Managed SIEM cost in 2026: SIEM-as-a-service pricing explained

Cloud SIEM-as-a-service, where you pay a SaaS SIEM vendor and run the platform yourself, costs roughly $60K–$110K a year in license fees at 50–100 GB/day of logs on Microsoft Sentinel’s list prices, and about $460K at 500 GB/day. A fully managed SIEM, where a provider also operates and monitors it, adds a service fee we estimate at $50K–$170K a year at 50–100 GB/day, for an all-in $110K–$280K (about $630K–$970K at 500 GB/day).

The math is below. For SIEM pricing models and license bands by company size, see our SIEM cost guide. For costs that never appear on a quote, see the hidden costs of SIEM.

SIEM-as-a-service vs managed SIEM vs co-managed vs MDR

Quotes use these labels loosely. What separates them is who runs the platform and who watches the alerts.

Model	Who runs the SIEM	Who watches alerts	Typical billing
SIEM-as-a-service (SaaS SIEM)	Vendor hosts it; your team configures and tunes it	Your team	Per GB, event, employee or asset
Managed SIEM	A provider, on its platform or in your tenant	Provider’s SOC, often 24/7	Service fee by volume, log source or user, plus the license
Co-managed SIEM	You own the platform; the provider adds analysts and content	Split by hours or severity	Your license plus a smaller service fee
MDR	Provider, usually on its own EDR	Provider, with active response	Per endpoint per month

A quick test: if you pay the SIEM vendor directly and your own staff triage alerts, you bought SIEM-as-a-service. If someone else answers the 3 a.m. alert, it is managed SIEM or MDR. Check whether the license sits inside the managed fee: MTI’s published UK G-Cloud price list says the customer pays all SIEM platform licensing and the fee covers SOC services only.

How SIEM pricing units work

• Per GB ingested. The dominant cloud SIEM unit. Sentinel bills per GB into its analytics tier, with daily commitment tiers. Google says all its Security Operations packages are priced on ingestion volume.
• Per event. Datadog Cloud SIEM lists $5 per million analyzed events per month, billed annually. Events-per-second (EPS) licensing is the older on-premises version.
• Per device, asset or log source. Huntress lists a $4.00 MSRP per data source per month for its managed SIEM. Rapid7 uses asset-based pricing without published rates.
• Per employee. Blumira charges $12–$21 per employee per month across three editions, with no data limits.
• Flat tiers. VE3’s G-Cloud listing sells SIEM-as-a-service at £9,600, £21,600 and £42,000 a year for up to 5, 15 and 40 log sources.

Volume units punish noisy logs; per-source and per-employee units punish growth. When a vendor offers both, get both quotes.

What’s public: SIEM vendor list prices

Vendor	Unit	Published price	Notes
Microsoft Sentinel	Per GB, analytics tier	$4.30/GB pay-as-you-go; 100 GB/day tier $296/day; 500 GB/day tier $1,265/day	East US, USD
Elastic Security Serverless	Per GB ingested + per GB-month retained	Ingest $0.09–$0.11/GB; retention $0.017–$0.019/GB-month	Listed “as low as”
Datadog Cloud SIEM	Per 1M analyzed events	$5 annual, $6 monthly, $7.50 on-demand	Price list
Google Security Operations	Ingestion volume	Quote via sales; Google’s UK G-Cloud 15 sheet lists $1.95, $2.40 and $4.60 “per GB per annum” by package	12 months hot retention included
Splunk Cloud / Enterprise Security	Ingest, workload or activity	Quote only	A reseller’s AWS listing for self-hosted Splunk Enterprise: $961.40 per GB/day per year at 50–99 GB/day
CrowdStrike Falcon Next-Gen SIEM	Ingest + retention	Quote only; 10 GB/day free for Falcon Insight XDR customers	Free tier keeps 7 days
Sumo Logic	Data scanned (Flex)	Quote only; “$0 ingest” under Flex	SIEM sold in Enterprise Suite

The spread is wide. At Elastic’s floor rates for Security Analytics Complete, 100 GB/day costs about $4,000 a year to ingest (100 × 365 × $0.11) and about $8,300 to keep a rolling year (36,500 GB × $0.019 × 12), if retained GB equals ingested GB. No license price includes the people.

Worked scenarios: 50, 100 and 500 GB/day

These use Sentinel’s East US list prices because they are fully public. Rows marked * are SecurityBudget estimates.

Annual cost	50 GB/day	100 GB/day	500 GB/day
License (analytics tier)	$58,856–$78,475	$108,040	$461,725
License math	$161.25 × 365 (50 GB tier) to $4.30 × 50 × 365	$296 × 365	$1,265 × 365
Retention to 12 months*	~$715	~$1,430	~$7,150
Managed service layer*	$50K–$100K	$60K–$170K	$160K–$500K
All-in*	~$110K–$180K	~$170K–$280K	~$630K–$970K
Per month*	~$9K–$15K	~$14K–$23K	~$52K–$81K

Assumptions:

• Retention. Sentinel keeps the first 90 days of analytics data at no charge. Days 91–365 sit in the data lake at $0.026 per GB per month, billed on 6:1 compressed volume. At 100 GB/day: 100 × 275 ÷ 6 ≈ 4,583 GB × $0.026 × 12 ≈ $1,430 a year. Lake queries are extra.
• 50 GB tier. A public-preview promotion; pay-as-you-go is the upper bound.
• Managed layer, low end. MTI’s published 24/7 SOC fees (UK G-Cloud 14 list, April 2024): £37,970 a year at 2 TB/month (~50 GB/day), £42,620–£46,295 at 3–4 TB/month (~100 GB/day), £119,555 at 15 TB/month (~500 GB/day). That is about $51K, $58K–$62K and $161K at an assumed $1.35 per pound.
• Managed layer, high end. A provider dedicating about 0.6, 1 and 3 FTEs of analyst and engineering time at the site’s $168K loaded cost per security FTE (BLS median wage plus ~30% overhead).
• Excluded. One-off onboarding (MTI lists £13,960–£42,130 at these volumes), automation, paid connectors and incident-response hours.

