Cloud SIEM: Architecture, Pricing, and Hidden Costs

A cloud SIEM is a security information and event management platform that runs on cloud infrastructure, usually as a service the vendor operates. The customer stops buying indexers and storage arrays, and pricing usually tracks usage: GB ingested, GB scanned, events analyzed, or compute time. Some products move an on-prem architecture onto hyperscaler infrastructure, and others let storage and compute scale on their own, so data can sit in cheap tiers until someone queries it.

Buyers comparing cloud SIEMs usually want to know what the quote leaves out. Vendors lead with ingest pricing, while later costs sit in query scans, long retention, cross-region transfer, and the people who run the platform.

This guide covers how to tell the two architectures apart, how the major vendors price, where costs grow after signing, what retention rules require, and which scaling and migration limits remain. Whether you need a SIEM at all is a separate decision, and some teams choose SIEM alternatives; this guide assumes you are buying one.

TL;DR:

• Gartner's SIEM deployment options don't define how a hosted design differs from one rebuilt for the cloud, so the useful test is whether storage and compute scale independently.
• Ingest is the headline price; scan charges, restores, extra retention, data transfer, and staff time often decide the total.
• Storage and ingest scale in the cloud, but query concurrency, rule counts, and ingestion rates still hit quotas, and some rise only through a support request.
• Lock-in lives in detection content and data formats, so budget for rewriting rules and running two platforms side by side before you sign.

Hosted Cloud SIEM vs. Decoupled Cloud SIEM

A hosted cloud SIEM runs the on-prem design on someone else's infrastructure, which Exabeam says is typically a lift-and-shift of on-premises systems. A decoupled cloud SIEM runs analytics and storage as separate services, the model Microsoft uses for the Sentinel data lake. Treat the two as ends of a spectrum: many products sit between them, and a decoupled design does not always mean separate charges on your bill.

Gartner doesn't draw the line. It lists "cloud-hosted, cloud-native or SaaS" among SIEM deployment options without saying what separates them. In April 2025, industry analyst Francis Odum argued that most SIEMs sold as built for the cloud are lift-and-shift deployments on hyperscalers or products built on Snowflake or Databricks.

A hosted model can still be the right purchase. ManageEngine, which sells SIEM, says it works for a stable, mostly on-premises environment with predictable log volume and a team comfortable managing SIEM infrastructure.

How Storage, Compute, and Indexing Are Coupled

Jack Naglieri, who founded Panther, names the tight coupling of storage, compute, and indexing as the main cost driver in SIEM, because it forces teams to choose what to retain. CrowdStrike markets an index-free architecture for Falcon Next-Gen SIEM, built on CrowdStrike's LogScale technology, while Naglieri describes Humio, the company behind LogScale, as a tightly coupled storage and compute model, so ask CrowdStrike how the current service is built.

Storage Format and Tiering

Many vendors expose decoupling to the buyer through tiers. The Sentinel data lake stores data as open-format Parquet files with storage separated from compute, and it sits beside a separate analytics tier. Datadog offers Flex Logs next to standard indexing, and Panther deploys each customer into a dedicated AWS account backed by a Snowflake or Databricks data lake. Additional tiers can introduce separate meters: Microsoft lists separate lake charges for ingestion, storage, and analytics, and each one is a line you have to model.

Where Detection Rules Run

Detection latency depends on the rule type more than on the platform label. Sentinel near-real-time rules run every minute with a two-minute delay, and scheduled rules carry a five-minute built-in delay. Test each rule type against your latency requirement before you compare prices, especially if your program depends on streaming correlation.

How Cloud SIEM Pricing Works

On-prem, SIEM spend goes into indexers and storage sized for peak ingest and search plus a license; a cloud SIEM turns it into metered usage. Most cloud SIEMs still meter ingest, and only some publish what they charge. The table lists each vendor's own pricing unit and its published list price, where one exists, as of October 2026.

‍

Sentinel's commitment tiers save up to 52% against pay-as-you-go, with conditions. Tiers apply per workspace and cannot be pooled, and a tier can be lowered at most once every 31 days. The discount covers analytics-tier ingestion only, not retention or lake charges.

Splunk publishes no universal dollar rate for Cloud Platform or Enterprise Security. Ask for a dated quote that names the license model, contracted capacity, storage entitlement, and Enterprise Security charges.

On AWS Marketplace, Panther's Cloud Connected offering costs $50,000 for a 12-month contract covering 1 TB/month of ingestion and one year of retention, and the customer pays separately for the AWS and Snowflake infrastructure it runs on. Panther's own pages describe both compute-based pricing and a platform fee plus licensing model; ask which one your quote uses.

Cloud sources can also push volume past the estimate, and ingesting them can be cost-prohibitive from the first source onward. Size cloud audit logs such as AWS CloudTrail from a sample of real traffic before you sign.

