← 02 — Articles

Choosing a SIEM by what you already run

Architecture13 min read

Most SIEM selections start with a feature matrix and end with a platform nobody has time to run. Every product on the shortlist parses logs, runs correlation rules, raises alerts and stores data for a while. The differences that decide whether a SIEM works for you are elsewhere: how cheaply it ingests the logs you produce, and how much engineering time it needs before an alert means anything.

This article compares five platforms through those two lenses — what is already in your infrastructure and how hard the platform is to operate — and maps them to small, mid-size and large organizations. The second article in this set, What a SIEM costs you in people, not licenses, goes platform by platform through the day-to-day work. A condensed decision matrix with every source link is in the armory as siem-selection-matrix.yml.

What this is, and what it is not

This is a reading of vendor documentation as of October 17, 2026, not a benchmark. We have not run all five platforms side by side on the same telemetry, and we do not quote prices except where a vendor publishes them. Licensing in this market changes often — two of the five products changed owner or pricing model in the last two years — so treat every number here as a pointer to the source, not as a quote.

The five platforms:

Platform Vendor Runs where License model
Wazuh Wazuh Self-managed or Wazuh Cloud Open source (GPLv2, Apache 2.0)
Elastic Security Elastic Self-managed, Elastic Cloud, Serverless Free tier plus paid subscriptions
Microsoft Sentinel Microsoft Azure only (SaaS) Pay per GB ingested and stored
QRadar SIEM IBM On-premises, cloud marketplace EPS/FPM or managed servers
Splunk Enterprise Security Splunk (Cisco) Self-managed or Splunk Cloud Ingest or workload based

Before you compare: measure two numbers

Every pricing model and every sizing guide asks the same two questions, so answer them first.

  1. Daily volume, per source. Gigabytes per day for Sentinel, Elastic Serverless and Splunk ingest pricing; events per second (EPS) for QRadar; alerts per second and agent count for Wazuh sizing. Measure it per source type — domain controllers, firewalls, proxies, endpoints, cloud audit logs — because the right answer is often to send different sources to different storage tiers.
  2. Who will run it, in hours per week. Not headcount: hours someone can actually spend on parsers, rule tuning, upgrades and capacity. A platform that needs a full-time engineer is the wrong platform for a team that has four hours a week.

If you already have a log platform, it can usually tell you the first number. In an Azure Monitor or Sentinel workspace, the Usage table records billable volume per table:

Usage
| where TimeGenerated > ago(30d)
| where IsBillable == true
| summarize GBperDay = sum(Quantity) / 1000 / 30 by DataType
| sort by GBperDay desc

In Splunk, the license manager writes usage to _internal:

index=_internal source=*license_usage.log type=Usage
| eval GB = b / 1024 / 1024 / 1024
| timechart span=1d sum(GB) by st

With no log platform yet, take a week of raw logs from a representative sample of each source type and extrapolate. It is crude, and it is still better than the vendor’s sizing questionnaire filled in from memory.

The first filter: where your logs live

Infrastructure eliminates options faster than any feature comparison.

Mostly Microsoft 365, Entra ID and Azure

This is the one case where one platform has a structural cost advantage. Microsoft documents a list of free data sources for Sentinel: Azure Activity logs, Office 365 audit logs (SharePoint, Exchange admin activity, Teams) and security alerts from the Defender products. Raw Defender XDR and Entra ID logs are not free, but Microsoft 365 E5, A5, F5 and G5 customers (and E7, per the current offer page) receive a data grant of up to 5 MB per user per day for Microsoft 365 data such as Entra sign-in and audit logs.

Sentinel is also moving into the Defender portal: after March 31, 2027, it will no longer be supported in the Azure portal. If you already triage incidents in Defender XDR, Sentinel lands in the same queue. Any other SIEM in this estate has to pull the same Microsoft data through APIs and pay to store it.

Mostly on-premises, or air-gapped

Sentinel is a cloud service. On-premises sources reach it through a Linux log forwarder running the Azure Monitor Agent, and a forwarder outside Azure must also run the Azure Arc Connected Machine agent (Microsoft Learn). That works, but every byte of firewall and proxy log becomes a metered ingest charge.

If logs must not leave your network — regulated sectors, operational technology, classified environments — Sentinel and the SaaS editions drop out. Wazuh, self-managed Elastic, QRadar and Splunk Enterprise all run entirely on your own hardware.

Linux, containers and multiple clouds

Wazuh ships cloud monitoring modules for AWS, Azure, Google Cloud, Office 365 and GitHub, plus Docker and Kubernetes monitoring (use cases). Elastic has the broadest catalogue of first-party integrations through Elastic Agent and Fleet. Splunk has the largest third-party add-on ecosystem. None of these has the Microsoft-data cost advantage, and none of them has a cost penalty for being outside Azure.

