for enterprise banks and large corps.

Check these off first before you even entertain the thought of a SIEM: 1) Is direct remote desktop (RDP) left wide open to the accounting server from outside? 2) Does every workstation have a licensed endpoint protection client installed? 3) Are you taking offline, air-gapped backups? If you don't have these three covered, a SIEM isn't going to save you from anything.

Unless there is a specific legal data-security mandate governing your operations in the customs and forwarding industry that strictly requires SIEM implementation, taking on such an expenditure is fundamentally at odds with sound operational efficiency for a company of your scale.

The general consensus is pretty clear: a SIEM is an unnecessary expense for an 18-person team. Instead of spending 160,000 RUB on setup and 55,000 RUB every month, rolling out two-factor authentication, solid endpoint protection, and reliable offline backups will provide far more realistic, practical security.

I have a question. like if it's your first time, start small; scaling comes later.

saved.

Let me summarize the topic, since several different answers were given. When making a decision, first look at what data you have on hand.

Just leaving this note, it might be useful.

I was thinking the same thing. Taking measures without an inventory leaves doors you haven't seen open.

Proven by experience.

I'll try it.

There are three things to check when doing this. If you get three different answers on a topic, the question was asked wrong.

Don't rely on a single measure; go layer by layer. This is my opinion, I'm not claiming it's absolute truth.

We got stuck at the same point for a while. When making decisions, write down the worst-case scenario too, not just the best.

If you post the result here, it will help others too.

I feel the same way. Processes without records never improve, because you don't know what to fix.

Any unwritten clause becomes a point of disagreement later, as both sides remember it differently. I'm also curious if anyone does it differently.

I don't think this advice fits everyone. If permission and scope aren't in writing, don't start that test.

Proven by experience.

I'm curious too.