SIEM as a Service: Scope, Pricing, and When It Fits

SIEM as a service is a security information and event management (SIEM) platform that a vendor or managed provider hosts and runs. It collects logs from your identity provider, endpoints, firewalls, and cloud accounts, stores them, and runs correlation rules that raise alerts. On its own, it ends at the alert: SOC as a service adds analysts who triage and escalate, and managed detection and response (MDR) adds a vendor's endpoint agent that can contain a host. Vendors price it by GB ingested per day, compute, events per second, or devices. BD Emerson's planning range for a mid-size company is $75,000 to $400,000 a year before analyst monitoring, and the service fits when someone owns the alert queue.

What does SIEM as a service include?

A SIEM does four jobs. It collects events through agents, API connectors, and syslog forwarders. It parses each event into common fields, so a failed sign-in from Okta and one from Microsoft Entra ID answer the same query. It stores the data in tiers with different retention periods and prices. It runs correlation rules that turn patterns across sources into alerts, such as a sign-in from a new country followed by a new mailbox forwarding rule.

The "as a service" part describes who runs that machinery. In the lighter form, a cloud vendor such as Microsoft, Splunk, Elastic, or Google hosts the platform and patches the software, and your team builds and tunes everything on top. In the managed form, often sold as managed SIEM, a provider also onboards log sources, repairs parsers when a vendor changes its log format, tunes rules that fire on normal business activity, and notices when a source stops sending.

A SIEM does not supply judgment. An alert that an administrator account signed in from a new device at 2:14 a.m. is a data point. Deciding whether that is the administrator on a business trip or an attacker with a stolen session token, then disabling the account, takes an analyst with context and authority. The joint event logging guidance that the Australian Signals Directorate's Australian Cyber Security Centre published with CISA, the FBI, and the NSA names four factors for a logging program: an approved event logging policy, centralized log access and correlation, secure storage with log integrity, and a detection strategy for relevant threats. A SIEM service supplies the correlation and most of the storage, and your team or a SOC provider owns the policy and the detection strategy and keeps them current.

How does SIEM as a service differ from SOC as a service and MDR?

The three services split along one line: who reads the alert and who acts on it. SIEM as a service sells the platform, SOC as a service sells the people who work its queue, and MDR sells a vendor's endpoint-centered detection stack and analysts as one product. Vendors use the labels loosely, so read the contract's responsibility matrix before the product name. Our comparison of MDR, SOC as a service, and MSSP models covers accountability during an incident.

The services combine. A company can run a SIEM in its own tenant with a SOC provider working its alerts, or run MDR on endpoints plus a SIEM for the identity, SaaS, and cloud logs the agent never sees.

How do vendors price SIEM as a service?

The pricing unit decides which of your growth curves the bill follows: log volume, compute, device count, or headcount. Five models show up in SIEM quotes.

• Gigabytes ingested. Microsoft Sentinel bills its analytics tier per GB, either pay-as-you-go or through commitment tiers that start at 100 GB per day, and it meters its lower-cost data lake tier separately for ingestion, processing, storage, and queries. Elastic Security on serverless bills per GB ingested and per GB retained each month, and Elastic's pricing page states that per-endpoint fees stopped applying on March 23, 2026.
• Compute. Splunk's workload pricing charges for the compute and storage that search and analytics consume, measured in Splunk Virtual Compute units on Splunk Cloud Platform and in vCPUs on Splunk Enterprise. Splunk also sells per-GB ingest pricing for Splunk Enterprise Security.
• Events per second and devices. Fortinet licenses FortiSIEM per device or per endpoint with an events-per-second (EPS) allowance attached, for example 10 EPS per device and 2 EPS per endpoint on its subscription licenses, and it offers a GB-per-day scheme for on-premises virtual machine deployments.
• Endpoints or users. Providers that bundle the SIEM into a wider managed service often price per endpoint or per user. The ingest cost still exists inside the provider's margin, and it resurfaces at renewal if your log volume grows faster than your headcount.
• Flat fee. Managed SIEM providers often quote a flat monthly fee for a named set of log sources up to a GB-per-day ceiling, with an overage rate above that ceiling.

Analyst coverage sits on top of every model above and carries its own price, which our breakdown of SOC as a service pricing covers model by model.

What drives SIEM cost?