Network flows are a hard requirement

QRadar is the only platform here that licenses and processes network flows as a first-class data type next to events: its usage model counts events per second (EPS) and flows per minute (FPM) separately (IBM pricing), and its architecture has dedicated Flow Collector and Flow Processor components. The others ingest NetFlow or Zeek data as ordinary logs — which works, but you build the analytics yourself.

The second filter: who will run it

Operational complexity is the cost that never appears on a quote. A rough ranking, from least to most engineering effort for a production deployment, explained in detail in the companion article:

Platform Infrastructure you run Detection language Effort to keep healthy
Sentinel None (SaaS) KQL Low infra, high cost governance
Wazuh (single node) One server XML rules and decoders Low at small scale
Elastic (Serverless) None (SaaS) KQL, EQL, ES|QL Low infra, medium tuning
Elastic (self-managed) Elasticsearch cluster KQL, EQL, ES|QL Medium to high
Wazuh (distributed) Server cluster, indexer cluster, load balancer XML rules and decoders Medium to high
QRadar Console, collectors, processors AQL, rule wizard High, specialist skills
Splunk ES (self-managed) Indexers, search heads, forwarders SPL High, dedicated admin

Two things are worth stating plainly. SaaS removes infrastructure work, not detection work: someone still has to tune rules and keep parsers working. And “free” platforms move the cost from licensing to engineering hours — which is a good trade only if those hours exist.

Small organizations

Working definition: no dedicated security staff. One IT generalist, or a small IT team where security is part of someone’s job. Typically under a few hundred endpoints.

Microsoft-centric: Sentinel

If identity and email live in Microsoft 365 and you already pay for Defender products, Sentinel is the shortest path to a working SIEM. You run no servers, the free data sources cover a large share of what a small company needs to watch, and an E5-class license grant offsets Entra ID logs. The free trial waives charges for the first 10 GB per day for 31 days, which is enough to measure your real volume before you commit.

The trap is volume you did not plan for. Pointing a chatty firewall at a Sentinel forwarder without filtering is the usual way a small Sentinel bill doubles. Decide per table whether it belongs in the analytics tier or the cheaper data lake tier before you connect it.

On-premises or budget-constrained: Wazuh

Wazuh is free, and a single all-in-one host covers small fleets. The quickstart requirements for 90 days of indexed data are:

Agents CPU RAM Storage (90 days)
1–25 4 vCPU 8 GiB 50 GB
26–50 8 vCPU 8 GiB 100 GB
51–100 8 vCPU 8 GiB 200 GB

What makes Wazuh fit small teams is that it is more than log correlation: the agent also does file integrity monitoring, configuration assessment against hardening benchmarks, vulnerability detection and active response. For a company without an EDR budget, that agent covers ground a pure SIEM does not. The cost is time: the out-of-the-box rules are noisy in most environments, and tuning them means writing XML.

What does not fit small teams

Elastic sits in between. Elastic Cloud Serverless lists Security Analytics Essentials from $0.09 per GB ingested and $0.017 per GB retained per month (pricing page, “as low as”), and as of March 23, 2026 there is no per-endpoint fee. That can be competitive for a small Linux-heavy shop, but someone needs to be comfortable with Elastic’s query languages and index model.

Mid-size organizations

Working definition: a small security team, or one or two people plus a managed security service provider (MSSP). Hybrid infrastructure: some cloud, some on-premises, more log sources than one person can keep in their head.

This is where the decision is genuinely open, and where infrastructure matters most.

Microsoft-heavy hybrid: Sentinel with tiered storage

Sentinel’s data model now has two tiers. The analytics tier keeps data queryable at full performance for 90 days by default (extensible to two years); the data lake tier is meant for high-volume, lower-value logs — firewall, proxy, NetFlow, storage access logs — at a lower price, queried on demand (log retention tiers). Getting this split right is the main lever on cost. Analytics-tier commitment tiers start at 100 GB per day; below that you pay as you go.

Mixed or non-Microsoft: Elastic, or Wazuh plus a SIEM

Elastic fits mid-size teams that have, or want, search engineering skills. The self-managed free tier gives you the Security app, the detection engine with prebuilt rules and Elastic Defend malware protection. The paid features are the ones mid-size teams start to miss: alert suppression needs Platinum or higher (Elastic blog), alerting on machine-learning anomaly detection is limited to Platinum and Enterprise (subscriptions), ransomware, memory-threat and malicious-behavior protection need a Platinum or Enterprise license, and response actions are Enterprise-only (Elastic Defend docs). Cheap long retention on self-managed clusters relies on searchable snapshots, which also require an Enterprise license. Elastic’s subscription page currently notes that Platinum is no longer offered to new customers, so check what tier you can actually buy.

Wazuh scales to mid-size with a distributed deployment — a Wazuh server cluster behind a load balancer and a multi-node indexer — but each layer is now something you operate. A common and reasonable pattern at this size is to keep Wazuh as the endpoint agent (integrity, configuration, vulnerability data) and forward its alerts into the SIEM the analysts actually work in.

