SIEM software collects logs from servers, cloud accounts and security tools, correlates them into alerts and keeps the evidence for audits.
Vendors price by data volume, events per second, servers or ingestion packages, and the licence figure rarely covers retention. This guide ranks twelve SIEM products on setup effort, real cost with add-ons, data exit and independence.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
In short
What SIEM software does
Security information and event management software gathers log and event data from across an organisation, correlates it to detect threats, and stores it for investigation, alerting and compliance reporting.
Five tests decide the order: setup effort, real cost, how your data leaves, whether you can walk away, and who the SIEM tool was built for. One rule overrides the order: smaller vendors take the first three places when the category offers them, and the best-known brands start at four. Our how we work page explains the choice of these five and why we give no mark out of ten.
Open source SIEM and XDR platform with no licence cost
Ranked #1 of 12 in Best SIEM Software in 2026.
Open sourceSelf-hostablePublished pricingElsewhere
Wazuh installs as an indexer, a server and a dashboard, with an agent on each monitored endpoint, and the same agent covers file integrity monitoring, configuration assessment and vulnerability detection.
Because the software is GPLv2, you can buy, run and leave without a contract, which is the strongest independence result in this list. The trade is staffing: parsing, rule tuning and upgrades are yours unless you buy Wazuh Cloud or professional support.
What stands out
Open source
Self-hosted
Agent-based
Where it costs you
Running it yourself means you size, patch and monitor the indexer, server and dashboard, and the vendor sells professional support and consulting as separate services.
The Small cloud tier covers up to 100 active agents and keeps indexed data for one month, so larger estates or longer retention need a bigger tier.
Right for
Teams with Linux skills that want endpoint-centred detection without any licence fee
Wrong for
Teams with nobody to run servers and tune detection rules
Not stated by the vendorSelf-hosted software free; Wazuh Cloud tiers published by active agents; 14-day trial
Log-first SIEM with a data lake outside the licence count
Ranked #2 of 12 in Best SIEM Software in 2026.
Free tierPublished pricingNorth America
Enterprise adds data lake routing, hot, warm and archive data tiering, a correlation engine, Graylog-maintained parsers and dashboards, SSO, LDAP roles and user audit logs. The Security tier adds SIEM features such as ATT&CK-mapped detection rules and Sigma support. Graylog Accelerator onboarding is included.
What stands out
Source-available
Volume licensing
Data lake
Where it costs you
Open edition support is community-only and the vendor frames it as for teams with engineering time.
Enterprise and Security start at a yearly floor and are bought through a sales contact.
Right for
Operations teams that want a log-specific tool with a free edition and a path to a paid licence
Wrong for
Teams that want usage-based pricing from the first gigabyte
United StatesGraylog Open free with no volume cap; Enterprise and Security licences published by daily volume
SIEM on Elasticsearch, billed per gigabyte ingested and retained
Ranked #3 of 12 in Best SIEM Software in 2026.
Published pricingEurope
Elastic Security is the SIEM layer of the Elastic stack, sold as serverless projects, hosted deployments or self-managed software. The Essentials tier bills a lower rate per ingested GB and includes prebuilt detection rules and Elastic Defend endpoint protection, while Complete adds entity analytics and the AI Assistant.
Elastic N.V. lists an Amsterdam address, and the repository licence offers AGPL beside SSPL and the Elastic License 2.0, so exit through self-managed code is genuine.
What stands out
Per-GB billing
Self-managed option
Search-based
Where it costs you
Entity analytics, the AI Assistant and private connectivity sit only in the dearer Complete tier, so the entry rate understates what a full SOC needs.
Running the stack yourself means sizing Elasticsearch, while the serverless route bills ingest, retention and egress as three separate meters.
Right for
Teams with search skills that want per-gigabyte billing and a self-run exit
Wrong for
Buyers who want a fixed annual price per organisation
NetherlandsServerless billed per GB ingested and retained, published; self-managed option; trial offered
Cloud SIEM or on-premises LogRhythm, both sold through sales
Ranked #4 of 12 in Best SIEM Software in 2026.