Where the Bill Grows After the Quote

Four charges recur after signing: query scans, restores, data transfer, and staff time. The first two grow because cheap storage moves cost to query time, where it often goes unpriced until someone runs a long hunt.

1. Scan-Based Search Charges

Sentinel bills low-cost-tier queries per GB scanned whether or not a workspace has joined the data lake. On older workspaces, Basic and Auxiliary tables bill on data scanned, so a query over three days of a 100 GB/day table bills 300 GB. Lake onboarding swaps the older search, long-term retention, and Auxiliary meters for lake meters, including a query charge of $0.005 per uncompressed GB scanned in East US.

Narrowing the query's time range is the main way to cut that charge. Splunk's workload pricing scales the same way, with search quantity and complexity as well as daily indexing volume.

2. Archive Restores

Bringing archived data back has its own limits and charges. Splunk Cloud's archive subscription includes restore capacity equal to 10% of your searchable storage entitlement, and restored data stays searchable for up to 30 days. Restores that push you past the entitlement may incur a true-up cost. On workspaces not yet onboarded to the lake, Sentinel search jobs bill per GB scanned for each day of data the search covers, and the results land in a new table billed at the standard analytics ingestion rate.

3. Data Transfer and Egress

Shipping logs across regions or clouds adds transfer fees. Azure charges $0.02/GB between regions within North America or Europe, and AWS charges $0.01 to $0.02/GB between its US and European regions. Internet egress costs more on both, close to $0.09/GB for the first 10 TB a month after a small free allowance.

4. Staff Time

Blumira, a SIEM vendor, models a three-year cost for a 200-employee organization running a Sentinel-class cloud SIEM at $90,000 to $300,000 in license and $375,000 to $750,000 in staffing for one to two full-time employees. Labor is the larger line in that vendor-built model, so ask what headcount a quote assumes.

How Retention Tiers Change the Cost

On-prem, retention is capped by the disk you buy. In the cloud it becomes a monthly per-GB rate set by the tier, and a lake tier cuts that rate sharply, as Sentinel's pricing shows. Sentinel includes 90 days of analytics-tier retention at no charge and bills lake storage at 6:1 compression. The analytics tier extends to two years, and the lake tier holds data for up to 12 years. Raw logs dumped into cold storage become expensive to analyze during an incident, Naglieri warns.

Take a constant 100 GB/day and a one-year retention requirement. The 275 days beyond the included window add 27,500 GB, or about 4,583 billed GB in the lake after compression. At Microsoft's list price of $0.023 to $0.026 per GB per month, depending on region, that is roughly $1,265 to $1,430 a year at steady state, before ingestion, processing, and query charges. In the analytics tier, at Azure Monitor's retention rate of $0.10 per GB per month with no compression, the same data costs roughly $33,000 a year.

Included retention varies widely. Splunk Cloud ingest plans include up to 90 days of searchable storage, with archive storage sold as an optional subscription. Google Security Operations includes one year. CrowdStrike's AWS Marketplace listing bundles 13 months of retention, while the company's 2024 guidance gives a seven-day default for other packages, extendable to 36 months with additional licensing.

The common compliance frameworks rarely force long hot retention. PCI DSS v4.0.1 Requirement 10.5.1 calls for at least 12 months of audit log history. At least the most recent three months must be "immediately available for analysis." HIPAA's six-year rule in 45 CFR 164.316 covers required policies, procedures, and records and does not name audit logs. NIST SP 800-53 control AU-11 leaves the retention period to the organization.

Federal agencies now face a lighter rule than before. OMB's M-26-14, issued in May 2026, requires logs to stay searchable for six months and retrievable for a year, and it rescinded the stricter M-21-31 rules as neither operationally feasible nor cost-effective for most agencies. Longer hot retention outside these rules may still come from internal policy, contracts, or sector regulation. Trace each requirement to its source before paying analytics-tier rates for it.

Scaling: Elastic Ingest, Limited Query Capacity

Cloud SIEM scales storage and ingest buffering far better than on-prem hardware, but queries and rules still have fixed limits. On-prem sizing rests on daily ingest and concurrent search load, and Splunk's current Enterprise Security reference tests a 300 GB/day deployment on three indexers and tells customers to add indexers as search load and concurrency grow. Cloud platforms trade that hardware problem for quotas:

• Sentinel allows five concurrent queries per user on analytics tables and rejects queries that wait in the queue longer than three minutes. Its workspace ingestion limit is soft, and raising it takes a support request.
• Sentinel allows 512 enabled scheduled rules per workspace, and raising the ceiling to 1,024 requires a dedicated cluster and a support ticket.
• Splunk Cloud sets a standard search concurrency limit of 400 for its largest entitlements, and going higher usually means tuning workloads or buying more capacity.
• Google Security Operations allows 180 simultaneous queries per tenant in each of two pools, one for simple queries and one for complex ones. Push-based senders that exceed burst limits receive HTTP 429 errors and lose data if set to "drop on failure," while pull-based ingestion buffers for up to 90 days.

