SIEM pricing comparison: 15 vendors, every pricing model, side by side
The vendor-neutral SIEM pricing comparison. All fifteen major platforms in one table, with each vendor's pricing model, entry point, published rate and what actually drives the bill, grouped by how they meter so you can compare like for like. Every figure links to the deep-dive page that sources it. Updated July 2026.
SIEM pricing comparison, in one paragraph
The reason SIEM prices are so hard to compare is that no two vendors meter the same thing. Splunk, Microsoft Sentinel, Google SecOps and CrowdStrike LogScale bill on data volume. IBM QRadar and LogRhythm bill on event rate (per EPS or MPS). Blumira bills per employee, Rapid7 InsightIDR per asset, Sumo Logic on credits, and Datadog on analyzed events. The published anchors range from Sentinel at $4.30/GB PAYG (down to $2.05/GB committed) and CrowdStrike LogScale at $5.95/GB, to QRadar at $2.40-$4.60/EPS/month and Blumira from $12/employee/month, with Google SecOps and Securonix quote-only. The table below lines all fifteen up on the same columns; the grouped view underneath sorts them by pricing axis so you can compare like for like, and the calculator normalises the major vendors to your own GB/day.
Every SIEM vendor, side by side
Fifteen platforms, one table. Each row links to the deep-dive page that sources the figure and shows the full cost scenarios. Rates are published anchors or reseller list references, not negotiated deal prices; negotiated agreements typically deliver 20-40 percent off list.
| Vendor | Pricing model | Entry / floor | Published anchor | What drives the bill |
|---|---|---|---|---|
| Splunk | Per GB ingested | ~$8K-$15K entry | $665-$1,620 /GB/day/yr | Ingest volume, plus Enterprise Security add-on |
| Microsoft Sentinel | Per GB, commitment tiers | PAYG $4.30/GB | Best commit $2.05/GB; Basic Logs $1.00/GB | Ingest volume; Microsoft 365 logs ingest free |
| IBM QRadar | Per EPS (events/sec) | $10K/yr entry; Community Edition free (100 EPS) | $2.40-$4.60 /EPS/mo | Events per second, plus 20-25% annual maintenance |
| Elastic Security | Resource-based | Basic tier free; Platinum from ~$131/mo | Licence low; engineer premium $120K-$180K | Compute/storage resources and self-managed ops effort |
| Datadog Cloud SIEM | Per analyzed event (+ logs) | $5 / 1M analyzed events | Indexed logs $1.70/Mevt; infra $15/host | Analyzed event volume plus separate log indexing |
| Sumo Logic | Flex credits | $0 ingest and indexing | Credit MSRP ~$1.50 | Credit consumption on scan and query, not raw ingest |
| LogRhythm | Self-hosted, per MPS (ULP) | Analytics core ~$65 /MPS/yr | ~60-80 MPS per GB; 15-25% renewal | Messages per second across the estate |
| Google SecOps (Chronicle) | GB data cap | ~£2,000 /TB/yr (UK G-Cloud) | US commercial quote-only | Committed GB data cap; overage billed in arrears |
| Exabeam | Per GB/day | SIEM ~$36K @ 50 GB/day | Fusion ~$51K @ 50 GB/day | Ingest volume, with UEBA bundled in Fusion |
| Securonix EON | Capacity (GB/day) + BYO Snowflake | Quote-only; 4 packages | Native SOAR in the All-In tier | Ingest capacity plus a separate Snowflake bill |
| Devo | Daily ingest tiers | ~$90K @ 100 GB/day (list) | 400-day hot retention included | Daily ingest tier; 20-25% EA discount typical |
| Rapid7 InsightIDR | Per asset / month | From $3.58 /asset/mo | MDR est. $15-$22 /asset/mo | Monitored asset count, not raw log volume |
| CrowdStrike LogScale | Indexing-free per-GB | 10 GB/day free | $5.95 /GB PAYG; ~$217K @ 100 GB/day | Ingest volume, no indexing surcharge |
| Panther | Per-TB volume meter | ~$75K-$90K @ 50 GB/day | $50K /TB/mo (AWS list anchor) | Ingest volume; detection-as-code workflow |
| Blumira | Per employee / month | Detect $12 /employee/mo | Automate $21 /employee/mo | Employee count, not log volume |
Each figure is reproduced from this site's per-vendor pricing pages, which carry the primary-source citation (vendor pricing page, Azure retail price list, AWS Marketplace, or UK G-Cloud listing) and the check date. This comparison introduces no new figure; it aggregates the verified per-vendor data into one view. Always obtain a vendor quote.
Why you cannot compare SIEM prices with a single number
A SIEM shortlist almost always mixes pricing models, and that is what makes a straight price comparison misleading. A $5.95/GB rate and a $12/employee/month rate are not two points on the same line; they meter different things. The only honest way to compare is to pick the metric your environment is bound by, usually sustained GB per day of ingest, and convert every vendor onto it. The three groups below sort the fifteen vendors by how they meter, so you compare within a group first and normalise across groups second.
Per-GB / per-volume
Splunk, Sentinel, Chronicle, Exabeam, Securonix, Devo, CrowdStrike LogScale, PantherThe dominant model. You pay for data ingested (or a committed GB data cap). Splunk, Microsoft Sentinel, Google SecOps, Exabeam, Securonix, Devo, CrowdStrike LogScale and Panther all meter on volume. Directly comparable once you normalise to the same GB/day, and the model where a noisy log source hurts most.
Per-EPS / per-MPS
IBM QRadar, LogRhythmPriced on event or message rate rather than bytes. QRadar meters events per second; LogRhythm meters messages per second (ULP). To line these up against per-GB vendors you convert EPS to GB using average event size, which is exactly what the EPS-to-GB tool does.
Per-seat / per-asset / credit
Blumira, Rapid7 InsightIDR, Sumo Logic, Datadog Cloud SIEM, ElasticPriced on something other than raw volume, so a high-log, low-headcount environment can win big here. Blumira meters employees, Rapid7 InsightIDR meters assets, Sumo Logic meters credits consumed on scan and query, and Datadog Cloud SIEM meters analyzed events. Elastic is resource-based and its real cost is the engineer who runs it.
To normalise across groups: use the EPS-to-GB conversion tool to put QRadar and LogRhythm on the same GB/day axis as the per-GB vendors, then run the multi-vendor calculator for a licence estimate at your volume. Remember that licence is rarely more than 40 percent of total spend, so finish with the hidden-cost breakdown.