--- title: Escaping the SIEM Cost Trap: A Data-First Architecture... description: SOFTSWISS shares how they replaced a traditional SIEM with a data-first security analytics architecture built on ClickHouse, open-source collection (Vector),... canonical: https://daily.dev/posts/escaping-the-siem-cost-trap-a-data-first-architecture-for-security-analytics-u22175hat twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Escaping the SIEM Cost Trap: A Data-First Architecture for Security Analytics | daily.dev og:description: SOFTSWISS shares how they replaced a traditional SIEM with a data-first security analytics architecture built on ClickHouse, open-source collection (Vector),... og:url: https://daily.dev/posts/escaping-the-siem-cost-trap-a-data-first-architecture-for-security-analytics-u22175hat og:image: https://api.daily.dev/og/posts/u22175hat.png og:image:alt: Escaping the SIEM Cost Trap: A Data-First Architecture for Security Analytics og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Escaping the SIEM Cost Trap: A Data-First Architecture for Security Analytics **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 14 min read · 0 upvotes · 0 comments ## Summary SOFTSWISS shares how they replaced a traditional SIEM with a data-first security analytics architecture built on ClickHouse, open-source collection (Vector), Kafka, tiered storage (SSD/HDD/S3), and detection-as-code using Sigma and SQL. The platform handles over 700,000 events per second, retains 100TB+ of security data, and delivers $300K/year in cost savings versus vendor-heavy approaches. Key design principles include enriching data on ingestion via materialized views, managing all schemas and detection logic as code, and enabling analysts to pivot from token search to analytical correlation within a single dataset. The post also honestly addresses trade-offs: SQL literacy requirements, database operational complexity, governance challenges at scale, and the need to design analyst UX on top of the raw data layer. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Why CISOs Are Building Open Security Lakes with Iceberg](https://daily.dev/posts/why-cisos-are-building-open-security-lakes-with-iceberg-kawnuzoou) · Confluent Blog · 0 upvotes · 0 comments - [How iFood built its agentic security platform on ClickHouse Cloud](https://daily.dev/posts/how-ifood-built-its-agentic-security-platform-on-clickhouse-cloud-0yktjc5xt) · ClickHouse · 0 upvotes · 0 comments - [Security’s Next Control Plane: The Rise of Pipeline-First Architecture](https://daily.dev/posts/security-s-next-control-plane-the-rise-of-pipeline-first-architecture-jvqwbmzxi) · Security Boulevard · 0 upvotes · 0 comments - [Databricks pitches Lakewatch as a cheaper SIEM — but is it really?](https://daily.dev/posts/databricks-pitches-lakewatch-as-a-cheaper-siem-but-is-it-really--wxes2qppc) · InfoWorld · 1 upvotes · 0 comments - [Intelligent security at ClickHouse speed: How Cogent Security built an AI-native vulnerability management platform](https://daily.dev/posts/intelligent-security-at-clickhouse-speed-how-cogent-security-built-an-ai-native-vulnerability-manag-obfsc8odp) · ClickHouse · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#clickhouse](https://daily.dev/tags/clickhouse), [#data-lake](https://daily.dev/tags/data-lake) [View this post on daily.dev](https://daily.dev/posts/escaping-the-siem-cost-trap-a-data-first-architecture-for-security-analytics-u22175hat) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Escaping the SIEM Cost Trap: A Data-First Architecture for Security Analytics","url":"https://daily.dev/posts/escaping-the-siem-cost-trap-a-data-first-architecture-for-security-analytics-u22175hat","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/escaping-the-siem-cost-trap-a-data-first-architecture-for-security-analytics-u22175hat"},"datePublished":"2026-07-10T11:29:50.605Z","dateModified":"2026-07-10T11:30:15.546Z","description":"SOFTSWISS shares how they replaced a traditional SIEM with a data-first security analytics architecture built on ClickHouse, open-source collection (Vector),...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/39dee248e4684d76cf041edca973e3c0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/39dee248e4684d76cf041edca973e3c0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/escaping-the-siem-cost-trap-a-data-first-architecture-for-security-analytics-u22175hat","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,clickhouse,data-lake","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"Escaping the SIEM Cost Trap: A Data-First Architecture for Security Analytics"}]} ```