# ============================================================================= # SIEM selection matrix — Wazuh, Elastic Security, Microsoft Sentinel, # IBM QRadar SIEM, Splunk Enterprise Security # # Companion to: # https://entropywatch.dev/articles/choosing-a-siem-by-what-you-run/ # https://entropywatch.dev/articles/siem-operating-cost-in-people/ # License: CC BY 4.0 — ENTROPY//WATCH # Facts as of: 2026-10-17 (vendor documentation; every fact carries its source) # # BEFORE YOU USE # - This is a reading of vendor documentation, not a benchmark. Re-check every # linked source on the day you decide: prices, tiers and grants change often. # - ADAPT size_tiers to your security team's capacity, not company headcount. # - ADAPT the filters to where your highest-value logs live (identity, # endpoints, perimeter), not where most of your servers are. # - Prices appear only where the vendor publishes them; "not published" means # ask for a quote. # ============================================================================= as_of: 2026-10-17 measure_first: - metric: daily_volume_per_source unit: "GB/day (Sentinel, Elastic Serverless, Splunk ingest), EPS/FPM (QRadar), alerts/s + agents (Wazuh)" how: "Measure per source type (DCs or Entra sign-ins, firewall, proxy, endpoints, cloud audit) for at least one week." - metric: engineering_hours_per_week how: "Hours someone can really spend on parsers, tuning, upgrades and capacity — not headcount." size_tiers: small: definition: "No dedicated security staff; one IT generalist or security as part of an IT role." microsoft_centric: Microsoft Sentinel on_prem_or_zero_budget: Wazuh (single node) linux_or_multi_cloud_with_search_skills: Elastic Security (Serverless Essentials) avoid: - "Splunk Free as a SIEM: no alerting, no users or roles, 500 MB/day." - "Splunk ES: documented minimum 16 physical cores / 32 GB RAM per search head and indexer." - "QRadar Community Edition in production: 3-month license, 100 EPS / 5,000 FPM." mid_size: definition: "Small security team, or one or two people plus an MSSP; hybrid infrastructure." microsoft_heavy_hybrid: "Microsoft Sentinel with analytics tier for primary data, data lake tier for verbose logs" mixed_or_non_microsoft: "Elastic Security (check which paid tier you can buy), or Wazuh as endpoint layer feeding a SIEM" splunk_or_qradar_when: "Already owned, staff know SPL/AQL, or an MSSP runs it" large: definition: "24/7 SOC, detection engineers, platform/data team; hundreds of GB to TB per day." deciding_questions: - "Must data stay on-premises or in a specific jurisdiction?" - "Which estate dominates: Microsoft, Cisco/Splunk, IBM, or mixed?" - "Which query language does the current team already know: KQL, SPL, AQL, ES|QL?" candidates: - Splunk Enterprise Security - Microsoft Sentinel - IBM QRadar SIEM (existing estates, network flows, on-prem appliances) - Elastic Security (especially where Elasticsearch already runs) - Wazuh (endpoint/compliance layer; primary SIEM only with strong engineering) infrastructure_filters: microsoft_365_entra_azure: favors: Microsoft Sentinel why: "Free data sources (Azure Activity, Office 365 audit, Defender alerts); M365 E5/A5/F5/G5/E7 grant up to 5 MB/user/day." air_gapped_or_data_must_stay_on_prem: excludes: [Microsoft Sentinel, Elastic Serverless, Splunk Cloud Platform] remaining: [Wazuh, Elastic self-managed, IBM QRadar SIEM, Splunk Enterprise] network_flows_first_class: favors: IBM QRadar SIEM why: "Licenses and processes flows (FPM) separately from events (EPS); dedicated Flow Collector/Processor." linux_containers_multi_cloud: neutral_options: [Wazuh, Elastic Security, Splunk Enterprise Security] platforms: wazuh: current_version: "4.14.x" license: "GPLv2 and Apache 2.0" deployment: "Self-managed (server, indexer, dashboard, agents) or Wazuh Cloud" detection_language: "XML rules and decoders; custom rule IDs 100000-120000" sizing_single_host_90_days: - { agents: "1-25", cpu: "4 vCPU", ram: "8 GiB", storage: "50 GB" } - { agents: "26-50", cpu: "8 vCPU", ram: "8 GiB", storage: "100 GB" } - { agents: "51-100", cpu: "8 vCPU", ram: "8 GiB", storage: "200 GB" } indexer_node: { min_ram: "4 GB", min_cpu: 2, rec_ram: "16 GB", rec_cpu: 8 } beyond_100_agents: "Distributed deployment: server cluster behind a load balancer, multi-node indexer" upgrades: "Server, indexer, dashboard must match to patch level; agents must not be newer than the server" ops_effort: "Low at small scale; medium to high distributed" sources: - https://documentation.wazuh.com/current/quickstart.html - https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/index.html - https://documentation.wazuh.com/current/user-manual/wazuh-server-cluster/index.html - https://documentation.wazuh.com/current/user-manual/ruleset/rules/custom.html - https://documentation.wazuh.com/current/upgrade-guide/compatibility-matrix/index.html - https://documentation.wazuh.com/current/getting-started/use-cases/index.html elastic_security: license: "Elastic License 2.0, SSPL 1.0, or AGPLv3 (AGPL option added 2024-08-29) for the free source" deployment: "Self-managed, Elastic Cloud Hosted, Elastic Cloud Serverless" detection_language: "KQL, EQL, ES|QL" paid_feature_gates_self_managed: - "Elastic