Test them in the proof of concept, since public documentation says little about how they behave during an incident surge. The table below summarizes how the three models compare across this guide; the on-prem column reflects general practice.

‍

Migration and Lock-In Trade-Offs

Detection content usually gets rebuilt in a migration. Microsoft's SIEM migration tool maps Splunk and QRadar detections to built-in Sentinel and Defender rules and leaves the rest to manual translation, and Google positions its SPL-to-YARA-L translator as a starting point for that work.

Decryption Digest estimates six to 12 months for a mid-size enterprise moving from Splunk to Sentinel, with Splunk kept read-only for one to two years afterward. Price the rule rebuild and the parallel run into the purchase.

Vendors can also force a move on their own schedule. Microsoft will stop supporting Sentinel in the Azure portal after March 31, 2027, leaving it in the Defender portal only, and Google moved its legacy SOAR API deadline to the same date. QRadar on Cloud, one of the SaaS products Palo Alto Networks acquired from IBM, reached end of life on April 14, 2026.

Data formats are the other lock-in point. Naglieri argues that SIEMs built on an open data layer emerged as a reaction to closed SIEM ecosystems. Keeping raw data in an open format you control lowers the cost of leaving.

How to Evaluate a Cloud SIEM

Architecture fit depends more on your query patterns and staffing than on the ingest rate:

1. If your log volume is stable and your environment is mostly on-prem, a hosted model may be enough, since you pay for decoupled architecture you won't use.
2. If firewall, proxy, NetFlow, or TLS certificate logs dominate your volume, require a low-cost tier and get its scan pricing in writing. Microsoft names these high-volume sources as the best fit for its data lake tier.
3. If your team hunts regularly across long time ranges, give scan charges their own line next to ingest and price them against your real query patterns.
4. If you can't forecast volume confidently, model the cost at current volume and at 30% and 50% above it, and ask how overage is billed during an incident.
5. If you lack data engineers and detection engineers, avoid a self-built decoupled stack, since Naglieri says decoupled models need expert infrastructure and data engineers, and consider a co-managed model or a managed service.
6. If PCI DSS is your strictest retention driver, keep 12 months of history with the latest three months immediately searchable, and tier older data only after you confirm you can retrieve and analyze it.
7. If legal review blocks sending real logs to a trial, budget that time into the evaluation.

Test these answers in the proof of concept, using production-shaped data and real hunts.

Storage and Investigation Are Becoming Separate Purchases

Vendors increasingly sell storage and analysis separately. Microsoft prices Sentinel's lake tier apart from its analytics tier, and Splunk sells Federated Search for Amazon S3 to query data where it sits. Cheap lake storage still leaves someone to investigate the data, and who that should be is central to the security data lake debate.

Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its MDR customers can keep telemetry in the Agentic Security Data Lake, which Daylight's AI agents and security experts also use for investigations, with older data moving to customer-owned, open-format cold storage.

Frequently Asked Questions About Cloud SIEM

How Does Sentinel Bill Usage Beyond a Commitment Tier?

Usage above a commitment tier bills at the tier's discounted rate and does not fall back to pay-as-you-go. With several workspaces, one can run over its tier while another leaves discount unused, so model each workspace's tier on its own.

How Does a Cloud SIEM Behave When Ingest Spikes During an Incident?

It depends on the ingestion path. In Sentinel, Azure Monitor drops some data once a workspace passes its ingestion threshold, and the Logs Ingestion API throttles a data collection rule above 2 GB per minute and tells senders to retry later, though it may absorb gradual increases. Ask each vendor to put surge behavior for each ingestion path in writing.

Will Sigma Make Our Detections Portable?

Partly. Writing rules in Sigma, an open detection-rule format, keeps the logic portable, but translation and field mapping still need careful handling on each platform. A playbook that references one field name can fail silently once the new SIEM renames it. Anton Chuvakin of Google Cloud reports hearing that LLM-assisted rule conversion has a mixed track record at best.

Can Detection Rules Run on Data in the Low-Cost Tier?

Not in real time on Sentinel. Microsoft puts analytics rules on the analytics tier and positions the data lake tier for hunting, background search, and KQL jobs that summarize high-volume logs back into the analytics tier. A source you route to the lake can still feed detections through those summaries. Decide which fields need near-real-time rules before you pick its tier.

Does Choosing an EU Region Settle Data Residency?

Not fully. A region choice may not cover metadata, support tickets, billing records, or AI processing pipelines, which are common residency gaps. Google Security Operations offers regional data location and customer-managed encryption keys. Ask each vendor which supporting services process data outside the region you selected.