SIEM pricing

Plans that fit your security operations model.

Start with AI-powered triage on Devo or Microsoft Sentinel, add the Devo partner platform, or bring in hands-on response support as your needs grow.

Most Popular

Platform Only

USD 300/mo

Billed annually — USD 300/mo, USD 3,600/year.

12-month term. Straightforward pricing, no usage surprises within your plan limits.

Up to 100 users, up to 40,000 alerts/day, 1 SIEM source

For teams running Devo or Microsoft Sentinel who want SIEM+ to triage, translate, and guide remediation on top of it.

  • AI alert triage and threat translation
  • Security health score and executive reporting
  • Remediation guidance for your existing SIEM stack
  • Native Devo and Microsoft Sentinel integrations
Get Started — USD 300/mo

SIEM+ Complete (with partner SIEM)

Custom

For teams that do not have a SIEM yet. Pair SIEM+ with our partner platform, Devo, for Devo alert ingestion, scheduled source jobs, and SIEM+ alert triage in one bundle.

  • Everything in Platform Only
  • Devo source connection and scheduled ingestion included
  • Single bill, single vendor relationship
Contact Us

Platform + Managed Services

Custom

For teams that want SIEM+ plus security specialists who provide guided incident response, escalation support, and response-workflow review.

  • Everything in Platform Only or SIEM+ Complete
  • Human-led incident response and escalation support
  • Response workflow review from security specialists
Contact Us

Pricing questions

How much does SIEM+ cost with my existing SIEM?

Platform Only is USD 300 per month for up to 100 users, up to 40,000 alerts per day, and 1 connected SIEM source. SIEM+ supports Devo and Microsoft Sentinel today.

What counts as an alert for the 40,000/day cap?

The cap refers to alerts sent into SIEM+ for triage during a day. If your team needs a higher alert volume, contact us for a custom quote.

Can SIEM+ include a SIEM or managed response?

Yes. SIEM+ Complete pairs the platform with the Devo partner platform, and Platform + Managed Services adds guided response and escalation support from security specialists.

What happens if we exceed the plan limits?

Platform Only covers up to 100 users, up to 40,000 alerts per day, and 1 connected SIEM source. If your team needs more users, higher alert volume, or to connect more than one SIEM source, contact us for a custom quote.

Which SIEM platforms do you support today?

SIEM+ supports Devo and Microsoft Sentinel today for supported alert ingestion and triage. LogEase and 日志易 (Rizhiyi) integrations are coming soon. SIEM support is source-specific; contact us to discuss a different environment.

Does SIEM+ officially support Microsoft Sentinel?

Yes. SIEM+ officially supports Microsoft Sentinel for alert triage, threat context, prioritized incidents, and clear remediation guidance.

How is our data secured?

Contact us for current security, data-handling, and retention details.

How long is our data retained?

Contact us for current data-retention details.

What is the difference between the three plans?

Platform Only provides alert triage, scoring, reporting, and remediation guidance on Devo or Microsoft Sentinel. SIEM+ Complete adds Devo alert ingestion and scheduled source jobs for teams that do not have a SIEM yet. Platform + Managed Services adds guided incident response and escalation support from security specialists, plus response-workflow review.

Is Platform Only a monthly or annual commitment?

Platform Only has a 12-month term and is billed annually at USD 300 per month, or USD 3,600 per year. Pricing is straightforward with no usage surprises within your plan limits.

What if we don't have a SIEM yet?

SIEM+ Complete pairs SIEM+ with our partner platform, Devo, for Devo alert ingestion and SIEM+ alert triage in one bundle, with a single bill and vendor relationship.

What does hands-on response support include?

Platform + Managed Services adds guided incident response and escalation support from security specialists, plus response workflow review.