Defend ransomware, memory threat, malicious behavior protection: Platinum or Enterprise" - "Response actions and response console: Enterprise" - "Alert suppression: Platinum or higher" - "Alerting on ML anomaly detection: Platinum or Enterprise" - "Searchable snapshots (frozen tier): Enterprise" - "Platinum not available to new customers (per subscriptions page footnote)" serverless_pricing_as_low_as: essentials: { ingest_per_gb: "$0.09", retention_per_gb_month: "$0.017" } complete: { ingest_per_gb: "$0.11", retention_per_gb_month: "$0.019" } per_endpoint_fee: "None since 2026-03-23" ops_effort: "Low infra on Serverless; medium to high self-managed" sources: - https://www.elastic.co/subscriptions - https://www.elastic.co/pricing/serverless-security - https://www.elastic.co/docs/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend - https://www.elastic.co/guide/en/elasticsearch/reference/current/searchable-snapshots.html - https://www.elastic.co/blog/elastic-security-detection-engineering - https://www.businesswire.com/news/home/20240829537786/en microsoft_sentinel: deployment: "SaaS on Azure; on-prem sources via Linux forwarder with Azure Monitor Agent (+ Azure Arc outside Azure)" portal: "Azure portal support ends 2027-03-31; Defender portal only after that" detection_language: KQL billing: analytics_tier: "Pay-as-you-go or commitment tiers from 100 GB/day; tier can be lowered every 31 days" analytics_retention: "90 days included, extensible to 2 years" data_lake_tier: "Per-GB ingestion, processing, storage (6:1 compression basis) and query meters" free_trial: "First 10 GB/day free for 31 days" free_sources: "Azure Activity, Office 365 audit (SharePoint, Exchange admin, Teams), Defender/Entra ID Protection alerts" m365_grant: "Up to 5 MB/user/day of Microsoft 365 data for E5/A5/F5/G5 (and E7)" extra_costs: "Logic Apps (automation), Azure Functions (some connectors)" ops_effort: "Low infra; ongoing cost governance" sources: - https://learn.microsoft.com/en-us/azure/sentinel/billing - https://learn.microsoft.com/en-us/azure/sentinel/log-plans - https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-ama - https://azure.microsoft.com/en-us/pricing/offers/sentinel-microsoft-365-offer ibm_qradar_siem: current_version: "7.6.0 (announced 2026-06-30)" deployment: "On-premises hardware or virtual appliances; All-in-One or distributed (Console, Event/Flow Collectors and Processors, Data Nodes)" licensing: "Usage model: EPS + FPM; Enterprise model: Managed Virtual Servers; subscription or perpetual" detection_language: "Custom Rules Engine (rule wizard), AQL" saas_status: "QRadar SaaS sold to Palo Alto Networks (closed 2024-09); QRadar on Cloud EOL 2026-04-14; on-prem not affected" notes: - "QRadar Incident Forensics not available in 7.6.x; stay on 7.5.0 UP15 if you use it" - "Over-allocating EPS/FPM in License Pool Management can block Log/Network Activity tabs" - "Community Edition: 3-month license, 100 EPS, 5,000 FPM" ops_effort: "High; specialist skills" sources: - https://www.ibm.com/products/hosted-security-intelligence/pricing - https://community.ibm.com/community/user/blogs/ashish-kothekar/2026/06/30/announcing-ibm-qradar-760-the-biggest-qradar-relea - https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary - https://investors.paloaltonetworks.com/news-releases/news-release-details/palo-alto-networksr-closes-acquisition-ibms-qradar-saas-assets - https://www.ibm.com/support/pages/node/6964816 - https://www.ibm.com/community/101/qradar/ce/ splunk_enterprise_security: owner: "Cisco (acquisition completed 2024-03-18)" current_version: "ES 8.x (8.4 GA 2026-02; 8.6 controlled availability 2026-07)" deployment: "Splunk Enterprise (forwarders, indexers, search heads) or Splunk Cloud Platform" minimum_hardware: "16 physical cores / 32 GB RAM per search head and per indexer (ES 8.x)" detection_language: "SPL; data normalized to the Common Information Model" pricing_models: "Ingest (GB/day), workload (SVC in Cloud, vCPU on-prem), activity-based (Cloud only); prices not published" splunk_free: "500 MB/day, single instance, no alerting, no users or roles — not a SIEM" upgrade_notes: - "ES 8.4: finding-based detections created before 8.4 may need updates" - "ES 8.x on Splunk Enterprise 10.x on-prem: install from the command line" ops_effort: "High self-managed; dedicated administrator" sources: - https://help.splunk.com/en/splunk-enterprise-security-8/install/8.3/planning - https://help.splunk.com/en/splunk-enterprise-security-8/release-notes-and-resources - https://www.splunk.com/en_us/products/pricing/pricing-models.html - https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.0/configure-splunk-licenses/about-splunk-free - https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m03/cisco-completes-acquisition-of-splunk.html proof_of_concept: candidates: 2 duration: "at least 2 weeks" same_sources_into_both: - "Domain controllers or Entra ID sign-ins" - "Perimeter firewall" - "Endpoint telemetry from a sample of machines" measure: - "Ingested GB/day per source" - "Alerts/day before and after one tuning round" - "Engineering hours per job: onboarding, tuning, platform upkeep" - "Time to write and tune one identical detection in each platform"