When Splunk or QRadar make sense at mid-size

Both are defensible if you already own them, have staff who know SPL or AQL, or work through an MSSP that runs them for you. Buying either fresh for a mid-size estate without that context means paying for capacity and expertise you will spend the first year growing into.

Large organizations

Working definition: a 24/7 security operations center (SOC), dedicated detection engineers, a platform or data team, and log volumes measured in hundreds of gigabytes or terabytes per day.

At this size every platform here can work, and the choice is driven by three questions: data residency, existing estate and the skill set of the team you have.

Splunk Enterprise Security

Splunk’s strengths are maturity, the Search Processing Language (SPL) and the size of its ecosystem. Enterprise Security 8 introduced a unified threat detection, investigation and response workflow and pairs with Splunk SOAR, including on-premises SOAR since 8.1 (release notes). Its documented minimum of 16 physical cores and 32 GB of RAM applies to every search head and indexer, so even a modest production deployment is several large machines. Pricing is either ingest-based (GB per day) or workload-based (compute: Splunk Virtual Compute units in Splunk Cloud, vCPUs on-premises), and Splunk Cloud also offers an activity-based model (pricing models). Workload pricing is the one to model if you ingest a lot but search a narrow slice of it. Splunk has been part of Cisco since March 18, 2024.

Microsoft Sentinel at scale

For a large Microsoft estate, Sentinel’s main argument is the same as at small scale — integration with Defender XDR and the free Microsoft data — plus no infrastructure to scale. Higher commitment tiers lower the effective price per GB, and the data lake tier keeps compliance retention out of the analytics price. The cost-control discipline (per-table tiering, transformation rules, volume alerts) needs an owner.

IBM QRadar

QRadar’s case is strongest for organizations that already run it, that need network flow analysis as a core capability, or that require on-premises appliances. Two facts matter for a new purchase. First, IBM sold the SaaS QRadar products to Palo Alto Networks in September 2024; Palo Alto lists April 14, 2026 as the end-of-life date for QRadar on Cloud and steers those customers to Cortex XSIAM, and states that on-premises QRadar is not affected. Second, IBM continues to develop the on-premises product: QRadar 7.6.0 was announced on June 30, 2026 (IBM Community), and IBM notes QRadar Incident Forensics is not available in the 7.6.x stream. Ask IBM for the support lifecycle of the version you would deploy before you sign.

Elastic at scale

Large self-managed Elastic deployments are common, particularly where a platform team already runs Elasticsearch for observability. Hot, warm, cold and frozen data tiers make multi-year retention affordable, but frozen-tier economics depend on the Enterprise license, and running a large cluster is a full-time job.

Wazuh at scale

Wazuh can run in large estates as a distributed deployment, and as an endpoint telemetry and compliance layer it is often the most cost-effective option at any size. As the primary SIEM for a large SOC, plan honestly for the engineering: you will build case management, enrichment and much of the correlation logic yourself.

How to test your shortlist

Do not decide from documentation alone — including this article. A proof of concept that tells you something:

  1. Pick two candidates, not five. Use the filters above to narrow down.
  2. Feed the same three sources into both: your domain controllers (or Entra ID sign-ins), your perimeter firewall, and endpoint telemetry from a sample of machines.
  3. Run for at least two weeks, so Monday-morning logon storms and weekly jobs show up in the volume and the alert counts.
  4. Measure, do not estimate: ingested GB per day per source, alerts per day before and after one round of tuning, and the hours the team actually spent.
  5. Write one detection in each platform for the same behavior, and compare how long it took and how many false positives it produced.

Every candidate has a way to do this cheaply: the Sentinel 31-day free trial, Elastic trials and Serverless pay-as-you-go, Splunk trials, QRadar Community Edition for skills testing, and Wazuh at no license cost.

Limitations

  • Prices, tiers and grants change faster than articles. Every figure links to its source; check it on the day you decide.
  • This is not a detection-quality comparison. We do not rank out-of-the-box content, because its usefulness depends almost entirely on your environment and your tuning.
  • We left out platforms outside this shortlist — Google Security Operations, Cortex XSIAM, CrowdStrike Falcon Next-Gen SIEM, OpenSearch Security Analytics, Graylog and others. Their absence is not a verdict.

Adapting this to your environment

  • ADAPT the size definitions to your team, not your headcount. A 2,000-person company with one security engineer should read the small section.
  • ADAPT the infrastructure filter to where your highest-value logs live — identity, endpoints, perimeter — not where most of your servers are.
  • ADAPT the cost model: compare platforms on your measured GB per day, split into primary and secondary data, and add the engineering hours.

The full decision matrix — size definitions, infrastructure filters, per-platform facts and source links — is in siem-selection-matrix.yml (CC BY 4.0). If something here is out of date or wrong, write to hello@entropywatch.dev and we will correct it in the open.