SIEM Pricing: What Businesses Actually Pay in 2026

SIEM licensing costs roughly $0.10 to $6 per GB of log data in 2026, so a business sending 5 to 50 GB of logs a day pays about $650 to $9,000 a month for the software itself. Managed SIEM, with analysts watching it overnight, usually runs $3,000 to $5,000 a month.

A SIEM quote is priced on a guess about your log volume, usually something round like 10 GB a day, and the guess is the part nobody checks. Then the firewall gets connected. DNS logging goes on after an auditor's question. The 40 laptops from "phase two" get their agents on a slow Friday, and by month three the invoice and the quote have stopped resembling each other, without anyone signing a thing.

A SIEM (security information and event management) collects the logs from your servers, cloud apps, firewalls, and laptops and searches them for signs of an attack. On almost every platform you're billed for how much you send it, which is why SIEM pricing swings so much between companies. Two firms with the same headcount can get very different quotes, and on a managed SIEM proposal the software ends up being one of the smaller lines.

I checked every vendor price in this post against the vendor's own rate card or marketplace listing on November 5, 2026. Splunk's pricing page, for the record, has a button that says "Get a quote" where the number would go.

Key Takeaways

Sentinel lists at $4.30 per GB in East US and CrowdStrike's Next-Gen SIEM at $5.95, so 5 to 50 GB of logs a day comes to about $650 to $9,000 a month in licensing (less if much of your data is Microsoft 365 audit logs, which Sentinel ingests free). Staffing it yourself is the expensive part, roughly 4.2 analysts per round-the-clock seat at a $129,180 median salary. Managed SIEM generally costs $3,000 to $5,000 a month.

How is SIEM priced, and what do the major platforms cost in 2026?

Nearly every platform meters gigabytes of log data ingested, at list prices from about a dime to $6 per GB. Microsoft Sentinel charges $4.30 per GB pay-as-you-go in East US, CrowdStrike Next-Gen SIEM is $5.95 per GB through AWS Marketplace, Elastic starts as low as $0.09 per GB, and Splunk doesn't publish a list price at all.

Per-GB ingestion is the dominant model, but older SIEMs, managed security service providers (MSSPs), and Splunk also use others:

Region changes the Sentinel number more than people expect, and the same product costs about 30% more in West US than in East US. Microsoft's Sentinel pricing page says committing to a daily volume saves "up to 52%" over pay-as-you-go, although the 50 GB commitment tier is new and its rate is promotional through December 31, 2026, so I wouldn't build a three-year budget on it.

Elastic's rates are labeled "as low as," which means they're the bottom of a sliding scale. A small customer pays more per gigabyte than the headline.

Google sells Security Operations (still called Chronicle by a lot of people) in ingestion-based packages through its sales team, with a year of retention included. The only public per-GB figures I found are on a UK government procurement price list dated January 2026, in US dollars, which makes them a reasonable sanity check and nothing you could hold a US account rep to.

CrowdStrike's AWS Marketplace listing meters only "non Falcon data," so endpoint telemetry from Falcon itself doesn't count against the $0.00595 per MB. It also offers up to $500 in usage credits during a 30-day trial, and the terms say orders are non-cancellable and fees non-refundable, which is worth knowing before you point a firewall at it.

For a ranking on more than price (detection quality, usability, and fit for a small security team), see the best SIEM software for 2026.

What does a business pay at 5, 20, or 50 GB a day?

About $650 to $900 a month at 5 GB a day, $2,600 to $3,600 at 20 GB, and $4,800 to $9,000 at 50 GB, at list price on a 30-day month. Platform choice and whether you've committed to a daily volume decide where in each range you land.

Sentinel's smallest commitment tier is 50 GB a day, which is why the first two rows have no committed price.

Measuring is cheap on Sentinel. Microsoft's billing documentation gives new workspaces the first 10 GB a day free for 31 days, and the Usage table records how many billable gigabytes each data type sent (Microsoft measures a GB as a billion bytes, if you're reconciling against storage reports). I'd then price the measured volume three ways, as-is, plus 30%, and plus 50%, since new sources get added far more often than old ones get retired.

Which logs are free, and which ones blow up the bill?

In Microsoft Sentinel, Office 365 audit logs, Azure activity logs, and alerts from Microsoft's Defender products come in free. The expensive sources are firewalls, DNS servers, web proxies, and raw endpoint telemetry, all of which produce enormous numbers of small events.

If you already pay for Microsoft 365, the free list is worth reading closely. Microsoft names these:

• Azure Activity Logs
• Office 365 Audit Logs, which cover SharePoint activity, Exchange admin activity, and Teams
• Alerts from Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Defender for Cloud

Microsoft is clear about the catch, to its credit. The alerts are free, but the raw logs behind some of them aren't, so if you send full Defender for Endpoint device telemetry into Sentinel you'll pay the normal rate on every gigabyte of it.

The pricing page also mentions a small allowance for eligible Microsoft 365 customers, up to 5 MB of free ingestion per user per day for key security logs. For a 100-person company, that's 500 MB a day. Nice to have. It won't cover a firewall.

Firewalls are where SIEM budgets go to die. A single perimeter firewall logging every allowed connection can outweigh every Microsoft 365 log in your building, and DNS logs behave the same way, with millions of tiny lookups a day. You need some of that data for investigations, but you almost certainly don't need all of it sitting in the most expensive tier.

Sentinel has two cheaper places to put that kind of data. Basic logs are $1 per GB with limited search, and the data lake charges $0.05 per GB to ingest plus $0.10 per GB to process, then $0.026 per GB a month to store. My rule of thumb is that if a detection rule reads it, it goes in the analytics tier. If it's only there for an investigation someday or an auditor, it goes in the lake.

