Decouple Retention From Detection: How Monad and Hydrolix Split the SIEM's Two Jobs

Ask a SOC team how long its firewall logs stay searchable and you rarely get a security answer. You get 7 days, or 30, or "whatever the license covers." Endpoint telemetry ages out in a week. Bot traffic gets a month. Anything older lives in cold storage, where a query means a ticket, a rehydration job, and an afternoon of waiting.

Michael Cucchi, Chief Product and Marketing Officer at Hydrolix, has a name for this: security by budget. By Hydrolix's estimate, most teams send roughly 30% of their data to the SIEM for real-time detection. The other 70% gets archived offline or dropped. The retention policy was never designed. It was invoiced.

I recently talked about this problem with Fed Rodriguez and Josh Robinson on Hydrolix's Hot Data podcast. This post is the written companion to that conversation: what Monad and Hydrolix do together, what we saw when we tested it on real firewall data, and how to run a pilot without touching your existing detection stack.

Your SIEM is doing two jobs at one price

A SIEM does two different things. It runs detections against recent, high-value data, and it serves as the long-term memory you go back to during an investigation. Those jobs have very different requirements. Detection needs low latency on a relatively small, curated slice of data. Retention needs cheap, full-fidelity storage that you can still query fast when an incident reaches back 4+ months.

Per-GB SIEM pricing charges detection rates for both. So teams do the rational thing and cut volume, which means cutting retention, which means the forensic record is missing data that anyone realizes that data is needed. Filtering upstream helps the bill. It doesn't help the analyst who needs the DNS logs you stopped keeping in March.

The fix is to stop asking one system to do both jobs. Detection stays in Splunk or your SIEM of choice. Retention moves somewhere built for it.

Two sides of the same coin

Monad is the security data pipeline that sits upstream of the SIEM, the data lake, and Hydrolix. It collects from 330+ sources, normalizes and deduplicates the data, enriches it with context, and routes it to 40+ output destinations. Every tool in a security stack speaks its own format, and without a pipeline in the middle, the cost of your destination ends up dictating your security posture. Monad's job is to let teams route data by its value instead of by what it costs to store.

Hydrolix sits to the right. It keeps full-fidelity data hot, compressed, and queryable for months instead of days, at a cost that makes keeping everything a reasonable decision rather than a luxury. Hydrolix cites 15 to 24 months of hot retention versus the 7 to 30 day windows most SIEMs end up with.

Put them together and the split looks like this. Monad sends the high-value signal your detections depend on to your SIEM. Monad sends a full-fidelity copy of everything to Hydrolix. Your analysts keep working in Splunk (or their SIEM of choice), and the SIEM stops being the only place your data lives.

Nobody has to rip anything out. The detection content your team spent years tuning stays where it is. The dashboards stay. What changes is where the long tail of your data lives and what it costs to keep it.

What it looked like on real data

Hydrolix and Monad tested this with RAD using Palo Alto firewall data, which is a good stress case: high volume, high value during investigations, and one of the first sources teams cut retention on because of what it costs to ingest.

Monad routed the firewall logs into Hydrolix. The team then queried that data through Hydrolix's Splunk connector, from inside Splunk, the way an analyst would during a real investigation. Broad correlation searches across the extended dataset came back in about 2 seconds at enterprise volume.

That number matters because it answers the objection every SOC lead raises about cheap storage: "Sure, it's cheaper, but can I actually use it?" Cold archives are cheap because you almost never query them. This was long-lookback data behaving like hot data, without moving a single detection out of Splunk.

How customers are actually routing data

The pattern we see most often is a move away from sending everything to one SIEM. It usually lands somewhere close to this:

The interesting part is how teams arrive there. Hydrolix almost always starts as a safety net. The team keeps its existing SIEM feed exactly as it was and duplicates data to Hydrolix "just in case." Then they run their first real investigation against it, find the answer in data they previously would have lost, and routing behavior changes. The safety net becomes a design choice. Sources that used to be trimmed for cost get routed in full, because the expensive destination is no longer the only one.

Large enterprises move through this slower. Change control, procurement, and detection engineering reviews all take time, and they should. But they get to the same place.

What happens when traffic spikes

A pipeline that splits data across destinations has to be boring under pressure. During an incident, log volume spikes precisely when you can least afford to lose events.

When a destination slows down or becomes unavailable, Monad buffers the data and continuously retries instead of dropping the data.  When ingestion surges or spikes beyond the capabilities of the destination, Monad gracefully handles the backpressure to prevent data loss without overwhelming the data destination.

On the Hydrolix side, throughput holds from 50 GB to multiple terabytes without query performance degrading. The two systems were built to absorb the kind of burst that tends to break homegrown pipelines at 3am.

The trade-offs worth planning for

This architecture isn't free of decisions, and it's worth being clear about them before you start.

You are running two copies of some data, which means two retention policies and two sets of access controls to govern. Somebody still has to decide what counts as high-value signal for the SIEM; a pipeline makes that decision cheap to change, but it doesn't make that decision for you. And detection rules that assumes all data lives in your SIEM may need review once some of it doesn't, particularly correlation searches that reach back past your new SIEM retention window.

None of these are reasons to wait. They're the checklist for a good pilot.

How to pilot Monad + Hydrolix alongside your SIEM

You can prove this out on one source in a few weeks without changing how your SOC works.

1. Pick one high-volume, high-value source. Firewall, EDR, DNS, or cloud audit logs are good candidates. Pick the one you've been trimming for cost.
2. Run the numbers first. Use Monad's storage cost analysis tool to compare what that source costs in Splunk today against Hydrolix for the retention window you actually want.
3. Route through Monad to Hydrolix, and leave your SIEM feed intact. Nothing about your current detections changes during the pilot.
4. Rerun last quarter's hardest investigation against both. Compare what each system could answer, how far back it could look, and how long it took.

Step four is the one that settles it. If the investigation that stalled because the data had aged out is answerable in Hydrolix in seconds, you have your business case.

Hear the full conversation

Fed Rodriguez and I go deeper on all of this on Hydrolix's Hot Data podcast, including why routing behavior changes after the first investigation and what enterprise teams do differently. Listen to the episode here.

If you want to run the pilot above on your own data, reach out at product@monad.com or schedule a demo and we'll help you pick the source and run the cost analysis.

‍