Data Cost Optimization
Ingest the signal. Skip the noise.
Not every log row is worth storing at full fidelity. ManySignal's cost optimization layer lets you route high-volume, low-value event streams to aggregated summaries, apply field-level dropping before storage, and configure per-source sampling rates — all while preserving full fidelity for sources that matter to detection.
60–80%
typical storage reduction
Zero
detection coverage lost
Per-source
granularity of controls
YAML
policy as code
Four levers for cost control
Source-level sampling
For sources where detection requires frequency analysis but not per-row detail (e.g., VPC flow logs), sample at 10% for storage while maintaining full aggregated counters for behavioral baselines.
Field dropping
Strip fields that are not referenced by any active detection rule or agent question. A dropped field is removed before the event is written to storage — it never exists in the store, so you cannot accidentally query it.
Aggregation paths
Route high-cardinality, low-value streams (DNS query logs, CDN access logs) to a pre-aggregation step that collapses identical events into counted rows. Detection runs on the aggregated view; storage holds summaries, not individual rows.
Tiered routing
Route specific sources directly to the warm or cold tier at ingest, bypassing hot-tier indexing. Useful for compliance-required sources that are never queried interactively but must be retained.
Cost changes are validated against detection coverage
Before any cost optimization policy is applied, the platform runs an impact analysis: which active detection rules reference fields that would be dropped? Which rules require full-fidelity events from a source you want to sample? You see the coverage impact before committing the change.
Fields safe to drop
No active detection rule or agent question references these fields on this source
Fields at risk
At least one active rule references this field — dropping it would disable that rule's condition
Sampling impact
Threshold-based rules on this source would require threshold adjustment at the proposed sampling rate
Cost optimization without coverage blind spots
Rule-aware field analysis
The cost optimizer knows which fields every active detection rule references. It will not suggest dropping a field that a rule depends on without surfacing the impact.
Per-source cost dashboard
See daily event volume, storage consumption, and AI inference cost broken down by source. Identify your top-5 cost drivers in under 30 seconds.
Aggregation templates for common sources
Shipped aggregation templates for VPC flow logs, CDN access logs, and DNS query logs reduce storage 80–95% on these high-volume sources with no detection coverage loss.
Retroactive field dropping
Apply a field-drop policy retroactively to the warm tier during a maintenance window. Useful for dropping fields that were initially retained but turned out to be unused.
Cost forecasting
The cost forecast tool projects 30-, 90-, and 365-day storage and compute costs based on current event volume growth rate and proposed policy changes.
MSSP pass-through billing
Per-tenant cost metrics are available to MSSPs for pass-through billing. Storage, compute, and AI inference costs are metered with daily granularity per tenant.
Cost Optimization — FAQ
If I sample VPC flow logs at 10%, will behavioral baselines still work?
Yes, with an adjustment. The baseline worker uses the aggregated flow counters (which are computed on 100% of events before sampling) rather than the sampled per-row events. Behavioral scoring accuracy is not materially affected by sampling of the raw row store.
Can I apply cost optimization policies without a restart?
Yes. Policy changes take effect within 2 minutes of deploy for new events. Retroactive application to existing warm or cold data requires a background migration job that runs without impacting query performance.
What happens to a detection rule when a field it references is dropped by a new policy?
The rule is flagged in the detection dashboard with a 'field missing' warning. The rule continues to evaluate but the condition referencing the missing field evaluates to false by default. You are notified at policy deploy time before the change takes effect.
Is there a minimum retention requirement for the hot tier?
The minimum hot-tier retention is 14 days. Detection rules that use temporal sequence evaluation across multi-day windows require sufficient hot-tier depth to catch all stages of a sequence.
How does ManySignal's cost model compare to a per-GB SIEM at enterprise scale?
A mid-size enterprise ingesting 300 GB/day at $3/GB/month in a SIEM pays $900K per year in ingestion costs alone. ManySignal's asset-based model does not charge for log volume — the same environment costs a fraction of that, with agentic triage included. The cost optimizer shows your projected savings in the first session.
Which source types typically yield the largest cost reduction?
VPC flow logs, WAF logs, and DNS query logs are the three highest-volume, lowest-marginal-value sources in most environments. Sampling flow logs to 1% for behavioral baseline computation (with full counts preserved) and routing WAF logs to warm tier on day 1 typically reduces effective storage cost by 40–60% with no detection coverage impact.
How do we ensure cost optimization doesn't create compliance gaps?
The cost optimizer validates all proposed policies against your active compliance framework mappings. Any policy that would remove a source required by a mapped control is flagged as a compliance risk before you can apply it. Compliance-required sources are pinned to full fidelity retention automatically.
Can we set per-source cost budgets and alerts?
Yes. The cost dashboard shows estimated monthly cost per source based on current event rate. Budget alerts fire via Slack or email when a source's projected monthly cost exceeds a configurable threshold — useful for catching misconfigured verbose logging before the bill arrives.
Does the cold tier support the same query language as hot tier?
Yes. Cold-tier queries use the same natural-language search and API query interface as hot and warm tiers. The only difference is latency — cold queries are asynchronous and results stream back as they complete. Detection rules do not evaluate against cold-tier data.
Cut your log bill without cutting your coverage
The cost optimizer identifies your highest-value reduction opportunities in the first session.