Simplifying SIEM Pricing: It’s Not as Complex as You Think!

SIEM pricing has a reputation for being impenetrable. It is not. Three numbers drive almost all of it, and a fourth one has become important since we first wrote this.

Ingest

You pay for the volume of data going in, normally per GB per day, occasionally by events per second.

This is the number vendors quote and the one that catches people out. Volume grows quietly as you add sources, and nobody notices until an invoice does the noticing for them.

Storage

You pay to keep the data, and longer retention costs more.

Compliance usually sets your floor. Plenty of obligations ask for 12 months, and some ask for seven years.

The useful point is that your archive does not have to live inside the SIEM. Cheaper storage exists, and the data you keep for an auditor is rarely the data you query on a Tuesday.

Features

Feature pricing is normally a multiplier on ingest, and it varies a lot between vendors.

Advanced analytics, threat intelligence feeds, automated response, user behaviour analytics. Work out which of these you will actually operate. A feature nobody has time to tune is a feature you are renting for nothing.

The bit that has changed: tiering

When we first published this, most SIEMs charged one rate for everything. That is no longer true, and tiering is now the biggest lever you have on the bill.

Most platforms, Microsoft Sentinel included, now offer several:

• A full analytics tier, where everything works. Real-time detection, alerting, long query windows. It costs the most.
• Cheaper tiers for high volume, low value data. Firewall traffic logs are the obvious candidate. You can still search them during an investigation, but detection is limited and the query window is shorter.
• An archive tier for data you keep because somebody says you must. Cheap to store, slow and fiddly to get back.

Sorting your sources across those tiers is worth more than any negotiation on the headline rate. A firewall producing most of your volume has no business sitting in the analytics tier.

Do that sorting before you sign. Moving data between tiers afterwards is possible and rarely pleasant.

Commitment tiers

If your volume is predictable, most vendors will discount in exchange for a commitment.

Only commit once you know your steady-state volume. Committing in the first month of a rollout, while ingestion is still being tuned, means locking in a number you picked while guessing.

Controlling the cost

There are two approaches to tuning and both are defensible.

Start open. Collect everything, find out what the environment actually produces, then cut back. This is the right call when you do not know what is out there, and it is expensive for the first couple of months.

Start closed. Collect a controlled set of sources and add more as you need them. Common in managed service contracts and cheaper up front, but it carries a real risk of missing something because you never collected it in the first place.

We usually start open for a short, fixed period and then tighten hard. The first bill is uncomfortable and you come out knowing what you are dealing with.

Four questions to ask a vendor

What counts as billable ingest, and what comes free? Which of my sources can sit in a cheaper tier? What does retention cost beyond the included period? And what happens to my price if volume doubles?

That last one matters most. Volume always grows.

There is more on how this plays out in practice in Microsoft Sentinel Implementation Lessons.

Element Digital offers IT consulting services in Hobart. If you are pricing a SIEM, get in touch.