Hi everyone, I’m just starting to explore SIEM options for a small AWS project. I’ve been reading about Cortex and it looks powerful, but I'm worried about costs spiraling.
Our main logs would be from CloudTrail, VPC Flow Logs, and maybe some app logs from ECS. Has anyone run Cortex in production with similar sources? I'm especially curious about:
* How you control log ingestion volume and costs. Are there specific filters you set up early on?
* Query performance for basic threat hunting – is it responsive for someone running a few searches a day?
I tried setting up a tiny test with Terraform, but I'm stuck on estimating the data volume. My dummy config looks like this:
```hcl
resource "aws_cloudtrail" "main" {
name = "example-trail"
s3_bucket_name = aws_s3_bucket.logs.id
}
```
How do you translate that into what Cortex would actually ingest daily? Any tips or gotchas would be super helpful 😅