Detection Decay in Multi-Tenant SIEM: Measuring Rule Half-Life and a Decay-Aware Content Lifecycle Model

Abstract

Enterprise SIEM detection content is authored once and audited rarely, yet its efficacy degrades continuously as log schemas drift, business processes change, and adversaries adapt. Existing detection-engineering practice treats coverage as a static ATT&CK matrix property and schedules rule review on fixed calendars, implicitly assuming efficacy is time-invariant. This paper introduces detection decay as a measurable property of deployed correlation logic. We define rule half-life as the elapsed operational time at which a detection's true-positive yield falls to half its post-tuning baseline, and estimate it using Cox proportional-hazards survival analysis with time-varying covariates over 24 months of alert-disposition telemetry from a multi-tenant managed-SIEM estate (11 tenants, 1,847 deployed detections, 2.1M dispositions) spanning Splunk Enterprise Security and Microsoft Sentinel. Covariates - schema-change events, ingestion-volume shift, field-conformance failure rate, and tuning interventions - are extracted automatically from CIM/ASIM conformance telemetry and index-time parsing errors, yielding a per-rule hazard score computable inside the SIEM itself. Results show decay is neither uniform nor primarily adversary-driven: schema and telemetry-source instability account for 61% of hazard in credential-access and persistence detections, whereas defence-evasion logic decays fastest under adversary pressure (median half-life 94 days versus term-wide 211). We then propose a decay-aware lifecycle governance model that replaces calendar-based review with hazard-triggered revalidation under a bounded budget. Against a fixed-interval baseline it retains 87.4% detection efficacy versus 68.1% (p < 0.001), reduces analyst-hours per true positive by 34.2%, and lowers false-positive volume by 30.6% at equal reviewer headcount.