What isn't on the SIEM invoice?

Retention past the included window, onboarding and rule tuning, and the analysts who read the alerts. The analysts cost the most by a wide margin, since the median information security analyst earns $129,180 a year and one seat covered around the clock needs about 4.2 people.

On retention, keeping a full year of logs at 20 GB a day leaves about 5,500 GB past Sentinel's free 90 days at any given time, roughly $550 a month added to ingestion. You often don't choose the period anyway. PCI DSS requires 12 months of audit log history with the latest 3 months immediately available, and cyber insurance renewal forms ask about it.

Onboarding covers connectors for each log source and parsers for anything unusual (a parser is a small piece of code that turns a vendor's raw log format into fields the SIEM can search). The correlation rules, the logic that decides what counts as suspicious, then need tuning to your environment. Untuned, they'll flag things like the nightly backup job as possible data theft at 1 a.m. Whether a partner does that work or your own engineers do, it's weeks of senior time.

Staffing is the line that changes the decision. The Bureau of Labor Statistics puts the median information security analyst at $129,180 as of May 2025, with the top 10% above $199,850. A year has 8,760 hours and a full-time employee works about 2,080 of them before vacation and sick days, so one chair staffed every night and weekend takes about 4.2 people, roughly $540,000 in salary before benefits, recruiting, or turnover.

Against that, a $2,600 monthly Sentinel bill ($31,200 a year) is about one-seventeenth of the people cost. The in-house SOC vs SOC-as-a-Service cost comparison runs the full build-versus-buy numbers, and I'd read it before signing a standalone SIEM contract.

An unwatched SIEM records an attack without stopping it. IBM's 2026 Cost of a Data Breach report put the global average breach at $4.99 million, up 12% from the year before.

What does managed SIEM cost?

Most businesses pay $3,000 to $5,000 a month for managed SIEM, and heavy log volumes push it toward $10,000. Read what's inside that number before you compare it, because one provider's $4,000 includes the license, the tuning, and analysts in a security operations center (SOC) who can act at night, and another's is a dashboard plus an email address.

Huntress publishes more than most. Its Managed SIEM is billed per data source, according to its pricing page, with the line "overage charges can be applied if pooled volume goes over 10GB per source," and up to 7 years of retention advertised. That's a model you can actually forecast. Flat retainers forecast even better, but comparing two of them is close to impossible unless both providers define "your environment" the same way (they won't).

I'd get these answered in writing before putting two proposals side by side:

The Sunday-night question tends to settle it. A monitoring service opens a ticket. A response service isolates the laptop, revokes the session, disables the account, and calls you afterward. That second kind is really managed detection and response, and the MDR vs MSSP vs SIEM breakdown shows where each one's responsibility ends.

Given the staffing math above, I'd ask any provider quoting genuine 24/7 coverage for well under $3,000 a month how the overnight shift is staffed. Consilien sells this as SOC-as-a-Service, the SIEM, tuning, and overnight analysts together in one fee.

Is an open-source SIEM actually cheaper?

Wazuh, Graylog, and Security Onion have no license fee. You still buy servers and storage, and somebody installs, patches, scales, and tunes them.

In practice that means the database servers that store your logs asking for more disk every quarter, agents to deploy and update on every server, and upgrades that occasionally break the rules that read a log format (firewall events then stop matching any rule until someone notices). For a company with a capable security engineer who has spare hours, open source can come out cheapest by a wide margin. For everyone else the work doesn't disappear. It moves from an invoice to your payroll.

How do you keep SIEM costs from climbing in year two?

Year-two increases nearly always come from log sources added after the contract was signed. Filtering before ingestion, committing once you know your volume, and tiering bulky logs keep the number close to the original quote.

Start with filtering. Repetitive firewall "allow" entries and debug-level logs can be dropped at the source, or trimmed by a routing tool before the SIEM bills for them, and Cribl's guide to SIEM costs covers how those pipelines work. Once a month of measured data shows your floor, commit to it (on Sentinel, a 100 GB daily commitment is $296 against $430 pay-as-you-go).

Logs kept only for compliance can live in the data lake or basic tier. Re-price when each new source is connected rather than waiting for renewal, by which point you've paid for a year of it. And check what you already license, because a Microsoft 365 shop with Defender everywhere may need much less SIEM than the first quote assumed.

Microsoft's billing documentation says that after March 31, 2027, Sentinel will no longer be supported in the Azure portal and will be available only in the Defender portal. Pricing doesn't change with that move, but your team's workflows will.

When is a SIEM overkill?

A 15-person firm on Microsoft 365 Business Premium, with Defender on every laptop and an MDR service watching its endpoints, probably doesn't need a SIEM yet. I'd put that money into the MDR contract and multifactor authentication on every account.

Three things change the answer:

• A compliance framework that requires centralized log review, such as PCI DSS Requirement 10 or the audit and accountability family in NIST SP 800-171, which CMMC assesses
• Enough separate systems that no single tool can follow an attacker moving between them
• A cyber insurer asking about centralized logging on the renewal application

Consilien handles compliance as a standalone engagement, separate from managed security, so you can make the SIEM decision and the compliance decision on their own merits.

For the basics of what a SIEM does day to day, see the plain-English explainer on what a SIEM is. For where it sits in an overall security budget, the managed cybersecurity cost guide breaks that down.

Have a quote on the table and can't tell what it buys? Speak to a SOC expert.