Self-hosted SIEM: 15 platforms compared
A SIEM's pricing model shapes your security more than its feature list does. Under per-gigabyte licensing, every new log source adds running cost. So teams quietly stop collecting the noisy sources. Those are the ones that make lateral movement visible. That is why this comparison leads with deployment model and licensing basis.
nPro publishes this comparison. Where nPro appears as one of the platforms listed, its card is marked and its scores are our own assessment. Third-party review scores are sourced from public vendor profiles. Structural facts are verifiable against each vendor's documentation: deployment model, licensing basis and residency.
15 platforms
nPro
NPRO TECH Sdn. Bhd.
Self-hosted only: publisher of this comparison.
Reviews
—
Licensing
$4.50/agent/mo
Average score
8.1
- +ClickHouse backend rather than Elasticsearch, so there is materially less tuning to operate.
- +Flat per-agent licensing means log volume never affects the bill.
- +Network monitoring included rather than sold as a separate product.
- −Integration and app ecosystem is small compared with Splunk or Elastic.
- −Behavioural analytics in development. Not comparable to Securonix or Exabeam today.
Best for Regulated organisations needing full residency control without operating an Elastic stack.
Watch out No SaaS option; you need a Linux server somebody patches and monitors.
Splunk Enterprise Security
Splunk (Cisco)
Market incumbent: deepest app ecosystem.
Reviews
G2 4.3 (248)
Licensing
Ingest volume or workload
Average score
7.8
- +Self-hostable. Splunk Enterprise runs on your own infrastructure.
- +Splunkbase app ecosystem is far larger than any competitor listed here.
- +Search language is exceptionally powerful for investigation and hunting.
- −Ingest-based licensing is the single most common driver of SIEM cost escalation.
- −Requires significant expertise and headcount to operate well at scale.
Best for Large enterprises with the budget and staff to exploit the platform fully.
Watch out Model three-year cost against realistic data growth, not today's volume.
Splunk Enterprise Security vs nPro →Microsoft Sentinel
Microsoft
Azure-native cloud SIEM.
Reviews
G2 4.4 (298)
Licensing
Per GB ingested
Average score
7.4
- +No infrastructure to size, patch or scale. It is fully managed by Microsoft.
- +Excellent native coverage of Entra ID, Microsoft 365 and Azure workloads.
- +Large library of prebuilt analytics rules and workbooks.
- −Azure only. Data residency is limited to available Azure regions.
- −Per-gigabyte pricing directly penalises comprehensive log collection.
Best for Azure-committed organisations without residency constraints.
Watch out Per-GB cost at scale surprises most teams; run a realistic volume forecast first.
Microsoft Sentinel vs nPro →IBM QRadar
IBM
On-premises enterprise SIEM.
Reviews
G2 4.4 (339)
Licensing
Events per second / flows
Average score
7.5
- +Mature on-premises deployment with a long track record in regulated sectors.
- +Strong network flow analysis alongside log correlation.
- +Well understood by the large pool of engineers trained on it.
- −Portfolio uncertainty following the sale of the SaaS business to Palo Alto Networks.
- −Events-per-second licensing requires sizing for peak, not average.
Best for Existing QRadar estates and regulated enterprises wanting proven on-premises SIEM.
Watch out Get a written roadmap commitment for the on-premises product before renewing.
IBM QRadar vs nPro →Elastic Security
Elastic
Open platform: self-hostable.
Reviews
G2 4.5 (23)
Licensing
Free / resource-based tiers
Average score
8.1
- +Self-hostable at any scale with full ownership of your data.
- +Search performance and flexibility are genuinely excellent.
- +Very large integration library covering most common log sources.
- −Cluster sizing, index lifecycle and upgrades demand real expertise.
- −Security machine learning features sit behind paid subscription tiers.
Best for Teams with platform engineering capacity wanting maximum flexibility.
Watch out The operational cost is the real cost. Do not treat this as a free option.
Elastic Security vs nPro →Wazuh
Wazuh Inc.
