Attestation vs SIEM logging

Security information and event management platforms collect logs from across an estate, normalise them, correlate events, and alert on patterns. They are essential, and nothing here argues otherwise.

They also share one property with the systems they monitor: everything in them was put there by the organisation that owns them, and can, with sufficient privilege, be changed.

What each one is for

SIEM

• Aggregation across many sources.
• Correlation, detection, and alerting.
• Operational investigation and incident response.
• Retention and search at volume.

Attestation

• Per-record integrity that any third party can check.
• Timestamps witnessed outside the organisation.
• Verification that does not require the record owner's participation.
• Selective scope: the decisions that matter evidentially, not every event.

The question that separates them

Ask: if the organisation wanted this record to say something different, could it?

In a SIEM, with sufficient privilege, yes. Write-once storage and access controls raise the bar, but they are controls the organisation administers, and their strength is a matter of the organisation's own assurances. In an anchored attestation, no, because the record's fingerprint was published to a ledger the organisation does not operate.

That is not a criticism of SIEM design. It is a statement about who the evidence has to convince. For internal investigation, self-produced records are fine. For a regulator, a counterparty, or a court, the producer's independence is the whole question.

How they fit together

The common pattern keeps the SIEM as the operational system of record and attests a narrow, high-value slice: adverse decisions, autonomous actions above a threshold, model changes, incidents. Attestation receipts can be forwarded into the SIEM so investigators see them alongside everything else, while the evidentiary weight lives outside the estate.

Cost shape

SIEM cost scales with volume ingested, which is why teams sample and drop. Attestation cost scales with the number of records attested, which is why scope selection matters. The two pressures push in the same direction: attest what would be expensive to be unable to prove, log the rest.