For scale: 24/7 in-house coverage takes 8–12 security FTEs, or $1.3M–$2M a year at $168K each.

What drives the price

1. Daily ingest. The main meter. Microsoft singles out network, firewall and proxy logs as high-volume.
2. Retention. Cheap in a data lake; expensive if it must stay hot and searchable.
3. Coverage and response depth. 8x5 costs less than 24/7, and “notify” costs less than “contain”.
4. Log sources. Each needs onboarding; VE3 lists a £450 one-off fee per extra integration.
5. Commitment. Microsoft says commitment tiers save up to 52% over pay-as-you-go.

How to cut ingest without losing detections

• Filter before ingest. Drop debug events, duplicate fields and noisy event IDs at the collector. Sentinel’s lake processing supports filtering, redaction and normalization.
• Tier your logs. Microsoft’s pricing FAQ puts identity, threat intelligence and endpoint alerts in the analytics tier and network, firewall and proxy logs in the data lake. At 500 GB/day, moving 200 GB/day to the lake drops you to the 300 GB tier ($800/day) plus $0.15/GB for lake ingestion and processing ($30/day): about $303K a year instead of $462K. Lake data serves investigation and hunting, not real-time analytics rules.
• Use free sources. Azure Activity, Office 365 audit logs and Defender security alerts are free in Sentinel; some raw Defender and Entra ID logs are paid. Microsoft also advertises up to 5 MB per user per day of free ingestion for key security logs, so check whether your Microsoft 365 licensing qualifies.
• Size the commitment to your average. The 100 GB/day tier ($296) beats pay-as-you-go ($4.30/GB) above about 69 GB/day.

Contract and overage traps

• Commitment lock-in. Sentinel tiers can be raised anytime but lowered only after 31 days, and they apply per workspace.
• Hard caps. Above CrowdStrike’s free 10 GB/day, extra data is not ingested without an extended subscription. Dropped logs during an incident cost more than an overage bill.
• Pooled-volume overages. Huntress says overage charges can apply if pooled volume exceeds 10 GB per source.
• “Consistent” overage clauses. Splunk charges overages when you consistently exceed purchased capacity. Get “consistently” defined in writing.
• Promotional pricing. Sentinel’s 50 GB promo price holds only until March 31, 2027. Budget for the renewal rate.

Questions to ask a managed SIEM provider

1. Is the SIEM license included, and who owns the tenant if we leave?
2. How much daily volume is included, and is excess billed, throttled or dropped?
3. How many log sources does onboarding cover, and what does each extra cost?
4. Are analysts watching 24/7, and what are the escalation SLAs by severity?
5. Will you contain threats or only notify us?
6. Who writes and tunes detections, and do we keep them at exit?
7. What retention is included, and what do searches of older data cost?

Managed SIEM vs MDR: which is the better buy?

MDR is usually the better first buy when your risk sits mostly on endpoints and identities and nothing requires you to keep logs. It runs roughly $3–$45 per endpoint per month, around $6 typical, or $72K–$180K a year for 1,000 endpoints at the mid-market band, usually with detection tooling bundled. See our MDR pricing breakdown.

Managed SIEM earns its cost when you need centralized logs and long retention for audits, when much of your telemetry comes from firewalls, SaaS, cloud or OT, or when you want to own the data and detections. Co-managed fits teams with one or two analysts who need nights and weekends covered. Many mid-market buyers run both: MDR on endpoints, a SIEM for logs and retention. For MSSP, pentest and IR retainer prices, see cybersecurity services pricing.

To see SIEM, MDR and staffing side by side for your size, run the cybersecurity budget calculator.

FAQ

How much does managed SIEM cost per month?

By our estimates, about $9K–$15K a month at 50 GB/day and $14K–$23K at 100 GB/day, including the Sentinel license at list price. Small environments on per-source plans pay far less: at Huntress’s $4.00 MSRP, 100 data sources is $400 a month before any overage.

What is SIEM-as-a-service pricing per GB?

Sentinel lists $4.30 per GB pay-as-you-go in East US, falling to an effective $2.96 at the 100 GB/day tier and $2.53 at 500 GB/day. Elastic Security Serverless lists ingest from $0.09–$0.11 per GB plus retention. Splunk, Google and CrowdStrike quote per deal.

How much do enterprise SIEM licenses cost?

At 500 GB/day, Sentinel’s commitment tier lists $461,725 a year before retention and people. Splunk, Google and CrowdStrike enterprise pricing is negotiated; our SIEM cost guide puts 100–500 GB/day licenses at $350K–$1.2M. For comparable quotes, give every vendor the same daily volume by source, retention period and term.

Why are SIEM logging costs so hard to predict?

The bill follows log volume, and volume moves with every new source, verbose setting or incident. Commitment tiers and per-source or per-employee pricing make spend steadier. Filtering and log tiering keep the volume down.