Self-hosted SIEM: 15 platforms compared
A SIEM's pricing model shapes your security posture more than its feature list does. Under per-gigabyte licensing every additional log source carries a running cost, so teams quietly stop collecting the verbose sources that make lateral movement visible. This comparison leads with deployment model and licensing basis for that reason.
nPro publishes this comparison and is one of the platforms listed. Scores for nPro are our own assessment. Third-party review scores are sourced from public vendor profiles. Structural facts — deployment model, licensing basis, residency — are verifiable against each vendor's documentation.
15 platforms
nPro
NPRO TECH Sdn. Bhd.
Self-hosted only — publisher of this comparison
Reviews
—
Licensing
$4.50/agent/mo
Average score
8.1
- +ClickHouse backend rather than Elasticsearch — materially less tuning to operate
- +Flat per-agent licensing means log volume never affects the bill
- +Network monitoring included rather than sold as a separate product
- −Integration and app ecosystem is small compared with Splunk or Elastic
- −Behavioural analytics in development — not comparable to Securonix or Exabeam today
Best for Regulated organisations needing full residency control without operating an Elastic stack
Watch out No SaaS option; you need a Linux server somebody patches and monitors
Splunk Enterprise Security
Splunk (Cisco)
Market incumbent — deepest app ecosystem
Reviews
—
Licensing
Ingest volume or workload
Average score
7.8
- +Self-hostable — Splunk Enterprise runs on your own infrastructure
- +Splunkbase app ecosystem is far larger than any competitor listed here
- +Search language is exceptionally powerful for investigation and hunting
- −Ingest-based licensing is the single most common driver of SIEM cost escalation
- −Requires significant expertise and headcount to operate well at scale
Best for Large enterprises with the budget and staff to exploit the platform fully
Watch out Model three-year cost against realistic data growth, not today's volume
Microsoft Sentinel
Microsoft
Azure-native cloud SIEM
Reviews
—
Licensing
Per GB ingested
Average score
7.4
- +No infrastructure to size, patch or scale — fully managed by Microsoft
- +Excellent native coverage of Entra ID, Microsoft 365 and Azure workloads
- +Large library of prebuilt analytics rules and workbooks
- −Azure only — data residency is limited to available Azure regions
- −Per-gigabyte pricing directly penalises comprehensive log collection
Best for Azure-committed organisations without residency constraints
Watch out Per-GB cost at scale surprises most teams; run a realistic volume forecast first
IBM QRadar
IBM
On-premises enterprise SIEM
Reviews
—
Licensing
Events per second / flows
Average score
7.5
- +Mature on-premises deployment with a long track record in regulated sectors
- +Strong network flow analysis alongside log correlation
- +Well understood by the large pool of engineers trained on it
- −Portfolio uncertainty following the sale of the SaaS business to Palo Alto Networks
- −Events-per-second licensing requires sizing for peak, not average
Best for Existing QRadar estates and regulated enterprises wanting proven on-premises SIEM
Watch out Get a written roadmap commitment for the on-premises product before renewing
Elastic Security
Elastic
Open platform — self-hostable
Reviews
—
Licensing
Free / resource-based tiers
Average score
8.1
- +Self-hostable at any scale with full ownership of your data
- +Search performance and flexibility are genuinely excellent
- +Very large integration library covering most common log sources
- −Cluster sizing, index lifecycle and upgrades demand real expertise
- −Security machine learning features sit behind paid subscription tiers
Best for Teams with platform engineering capacity wanting maximum flexibility
Watch out The operational cost is the real cost — do not treat this as a free option
Wazuh
Wazuh Inc.
Open source — GPLv2
Reviews
—
Licensing
Free; paid support available
Average score
8.0
- +No licence cost at any scale, with a genuinely capable rule engine
- +Includes file integrity monitoring and configuration assessment out of the box
- +Very large community rule base and active development
- −The indexing and storage layer is where cost and complexity actually accumulate
- −Dashboard and reporting experience trails commercial platforms
Best for Teams with engineering capacity and a strong open-source preference
Watch out Free licence, real operational cost — staff it honestly or buy support
Graylog
Graylog Inc.