Self-hostablePricing on requestNorth America
New-Scale Fusion combines SIEM and analytics on Google Cloud with a 99.5% uptime commitment, a hosting region chosen at purchase and more than 7,000 prebuilt log parsers.
LogRhythm SIEM suits buyers who must keep data in their own data centre, and the vendor says its pricing model has no tiers or hidden fees. Collectors run as virtual machines behind your firewall. Exit paths differ by edition, and the pages we read document no data export.
What stands out
Cloud or on-premises
Behavioural analytics
LogRhythm merger
Where it costs you
Neither edition shows a price on the pages we checked, so budgeting needs a sales conversation.
The cloud product and LogRhythm are separate platforms, and the vendor says LogRhythm SIEM is not available as cloud native.
Right for
Organisations that need a SIEM with behavioural analytics and an on-premises option
Wrong for
Buyers who need public prices before a first conversation
United StatesCloud-native New-Scale platform or self-hosted LogRhythm SIEM; quoted by sales
Cloud SIEM that bundles UEBA, SOAR and threat intelligence together
Ranked #5 of 12 in Best SIEM Software in 2026.
Pricing on requestNorth America
Unified Defense SIEM is delivered as one cloud-native platform with an AI analyst called Sam and a Data Pipeline Manager meant to align data cost with value. The vendor says searchable data stays hot for 365 days and that compliance reporting maps to SEC, GDPR and DORA.
Everything is sold as one platform, so leaving means extracting detections and data from several bundled parts, and the pages we read document no export route.
What stands out
Unified SIEM
Behavioural analytics
Consumption pricing
Where it costs you
No price or entry plan is shown, so cost can only be tested through a demo.
The product page describes a cloud-native platform and names no self-run edition.
Right for
Mid-size security teams that want UEBA and SOAR bundled rather than bought separately
Wrong for
Teams that want to compare published list prices first
United StatesConsumption-based model with SOAR, UEBA and analytics not charged separately; sized in a demo
Log analytics vendor whose Cloud SIEM sits in the Enterprise Suite
Ranked #6 of 12 in Best SIEM Software in 2026.
Pricing on requestNorth America
Sumo Logic places Cloud SIEM in its Enterprise Suite and lists unlimited users on both plans, while the cheaper Essentials plan shows no SIEM log ingest.
Licensing runs on Sumo credits, in tiers or in a Flex option where search is billed separately, which is harder to forecast than a flat gigabyte rate. It is headquartered in Redwood City, California, and the Enterprise Suite price comes only from sales.
What stands out
Credit licensing
Unlimited users
Log-first
United StatesCredit-based licensing; Essentials plan with trial, Enterprise Suite quoted; unlimited users
Cloud SIEM billed per gigabyte analysed, sold beside observability
Ranked #7 of 12 in Best SIEM Software in 2026.
Published pricingNorth America
Datadog covers more ground than anything else here, and the integrations mean a new service is visible the day it ships.
That breadth is also the billing problem: hosts, indexed logs, ingested logs, custom metrics, spans, RUM sessions and synthetics each meter separately, though seats are not one of the meters, and nothing in the console stops an engineer from adding a tag that multiplies custom metrics. OTLP is supported, but profiling, database monitoring and live container views need the agent.
What stands out
Per-GB analysed
Observability suite
12-month retention
Where it costs you
Six or more meters on the same invoice
Overage after a noisy deployment is the standard complaint
Right for
Organisations that want every observability product from one vendor
Wrong for
Teams that need the bill to be predictable month to month
United StatesPer GB of logs analysed per month, published; trial offered; volume discounts from sales
SIEM now sold as Incident Command, in three packages
Ranked #8 of 12 in Best SIEM Software in 2026.
