SIEM pricing-model changelog 2024-2026

Six vendors changed pricing structurally between January 2024 and June 2026. The dollar impact at 500 GB/day is meaningful for every one of them.

• 2024-2026

  Splunk

  Workload Pricing pushed as alternative to ingest-volume pricing for large customers. Post-Cisco, renewal posture firmer; channel reports 35-50% list-price uplift on upper-band multi-year renewals.[1]

• 2026

  Microsoft Sentinel

  Sentinel data lake launched at $0.05/GB ingest and $0.026/GB-month storage. Defender XDR data into Sentinel free; E5 5 MB/user/day benefit added.[3]

• 2024-2026

  Google Chronicle

  Per-employee pricing tiers consolidated. Mandiant Threat Intelligence bundled into Enterprise Plus.[5]

• 2024-2026

  CrowdStrike

  Falcon Flex commercial wrapper made bundled consumption the default purchase pattern; LogScale per-GB rate stays under a platform credit pool.[7]

• 2023-2025

  Sumo Logic

  Cloud Flex Credits model unified observability and security spend. Cloud SIEM Enterprise add-on layered on Credits.[15]

• 2024-2026

  Elastic

  Serverless Security generally available with ingest, compute, and storage billed as three line items.[16]