How I Built an AI-Powered SIEM That Costs $2/Month to Run

Описание и применение

LogPulse AI – открытая SIEM, использующая LLM для оценки логов, достигает стоимости $2‑10/мес благодаря 16 оптимизациям, включая дедупликацию шаблонов и кэширование.

Задача

High cost of per-event LLM scoring in SIEMs makes open-source solutions unviable.

Результат

With 16 optimization layers, LogPulse AI reduces LLM calls by ~90%, achieving $2‑10/month for 10,000 daily events while preserving AI scoring and MITRE mapping.

Рабочий процесс

• Collect logs
• Deduplicate templates
• Cache recent scores
• Mark normal behavior
• Apply severity pre‑filter
• Auto‑skip low‑score templates
• Truncate messages to 512 chars
• Batch 20 templates per API call
• Run meta‑analysis with optimizations
• Select gpt‑4o‑mini for per‑event, gpt‑4o for meta
• Schedule adaptive pipeline runs
• Configure privacy filtering
• Limit context window
• Deploy via Docker
• Configure LLM API key

Доказательства

Template deduplication reduces 10,000 events to ~200‑500 unique templates.

Источник

With all optimizations enabled, monthly cost is $2‑10 for gpt‑4o‑mini.

Источник