Open core — log management first
Reviews
—
Licensing
Free / ingest volume (Enterprise)
Average score
7.8
- +Noticeably easier to stand up and operate than Elastic for log management
- +Open-source edition is genuinely usable rather than a crippled trial
- +Strong search and alerting for the operational logging use case
- −Security-specific content is thinner than dedicated SIEM platforms
- −Enterprise edition returns to volume-based pricing
Best for Teams wanting solid self-hosted log management with a path toward SIEM
Watch out Check which security features require Enterprise before assuming the free tier suffices
Sumo Logic
Sumo Logic
Cloud-native SIEM and observability
Reviews
—
Licensing
Ingest volume
Average score
6.9
- +Fast to deploy with no infrastructure to manage
- +Combines security and operational observability in one platform
- +Good cloud-native log source coverage
- −SaaS only, with no self-hosted option at any tier
- −Volume-based pricing with the usual collection-suppressing effect
Best for Cloud-native organisations wanting security and observability together
Watch out No residency control — rules this out for most regulated deployments
Exabeam
Exabeam (with LogRhythm)
Behavioural analytics specialist
Reviews
—
Licensing
Per user or volume
Average score
7.7
- +Among the strongest genuine UEBA implementations available
- +The LogRhythm merger brings a mature self-hosted heritage
- +Timeline-based investigation model is well suited to insider threat work
- −Post-merger product line is still consolidating — clarify which platform you are buying
- −Pricing model varies by product and is harder to forecast than per-agent
Best for Organisations where insider threat and account compromise are the priority
Watch out Establish clearly whether you are buying Exabeam or LogRhythm lineage, and its roadmap
Securonix
Securonix
UEBA-led cloud SIEM
Reviews
—
Licensing
Per identity or volume
Average score
7.4
- +Behavioural analytics is core to the product rather than an add-on
- +Strong identity-centric threat detection and peer group analysis
- +Extensive prebuilt content for insider threat use cases
- −Primarily cloud-delivered — self-hosted options are limited
- −Identity-based pricing needs careful modelling against your user count
Best for Enterprises where identity-driven detection is the primary requirement
Watch out Confirm self-hosted availability early if residency is a constraint
Devo
Devo
High-speed cloud data platform
Reviews
—
Licensing
Ingest volume
Average score
6.9
- +Very strong query performance over large historical datasets
- +Retains full-fidelity data for long periods without rehydration steps
- +Fast to deploy with no infrastructure to operate
- −SaaS only — no self-hosted deployment path
- −Smaller ecosystem and community than the incumbents
Best for Enterprises needing fast search across long retention windows
Watch out No residency control — assess against your regulatory position first
Rapid7 InsightIDR
Rapid7
Cloud SIEM with strong SMB fit
Reviews
—
Licensing
Per asset
Average score
7.2
- +Among the fastest SIEM deployments in this table
- +Good out-of-the-box detection content requiring little tuning
- +Integrates cleanly with Rapid7 vulnerability management
- −SaaS only, with no self-hosted option
- −Less customisable than platforms built around a query language
Best for SMB and mid-market teams wanting quick time to value without deep expertise
Watch out Per-asset pricing plus SaaS delivery limits both flexibility and residency control
Fortinet FortiSIEM
Fortinet
Self-hosted appliance or virtual machine
Reviews
—
Licensing
Events per second
Average score
7.6
- +Genuinely self-hosted as an appliance or virtual machine
- +Includes configuration management database and asset discovery
- +Cost-effective where Fortinet infrastructure is already in place
- −Interface and workflow rated below newer platforms by most reviewers
- −Events-per-second licensing requires sizing for peak load
Best for Fortinet-standardised networks wanting self-hosted SIEM without a new vendor
Watch out Evaluate the analyst experience directly — this is where reviewers are most critical
ManageEngine Log360
Zoho / ManageEngine
Self-hosted, SMB-oriented
Reviews
—
Licensing
Per log source
Average score
7.8
- +Self-hosted with straightforward per-log-source licensing
- +Strong Active Directory auditing and prebuilt compliance reporting
- +Considerably cheaper than enterprise SIEM for comparable log volume
- −Advanced threat detection is weaker than dedicated security platforms
- −Scales less comfortably into large, high-volume environments
Best for SMB and mid-market needing compliance reporting and AD auditing on-premises
Watch out If advanced threat detection is the goal, this is a compliance tool first
Security Onion
Security Onion Solutions
Open source — network security monitoring
Reviews
—
Licensing
Free; paid support available
Average score
7.8
- +Free and open source with excellent network security monitoring depth
- +Bundles Suricata, Zeek and full packet capture in one distribution
- +Widely used for training, research and incident response work
- −Network-focused — endpoint and identity coverage is comparatively thin
- −No commercial support unless purchased separately from the project
Best for Teams prioritising network visibility and detection engineering practice
Watch out Not a full enterprise SIEM replacement on its own — plan the endpoint layer separately
Capability matrix
| Capability | NP | SP | MS | QR | EL | WZ | GL | SL | EX | SX | DV | R7 | FS | ME | SO |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Self-hosted deployment | ✓ | ✓ | — | ✓ | ✓ | ✓ | ✓ | — | ~ | ~ | — | — | ✓ | ✓ | ✓ |
| Fully air-gapped operation | ✓ | ✓ | — | ✓ | ~ | ✓ | ~ | — | ~ | — | — | — | ✓ | ~ | ✓ |
| Open-source core | — | — | — | — | ~ | ✓ | ~ | — | — | — | — | — | — | — | ✓ |
| No per-GB ingestion charge | ✓ | — | — | ~ | ~ | ~ | — | — | ~ | ~ | — | ~ | ~ | ✓ | ✓ |
| Bundled network monitoring | ✓ | — | — | ~ | — | — | — | — | — | — | — | — | ✓ | ✓ | ✓ |
| Behavioural analytics (UEBA) | ~ | ✓ | ✓ | ✓ | ✓ | ~ | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | ~ | — |
| SOAR / playbook automation | ✓ | ✓ | ✓ | ✓ | ~ | ~ | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | — |
| STIX / TAXII ingestion | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | ✓ | ✓ | ✓ | ~ | ✓ | ✓ | ~ | ✓ |
| MITRE ATT&CK mapping | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | ✓ |
| Prebuilt compliance reporting | ✓ | ✓ | ✓ | ✓ | ~ | ~ | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ |
| Deploys in under one day | ✓ | — | ~ | — | — | ~ | ~ | ✓ | — | — | ✓ | ~ | — | ~ | ~ |
✓ supported · ~ partial or requires an add-on · — not available
Compare two platforms
Verification date pending. Vendors change packaging frequently — tell us if anything here is out of date and we will correct it.