We Love What’s Broken … Yes, This Of Course Means SIEM!

This blog summarizes key findings from CardinalOps’ State of SIEM 2024, noting that while organizations ingest data that could potentially cover 87% of MITRE ATT&CK, they actually detect less than 19%, and more than 18% of rules are broken due to misconfigurations, missing fields, and parsing errors. It attributes these shortcomings to tool sprawl, constant change, lack of one-size-fits-all detections, manual and error-prone processes, and skills shortages, and observes that 20–30% of alerts go uninvestigated—urging continuous identification and remediation of decayed SIEM rules.