I'm looking into different siem tools for our small team and the pricing is all over the place. Some vendors won't even give a straight answer without a call. Just trying to get a rough idea of what people are paying or what's worth it before wasting time with demos. Any tips or ballpark numbers would help.
Rough numbers from clients, per month, small team:
Self hosted Wazuh or Graylog: just the server, so 100 to 400 depending on retention
Sentinel: wildly variable, 300 to several thousand, it is per GB and the GB add up faster than anyone predicts
Splunk: if you are asking about price you are not the customer
Smaller commercial platforms: 100 to 1000
The thing that catches people is that the licence is not the cost. The cost is the person who runs it.
Insist on a price per GB per day and a retention figure before any demo. Every vendor can answer that in one line and the ones who will not are telling you something.
Also ask what happens when you exceed your tier mid month. Some throttle, some silently drop, some bill you. That difference matters more than the headline number.
We got quoted 4x our budget by one of the big ones, then the same rep called back in December with 60% off. The whole thing is theatre. Get three quotes and make sure they know there are three.
That matches what I have been seeing. This is more useful than the last two weeks of vendor calls.
the ones that wont give you a number without a call are the expensive ones. that is the whole tell, you can skip the call