SIEM pricing

Plans that fit your security operations model.

Start with AI-powered triage on top of your existing SIEM, add a partner platform, or bring in hands-on response support as your needs grow.

Most Popular

Platform Only

USD 300/mo

Billed annually — USD 300/mo, USD 3,600/year.

12-month term. Straightforward pricing, no usage surprises within your plan limits.

Up to 100 users, up to 40,000 alerts/day

For teams running Devo today — or Microsoft Sentinel once that integration ships — who want SIEM+ to triage, translate, and guide remediation on top of it.

  • AI alert triage and threat translation
  • Security health score and executive reporting
  • Remediation guidance for your existing SIEM stack
  • Native Devo integration today — Microsoft Sentinel coming soon
Get Started — USD 300/mo

SIEM+ Complete (with partner SIEM)

Custom

For teams that do not have a SIEM yet. Pair SIEM+ with our partner platform, Devo, for detection and AI triage in one bundle.

  • Everything in Platform Only
  • Fully managed SIEM backend included
  • Single bill, single vendor relationship
Contact Us

Platform + Managed Services

Custom

For teams that want SIEM+ plus guided incident response, escalation, and ongoing tuning from security specialists.

  • Everything in Platform Only or SIEM+ Complete
  • Guided incident response and escalation
  • Response workflow review and ongoing tuning
Contact Us

Pricing questions

How much does SIEM+ cost with my existing SIEM?

Platform Only is USD 300 per month for up to 100 users and up to 40,000 alerts per day. SIEM+ is built to work with any SIEM; Devo is live today, with Microsoft Sentinel coming soon.

What counts as an alert for the 40,000/day cap?

The cap refers to alerts sent into SIEM+ for triage during a day. If your team needs a higher alert volume, contact us for a custom quote.

Can SIEM+ include a SIEM or managed response?

Yes. SIEM+ Complete pairs the platform with a partner SIEM, and Platform + Managed Services adds guided response and ongoing tuning.

What happens if we exceed the plan limits?

Platform Only covers up to 100 users and up to 40,000 alerts per day. If your team needs more users or higher alert volume, contact us for a custom quote.

Which SIEM platforms do you support today?

SIEM+ is designed to plug into any SIEM platform, and the Devo integration is live today. Microsoft Sentinel is in active development. If you run a different SIEM, tell us which one so we can consider it for the integration roadmap.

When is Microsoft Sentinel support launching?

There is no fixed launch date yet. Contact us to get notified when it ships or to join early access.

How is our data secured?

SIEM+ is hosted on SOC 2-compliant cloud infrastructure. Data is encrypted at rest and in transit, alert data is logically separated by customer account within the platform, and data retention defaults to 30 days and is configurable per client.

How long is our data retained?

Data retention defaults to 30 days and is configurable per client.

What is the difference between the three plans?

Platform Only provides SIEM+ automation, scoring, reporting, and remediation guidance on top of your existing SIEM. SIEM+ Complete adds a fully managed partner SIEM for teams that do not have one yet. Platform + Managed Services adds guided incident response, escalation, and ongoing workflow tuning.

Is Platform Only a monthly or annual commitment?

Platform Only has a 12-month term and is billed annually at USD 300 per month, or USD 3,600 per year. Pricing is straightforward with no usage surprises within your plan limits.

What if we don't have a SIEM yet?

SIEM+ Complete pairs SIEM+ with our partner platform, Devo, so you get full detection and AI triage in one bundle, with a single bill and vendor relationship.

What does hands-on response support include?

Platform + Managed Services adds guided incident response and escalation, plus response workflow review and ongoing tuning from security specialists.