SIEM as a Service with 24/7 SOC: Managed SIEM Pricing and What Is Included

SIEM as a Service gives you centralised log collection, 12-month searchable retention, correlation rules and a 24/7 SOC that investigates what the SIEM finds, for a fixed monthly price instead of a six-figure platform project. ITSecOps runs SIEM as a Service on Microsoft Sentinel or the Sophos XDR data lake, monitored from Norway and India. Because we hold partnerships with every industry-standard vendor, the platform licence comes at partner pricing, cheaper than buying direct.

Updated September 4, 2026. The August 2026 Microsoft Entra ID vulnerability (CVE-2026-69836, unauthenticated remote code execution) and the Zimbra CVE-2026-73570 campaign that compromised at least 274 servers were both found first in sign-in and server logs, not by endpoint agents. Companies without log retention could not even tell whether they were affected. That is the gap a managed SIEM closes.

Managed SIEM pricing: what it actually costs in 2026

Managed SIEM pricing is the most searched question in this category, and most providers hide it. Here is the honest structure. Cost has three parts: the platform (priced per gigabyte of logs ingested per day or per device), the SOC service (priced per device or as a flat monthly fee) and one-time onboarding.

Compare that with an in-house SIEM: a platform licence of $20,000 to $60,000 per year, a dedicated engineer at $90,000 or more, and 6 to 9 months to reach useful detection coverage. Our 24/7 SOC monitoring cost guide has the full managed-versus-in-house comparison, and the cybersecurity price comparison lists platform prices side by side.

What is included

Custom-built open source SIEM: the answer above 50 GB per day

If you ingest more than about 50 GB of logs per day, every per-gigabyte SIEM (Microsoft Sentinel, Google Security Operations, SentinelOne Singularity Data Lake, Splunk, Sumo Logic) starts costing more than the analysts watching it. ITSecOps builds and runs a customised open source SIEM for exactly that situation: Wazuh or Elastic/OpenSearch for detection and search, hot storage sized for 90 days, object storage for 12 months or more, MITRE ATT&CK detection content we maintain, and the same 24/7 SOC on top. You pay for infrastructure and our service, not per gigabyte, which is what slashes the yearly cost.

What “custom-built” means in practice: log sources normalised to a common schema, noisy sources filtered before they are stored, detection rules mapped to MITRE ATT&CK and tuned to your environment, dashboards for auditors (NIS2, ISO 27001, CMMC, SOC 2), and immutable retention for evidence. It runs in your cloud (Azure, AWS, Hetzner, a Norwegian data centre) or ours, and nothing leaves your tenancy without your approval. Below 50 GB per day, Microsoft Sentinel with free Microsoft 365 connectors is usually still the cheapest option, and we tell you so.

SIEM or MDR: which do you need first?

If you have neither, start with MDR: it stops attacks on the endpoint and identity, where most incidents begin. Add SIEM as a Service when you need retention and reporting across every system, which usually means NIS2, CMMC, HIPAA or ISO 27001 obligations, more than about 100 endpoints, or an incident where you could not answer “what happened”. Many clients run both from ITSecOps under one contract, and the Security Stack Recommender tells you which applies to you.

Frequently asked questions

How much does a managed SIEM cost per month?

For a company with 25 to 50 endpoints on Microsoft 365, $450 to $900 per month including the platform and 24/7 SOC. Costs scale with log volume, not headcount, which is why we start every quote with a log-volume estimate.

Is Microsoft Sentinel cheaper than other SIEMs?

For Microsoft 365 companies, usually yes. Microsoft 365 audit, Entra ID sign-in and Defender alerts are ingested free of charge, and Microsoft 365 E5 tenants get a daily data grant. Non-Microsoft sources are billed per gigabyte, which we control with filtering and commitment tiers.

Can you use our existing SIEM?

Yes, for Sentinel, Sophos XDR, Elastic and Wazuh. We take over tuning and monitoring rather than migrating you.

Do you provide SIEM to MSPs under white label?

Yes. MSPs resell our SIEM as a Service and 24/7 SOC under their own brand. See white-label MSP support.

What evidence do I get for auditors?

Monthly reports, retention proof, detection rule inventory and incident timelines mapped to ISO 27001, SOC 2, NIS2 and CMMC control identifiers.

When is an open source SIEM cheaper than Microsoft Sentinel or Splunk?

Above roughly 50 GB of ingestion per day. Per-gigabyte pricing grows linearly with volume, while a custom open source SIEM (Wazuh, Elastic or OpenSearch) costs infrastructure plus a fixed service fee, so at 100 GB per day the saving is typically 55 to 65 percent and at 250 GB per day 65 percent or more.

Is an open source SIEM good enough for compliance?

Yes when it is built and operated properly: immutable retention, MITRE-mapped detections, audit dashboards and a 24/7 SOC. Auditors care about evidence, retention and monitoring, not the vendor logo.

Which open source SIEM do you build on?

Wazuh for endpoint-centric environments and compliance modules, Elastic or OpenSearch for high-volume search and custom pipelines, often combined. We choose per environment after seeing your log sources and volume.