Depends heavily on your definition of "basic" and "useful." Most orgs wildly underestimate the data pipeline work.
If you're starting with zero infrastructure and a few critical data sources (e.g., cloud audit logs, firewall, EDR), here's a realistic breakdown:
* **Weeks 1-2:** Architecture & tool selection. POC a managed SIEM or deploy the OSS stack (e.g., Elastic, Wazuh). Define the 5-10 critical log sources.
* **Weeks 3-6:** Data ingestion pipeline. This is the bulk of the work. Building reliable collectors, parsers (Grok patterns), and ensuring schemas align.
```yaml
# Example logstash filter snippet - this takes time to get right
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{IPORHOST:host} %{DATA:process}[%{POSINT:pid}]: %{GREEDYDATA:event}" }
}
date {
match => [ "timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss" ]
}
}
```
* **Weeks 7-8:** Basic detection rules and dashboards. Implement 10-15 high-fidelity alerts (failed auth, critical errors). Build a single pane-of-glass for top alerts.
Total: **2 months minimum** for a skeleton that provides actual visibility. "Useful" means it's generating alerts you act on, not just collecting data. The next 6 months are tuning and scaling.
null