Pricing on requestNorth America
Incident Command combines logs, telemetry and asset context in one view and enriches alerts with exposure, vulnerability and asset risk data. The packages step up from streamlined SIEM with threat hunting in Essentials, to AI triage and deception in Advanced, to endpoint detection and embedded forensics in one agent in Ultimate.
That bundling helps buyers already using Rapid7, but it ties the SIEM to the same vendor's agent, so leaving later means replacing more than the SIEM.
What stands out
Incident Command
Three packages
XDR in top tier
Where it costs you
The product carries two names, InsightIDR in the docs and Incident Command on the sales page, so check which one a quote covers.
No package price is shown; the vendor offers a demo only.
Right for
Teams wanting SIEM, endpoint detection and forensics from one vendor
Wrong for
Buyers who want a published price before talking to sales
United StatesEssentials, Advanced and Ultimate packages; quoted per organisation; demo offered
Azure-native SIEM billed by ingestion, with a separate data lake tier
Ranked #9 of 12 in Best SIEM Software in 2026.
Pricing on requestNorth America
Sentinel inherits the tamper-proofing and immutability practices of Azure Monitor, and its analytics tier supports all log types with full alerting and query.
Commitment tiers run from 100 GB to 50,000 GB a day with savings of up to 52% against pay-as-you-go, and amounts come from Microsoft's cost estimator. Independence is low: you need an Azure environment, and from April 2027 the Defender portal, so exit means rebuilding rules and playbooks elsewhere.
What stands out
Azure-native
Commitment tiers
Data lake tier
Where it costs you
Azure Log Analytics, Logic Apps and other Azure services used with Sentinel are billed separately from the Sentinel meter.
A commitment tier can be raised at any time but lowered only after 31 days, so a mis-sized reservation costs at least a month.
Right for
Organisations that already run workloads in Azure and use Microsoft security tools
Wrong for
Teams wanting a self-run SIEM or a flat per-organisation fee
United StatesPay-as-you-go or daily commitment tiers; separate data lake tier; cost estimator offered
SIEM, SOAR and threat intelligence sold as ingestion-based packages
Ranked #10 of 12 in Best SIEM Software in 2026.
Pricing on requestNorth America
Standard includes the core SIEM and SOAR functions with 12 months of hot retention, more than 700 parsers, over 300 SOAR integrations and one environment with a remote agent. Enterprise lifts that to unlimited environments and adds UEBA and a Gemini investigation assistant.
Enterprise Plus adds applied threat intelligence, BigQuery storage for exports up to your retention period and 12 months of routing to another destination for SIEM migrations, the clearest exit clause in this list.
What stands out
Ingestion-based
SOAR included
12 months hot data
Where it costs you
Rule capacity is capped per package, so growth in detections can force a move to a dearer package.
Prices are available only through sales, and data pipeline management is limited in Standard and Enterprise.
Right for
Organisations wanting SIEM and SOAR in one ingestion-priced package with long retention
Wrong for
Teams that need to compare published prices before contacting sales
United StatesStandard, Enterprise and Enterprise Plus packages based on ingestion; quoted by sales
Splunk's SIEM in Essentials and Premier editions, priced by quote
Ranked #11 of 12 in Best SIEM Software in 2026.
Self-hostablePricing on requestNorth America
Enterprise Security packages SIEM, threat intelligence, Detection Studio and exposure analytics in both editions, and Premier adds SOAR, UEBA and automated threat analysis.
It runs on Splunk Cloud or in self-managed environments, and on the platform pricing page eligible Cisco telemetry counts at a 50% weighted ingest rate. You model the platform and pricing metric yourself, and the supplier is a Cisco subsidiary, so independence from one large vendor is low.
What stands out
Two editions
Cloud or on-premises
Part of Cisco
Where it costs you
SOAR, UEBA and automated threat analysis appear only in the Premier edition column, so the cheaper edition lacks them.
Three pricing metrics are offered and every route ends in a quote, so comparing it with another product needs a sizing exercise.
