Buying SIEM

Buyer's guide.

Evaluation criteria

Ingestion volume capacity. Match to expected log sources at peak.

Pricing model: per-GB ingest, per-host, per-event. Different models suit different workloads.

Detection content: rule library, ML detection, threat intelligence integration.

Major options

Splunk: mature; expensive; deep customisation. Industry standard at large enterprises.

Datadog Security: integrated with Datadog observability. Best for Datadog-heavy shops.

Microsoft Sentinel: cloud-native; tight Azure integration; competitive pricing.

Elastic SIEM: open-core; lower cost; mature. Fit for teams already on Elastic.

Integration requirements

EDR integration. Endpoint detection feeds SIEM for correlation.

Cloud audit logs. CloudTrail, Azure Monitor, GCP Cloud Audit. Critical for cloud-heavy environments.

Identity provider logs. Failed authentications, privilege changes, account lifecycle.

Operating costs

License is the headline cost. Operations adds 20-50% on top: tuning, content authoring, alert triage.

SOC team cost. SIEM without analysts watching is half-deployed.

Quarterly tuning. False positives reduced; new detection content added.