Cisco’s Splunk deal and the case for owning your security logs outside the SIEM

The week

On September 21, 2023, Cisco announced an agreement to acquire Splunk, the security information and event management and observability company, in an all-cash deal valued at about $28 billion. Splunk was widely deployed in banks, health systems and government agencies as the place where security logs were collected, searched and correlated, and where many security operations centers wrote their detection rules. The deal was among the largest in security software. It came as other consolidation was under way, including Broadcom’s acquisition of VMware, announced in 2022, which would close that November. Cisco said Splunk would strengthen its security and observability portfolio. The transaction needed regulatory approvals and was expected to close in 2024.

An earlier article in this series, on Broadcom and VMware, argued that an acquisition announcement gives customers an option to price their exit. That applies to any platform. A security information and event management system has a particular kind of lock-in, which the Cisco and Splunk announcement made visible to every CISO who runs one. The license is the smallest part of it. A SIEM holds three things that are hard to move, and together they account for nearly the whole cost of leaving: the retained logs, the detection content, and the integrations that feed and act on it. Each can be taken out of the platform’s exclusive control, at a price, before the next change of owner.

The retained logs

Regulated organizations keep security logs because rules and contracts require it. Federal agencies work under OMB memorandum M-21-31 of 2021, which set log retention periods of 12 months in active storage and a further 18 months in cold storage for many log types. Merchants and processors under PCI DSS keep a year of audit logs with three months immediately available. Banks and health systems have their own examination expectations, investigation needs and litigation holds. When the only searchable copy of that history sits inside a SIEM’s proprietary indexes, the retention obligation quietly becomes a commitment to the vendor. Leaving means either paying two platforms during the overlap or re-ingesting years of data.

The architectural answer is to make the organization’s own storage the system of record. Raw logs land first in object storage the organization controls, in an open format, with retention and immutability set there. The SIEM then reads from that store, holding only the recent, hot data it needs for detection. Retention policy is enforced once, independently of the analytics vendor, and a legal hold applies to the store rather than to a product.

The trade-off is real. A separate store means another system to secure and pay for, and searching cold data may be slower than searching a fully indexed SIEM. For most regulated organizations, a modest storage bill buys the right to change analytics platforms without breaching a retention rule. It also lowers ingestion-based license costs, because only the data needed for live detection flows into the priced tier.

The detection content

Over years, a security team writes hundreds of correlation searches, alerts, dashboards and reports in the SIEM’s own query language. That content encodes the organization’s threat model and its regulatory reporting. It is also the main reason migrations take a year or more, because every rule has to be rewritten and re-tested against new data structures.

Detection engineering can be run like software. Rules can live in a version-controlled repository with a description of the behavior each one detects, the data sources it needs and the test events that should trigger it. Where practical, rules can be written first in a vendor-neutral format such as Sigma and translated into the platform’s language. A coverage map against a public framework such as MITRE ATT&CK shows which detections matter most. None of this removes migration work, but it turns an archaeological dig into a planned translation with tests.

The content also lives in people. In many security operations centers, two or three engineers understand why a rule was tuned the way it was, and a change of vendor often coincides with their departure. Documenting the reasoning behind each tuning decision, in the same repository as the rule, protects the organization against both risks at once. It also helps auditors and examiners, who increasingly ask how an alert threshold was chosen and who approved it.

The integrations

The third part is plumbing. Collectors and forwarders on servers, connectors to cloud services, parsers for each log type, automated response playbooks, and the case management records that document past investigations all tend to be built around one vendor. Case records deserve particular care, because they are the evidence of how incidents were handled, and regulators or plaintiffs may ask for them years later.

Three practical steps help. Standardize collection on agents or pipelines that can send data to more than one destination. Normalize data into a common schema before it reaches the SIEM. Export closed case records on a schedule into the organization’s own document store. Contracts can support the architecture: a right to export all stored data and content in a usable format at any time, at no more than cost; notice of any change of control; and preservation of existing license types and price protections for a defined period after one.

A CISO can test readiness with one exercise. Pick a single high-value detection and trace it end to end: where its data is stored, in what format, how long it is kept, how the rule would be rewritten, and what playbook it triggers. If any step depends on knowledge held only inside one product, that is where an acquisition will cost the most.

With hindsight

Cisco completed the Splunk acquisition in March 2024. SIEM consolidation continued that year: Palo Alto Networks agreed to acquire IBM’s QRadar SaaS assets, and Exabeam and LogRhythm merged, leaving many customers facing migrations they had not planned. QRadar customers in particular had to decide where their retained data and rules would go. Broadcom’s ownership of VMware, with its move to subscription bundles and reported price increases, kept change-of-control risk on board agendas. The architectural shift held up. Separating security data storage from analytics, often described as a security data lake or data pipeline layer, spread among larger organizations through 2024 and 2025. Pipeline products that route logs to several destinations grew as a category. Organizations that had already done so faced the 2024 changes as a choice of analytics tool rather than a data migration.