Right for
Large security teams that already run Splunk for logs and want one vendor
Wrong for
Small teams that need a published price and a short setup
United StatesEssentials and Premier editions; activity, workload or ingest pricing; quoted by sales; cloud or on-prem
On-premises SIEM licensed by events per second or managed servers
Ranked #12 of 12 in Best SIEM Software in 2026.
Self-hostablePricing on requestNorth America
QRadar offers user behaviour analytics, network threat analytics through its NDR product and native support for community Sigma rules, with about 700 prebuilt integrations and partner extensions.
Software and appliances give control of the environment, while subscription and support, including round-the-clock technical support, renews annually. The vendor is IBM Corporation in Armonk, New York, and its pages document no export format, so leaving is a migration project.
What stands out
Appliance or software
Events per second
Sigma rules
Where it costs you
Under the usage model you pay for event and flow rates, so a spike in log volume means a larger licence.
The pricing page gives no amounts, and the options it names are appliances, software and a managed service.
Right for
Regulated organisations that want a SIEM they run in their own data centre
Wrong for
Teams wanting a self-serve cloud SIEM with published pricing
United StatesLicensed by events and flows or by managed servers; subscription or perpetual; quoted by sales; on-premises
Security information and event management software gathers log and event data from across an organisation, correlates it to detect threats, and stores it for investigation, alerting and compliance reporting. Products in this area look alike on a feature list, so we would decide these questions first.
01
Decide whether you need a published price
The split is 4 published against 8 quoted. If you want to compare numbers first, start with Wazuh, Graylog, Elastic Security, Datadog.
02
Look at where the vendor sits
Look at the contracting entity: these 12 vendors sit in 3 countries, split by region as North America 10, Europe 1, Elsewhere 1. The servers can be anywhere; the legal obligations follow the company.
03
Consider whether you want the source
Open source here means Wazuh. The price of self-hosting is the time your team spends maintaining it.
How SIEM vendors count your data
Every SIEM in this list meters something different, and the unit decides what a noisy month costs. Datadog bills per GB of logs analysed, Microsoft Sentinel per ingested GB or a reserved daily commitment, Elastic Security per GB ingested and retained, and Graylog by daily volume with a data lake that stays outside the licence until you retrieve data.
IBM QRadar counts events per second and flows per minute, or managed servers. Google Security Operations sells packages based on ingestion. Securonix describes a consumption model with SOAR and UEBA included. Ask each vendor to price your own log sources rather than a sample, and ask what is counted twice when data is both analysed and archived.
Which unit is metered: ingested, analysed, retained or processed?
What does the quote say for your real daily volume plus a year of growth?
Is archived or lake data counted again when you search it?
Self-run, vendor-run or in between
Wazuh and the self-managed Elastic Security stack are software you run yourself, which buys independence at the cost of staff time. IBM QRadar and the LogRhythm edition of Exabeam keep data in your own data centre on licences or appliances. Microsoft Sentinel, Google Security Operations, Securonix and the cloud platform from Exabeam are delivered as services, where the vendor runs the platform and you rely on its hosting and roadmap.
Splunk Enterprise Security is offered for both cloud and self-managed environments, and Exabeam lets you choose a hosting region at purchase. Count the hours for upgrades, parser fixes, storage planning and incident support before choosing the cheaper licence, because a free or low licence price shifts that cost onto your own team rather than removing it.
Who patches, upgrades and monitors the platform after go-live?
Where is the data stored, and can you choose the region?
What does the vendor charge for support, training and onboarding?
Detection content, SOAR and UEBA: bundled or bought
A SIEM that only stores logs leaves the analyst to write every detection, so check which package carries the content you need. At Splunk Enterprise Security, SOAR, UEBA and automated threat analysis appear only in Premier. Google Security Operations raises its rule limits from 1,000 single-event rules in Standard to 3,500 in Enterprise Plus and adds UEBA from Enterprise.
