How I Built an AI-Powered SIEM That Costs $2/Month to Run

Description and use

LogPulse AI is an open‑source SIEM that uses LLMs to score logs, achieving $2‑10/month through 16 optimizations such as template deduplication and caching.

Problem

High cost of per-event LLM scoring in SIEMs makes open-source solutions unviable.

Outcome

With 16 optimization layers, LogPulse AI reduces LLM calls by ~90%, achieving $2‑10/month for 10,000 daily events while preserving AI scoring and MITRE mapping.

Workflow

• Collect logs
• Deduplicate templates
• Cache recent scores
• Mark normal behavior
• Apply severity pre‑filter
• Auto‑skip low‑score templates
• Truncate messages to 512 chars
• Batch 20 templates per API call
• Run meta‑analysis with optimizations
• Select gpt‑4o‑mini for per‑event, gpt‑4o for meta
• Schedule adaptive pipeline runs
• Configure privacy filtering
• Limit context window
• Deploy via Docker
• Configure LLM API key

Evidence

Template deduplication reduces 10,000 events to ~200‑500 unique templates.

Source

With all optimizations enabled, monthly cost is $2‑10 for gpt‑4o‑mini.

Source