Billable volume drives the platform bill under ingest pricing, and a few verbose sources set that volume. Firewall traffic, DNS query, cloud flow, and raw EDR logs produce far more data per day than identity sign-ins or email audit events, often with less detection value per gigabyte. The joint guidance tells organizations to consider filtering event logs before they reach a SIEM, to minimize added cost and capacity problems. Filtering and routing are where a managed SIEM provider earns its fee: it drops fields no rule uses, sends high-volume, low-value logs to a cheaper tier, and keeps detection-relevant events in the tier where rules run.

Free sources change the math. Microsoft lists Azure Activity Logs, Office 365 audit logs, and security alerts from its Defender products as free in Sentinel, while raw logs for several Defender XDR and Microsoft Entra ID data types are billed. A company that runs on Microsoft 365 starts with part of its audit trail at no ingest charge and pays for the raw telemetry it adds.

Retention is the third driver. Sentinel keeps analytics data at no charge for the first 90 days and bills retention beyond that, including per-GB monthly storage in its data lake tier. The joint guidance warns that default retention periods are often insufficient, notes that discovering an incident can take up to 18 months, and recommends hot and cold storage tiers. Set the retention period from your regulatory, contractual, and investigation needs, then decide how much of it stays in the tier where detection rules run.

Commitment and overage terms come fourth. Sentinel lets a customer raise its commitment tier at any time, bills usage above the tier at the tier's rate, and allows a lower tier only once every 31 days. A new SaaS audit feed or a verbose firewall policy can push daily volume past a tier, so put the overage and re-tiering rules in the budget before the first invoice.

What does SIEM as a service cost a mid-size company?

BD Emerson's planning range for a company of roughly 500 to 2,500 employees is $75,000 to $400,000 a year before onboarding and analyst monitoring, built from three lines. The platform line runs $40,000 to $250,000 a year and assumes 25 to 150 GB per day of billable data on an analytics tier with 12 months of retention; a lake tier for secondary logs or a platform with a lower per-GB rate moves it down. The management line runs $3,000 to $12,000 a month and moves with the number of log source types, custom parsers for in-house applications, detection rules under maintenance, and change requests. Onboarding adds $10,000 to $50,000 once, driven by how many sources need custom parsing and whether existing rules migrate from an older SIEM.

In our planning, two inputs move the platform line more than any others: billable GB per day after filtering, and the retention period in the analytics tier. Before you request quotes, measure seven days of volume per source from your existing collectors and decide what each source is for: detection, investigation, or compliance retention only. Sources kept for compliance retention alone rarely need the analytics tier.

When does SIEM as a service fit a mid-size company?

SIEM as a service fits when three conditions hold. First, someone owns the alert queue: an internal security team during business hours and a SOC provider or an on-call rotation for nights and weekends. A SIEM that nobody watches produces an accurate record of an attack after the attacker has finished. Second, you carry logging and monitoring obligations that need a central, searchable store, such as SOC 2 common criterion CC7.2 on monitoring system components, ISO 27001:2022 Annex A controls 8.15 (logging) and 8.16 (monitoring activities), the HIPAA Security Rule audit controls standard at 45 CFR 164.312(b), or the audit and accountability requirements in CMMC Level 2. Third, your telemetry reaches past endpoints into identity, SaaS, cloud control planes, and in-house applications, where an endpoint agent has no view.

It fits poorly when no one will work alerts after hours and there is no budget for a provider who will. There, MDR puts analysts and containment on endpoints first, and a SIEM can follow once the queue has an owner. It also fits poorly when the buyer expects the SIEM to stop attacks, because a SIEM detects and records while containment comes from people with authority or an agent that can isolate a host. If you expect to change providers, keep the SIEM in your own tenant under your own contract so the data, parsers, and rules stay when the provider leaves.

What should a SIEM as a service contract spell out?

Put these terms in writing. State the billable unit, how the vendor measures it, and the overage rate. Fix retention per tier and the price to extend it. Name who owns the detection rules and parsers the provider writes, and confirm they leave with you at exit along with your data in a usable export format. Require source health monitoring with a response time, because a source that stops sending looks the same in the console as a quiet network. Finally, attach a responsibility matrix that names who triages, who escalates, and who acts on a confirmed threat for every hour of the week, including the handoff to your incident response retainer.

BD Emerson runs the layer above the platform. Our SOC as a Service operates on the SIEM and EDR you own, such as Microsoft Sentinel with CrowdStrike or Microsoft Defender, so the data and licenses stay in your tenant. Our team onboards and parses log sources, sets retention, writes detections mapped to MITRE ATT&CK, triages the queue, and hands confirmed incidents to your responders with severity, scope, and evidence.