Securonix states that SOAR, UEBA and analytics carry no separate fee. Rapid7 InsightIDR, sold as Incident Command, adds AI triage and deception technology from Advanced and endpoint detection from Ultimate. Sumo Logic lists SIEM log ingest only in its Enterprise Suite. Match the package to the detections you must run in the first quarter, not to the demonstration.
Which edition holds the SOAR, UEBA and threat intelligence you need?
What are the rule or environment limits per package?
Which detections ship ready to use, and who maintains them?
Exit: getting data and rules back out
Leaving a SIEM means moving years of logs and hundreds of rules. Google Security Operations Enterprise Plus includes BigQuery storage for exports up to your retention period and 12 months of routing to another destination for SIEM migrations, the clearest exit clause here. Wazuh is GPLv2 software that stays with you after any support contract ends.
Datadog Cloud SIEM keeps 12 months of searchable security data and Securonix keeps 365 days always searchable, so the retention window sets how much history you carry across. IBM QRadar supports community Sigma rules natively, which helps rule portability. For every product, ask for the export format, whether export costs extra and how detections are exported.
In what format do logs, cases and rules leave, and at what cost?
How long can you search history before and after a move?
Can detections be exported as Sigma or another open rule format?
What goes wrong most often when buying SIEM software
Pricing a SIEM on a sample of logs, then adding retention, SOAR and cloud connectors after the contract starts.
Buying the cheaper edition without checking which detections, UEBA and automation sit in the higher one.
Forgetting the staff time to run Wazuh or self-managed Elastic Security, or the retention limit of a small cloud tier.
Assuming migration is easy because a vendor imports from competitors; test an export with your own rules before signing.
07
Frequently asked questions
8 answers
What is the best SIEM software in 2026?
First of 12 on this page is Wazuh. Wazuh is the one entry here whose software carries no licence cost: the vendor says so and the code is GPLv2.
The price is your own time, because you install and size the indexer, server and dashboard, or you buy Wazuh Cloud. Its Small cloud tier covers up to 100 active agents and keeps indexed data for one month. The vendor pages state no country of establishment.
Which SIEM tools publish their pricing?
4 of the 12, with the pricing model each one publishes:
Wazuh: Self-hosted software free; Wazuh Cloud tiers published by active agents; 14-day trial.
Graylog: Graylog Open free with no volume cap; Enterprise and Security licences published by daily volume.
Elastic Security: Serverless billed per GB ingested and retained, published; self-managed option; trial offered.
Datadog: Per GB of logs analysed per month, published; trial offered; volume discounts from sales.
The other 8 quote per organisation.
Is there a free SIEM tool?
Graylog have a free plan or free self-hosted edition.
Where are these SIEM software vendors established?
Across 3 countries (North America 10, Europe 1, Elsewhere 1):
Wazuh: Not stated by the vendor.
Graylog: United States.
Elastic Security: Netherlands.
Exabeam: United States.
Securonix: United States.
Sumo Logic: United States.
Datadog: United States.
Rapid7 InsightIDR: United States.
Microsoft Sentinel: United States.
Google Security Operations: United States.
Splunk Enterprise Security: United States.
IBM QRadar: United States.
Which SIEM tools are open source?
Wazuh.
Which SIEM tools can you host yourself?
Wazuh, Exabeam, Splunk Enterprise Security, IBM QRadar. 8 products offer no self-hosted option.
What should you use instead of Wazuh?
The next in line are Graylog, aimed at Operations teams that want a log-specific tool with a free edition and a path to a paid licence, and Elastic Security, aimed at teams with search skills that want per-gigabyte billing and a self-run exit.
Who should not buy Wazuh?
Teams with nobody to run servers and tune detection rules. Running it yourself means you size, patch and monitor the indexer, server and dashboard, and the vendor sells professional support and consulting as separate services..
Vendors who think their SIEM software product should be here can tell us about it: what it does, who it is for. The call is ours, and software advice sets out what being listed means.
