How I Built an AI-Powered SIEM That Costs $2/Month to Run

说明与用途

LogPulse AI 是一款开源 SIEM，利用 LLM 对日志进行评分，通过 16 层优化实现每月仅 $2‑10 的成本。

问题

High cost of per-event LLM scoring in SIEMs makes open-source solutions unviable.

结果

With 16 optimization layers, LogPulse AI reduces LLM calls by ~90%, achieving $2‑10/month for 10,000 daily events while preserving AI scoring and MITRE mapping.

工作流

• Collect logs
• Deduplicate templates
• Cache recent scores
• Mark normal behavior
• Apply severity pre‑filter
• Auto‑skip low‑score templates
• Truncate messages to 512 chars
• Batch 20 templates per API call
• Run meta‑analysis with optimizations
• Select gpt‑4o‑mini for per‑event, gpt‑4o for meta
• Schedule adaptive pipeline runs
• Configure privacy filtering
• Limit context window
• Deploy via Docker
• Configure LLM API key

证据

Template deduplication reduces 10,000 events to ~200‑500 unique templates.

来源

With all optimizations enabled, monthly cost is $2‑10 for gpt‑4o‑mini.

来源