Open source: GPLv2.
Reviews
G2 4.5 (72)
Licensing
Free; paid support available
Average score
8.0
- +No licence cost at any scale, with a genuinely capable rule engine.
- +Includes file integrity monitoring and configuration assessment out of the box.
- +Very large community rule base and active development.
- −The indexing and storage layer is where cost and complexity actually accumulate.
- −Dashboard and reporting experience trails commercial platforms.
Best for Teams with engineering capacity and a strong open-source preference.
Watch out Free licence, real operational cost. Staff it honestly or buy support.
Wazuh vs nPro →Graylog
Graylog Inc.
Open core: log management first.
Reviews
G2 4.4 (122)
Licensing
Free / ingest volume (Enterprise)
Average score
7.8
- +Noticeably easier to stand up and operate than Elastic for log management.
- +Open-source edition is genuinely usable rather than a crippled trial.
- +Strong search and alerting for the operational logging use case.
- −Security-specific content is thinner than dedicated SIEM platforms.
- −Enterprise edition returns to volume-based pricing.
Best for Teams wanting solid self-hosted log management with a path toward SIEM.
Watch out Check which security features require Enterprise before assuming the free tier suffices.
Graylog vs nPro →Sumo Logic
Sumo Logic
Cloud-native SIEM and observability.
Reviews
G2 4.3 (417)
Licensing
Credits (ingest or data scanned)
Average score
6.9
- +Fast to deploy with no infrastructure to manage.
- +Combines security and operational observability in one platform.
- +Good cloud-native log source coverage.
- −SaaS only, with no self-hosted option at any tier.
- −Volume-based pricing with the usual collection-suppressing effect.
Best for Cloud-native organisations wanting security and observability together.
Watch out No residency control. This rules it out for most regulated deployments.
Sumo Logic vs nPro →Exabeam
Exabeam (with LogRhythm)
Behavioural analytics specialist.
Reviews
G2 4.6 (16)
Licensing
Per user or volume
Average score
7.7
- +Among the strongest genuine UEBA implementations available.
- +The LogRhythm merger brings a mature self-hosted heritage.
- +Timeline-based investigation model is well suited to insider threat work.
- −Post-merger product line is still consolidating. Clarify which platform you are buying.
- −Pricing model varies by product and is harder to forecast than per-agent.
Best for Organisations where insider threat and account compromise are the priority.
Watch out Establish clearly whether you are buying Exabeam or LogRhythm lineage, and its roadmap.
Exabeam vs nPro →Securonix
Securonix
UEBA-led cloud SIEM.
Reviews
G2 4 (14)
Licensing
Per identity or volume
Average score
7.4
- +Behavioural analytics is core to the product rather than an add-on.
- +Strong identity-centric threat detection and peer group analysis.
- +Extensive prebuilt content for insider threat use cases.
- −Primarily cloud-delivered. Self-hosted options are limited.
- −Identity-based pricing needs careful modelling against your user count.
Best for Enterprises where identity-driven detection is the primary requirement.
Watch out Confirm self-hosted availability early if residency is a constraint.
Securonix vs nPro →Devo
Devo
High-speed cloud data platform.
Reviews
G2 4.3 (5)
Licensing
Ingest volume
Average score
6.9
- +Very strong query performance over large historical datasets.
- +Retains full-fidelity data for long periods without rehydration steps.
- +Fast to deploy with no infrastructure to operate.
- −SaaS only. There is no self-hosted deployment path.
- −Smaller ecosystem and community than the incumbents.
Best for Enterprises needing fast search across long retention windows.
Watch out No residency control. Assess against your regulatory position first.
Devo vs nPro →Rapid7 Incident Command (InsightIDR)
Rapid7
Cloud SIEM with strong SMB fit.
Reviews
G2 4.4 (75)
Licensing
Per asset
Average score
7.2
- +Among the fastest SIEM deployments in this table.
- +Good out-of-the-box detection content requiring little tuning.
- +Integrates cleanly with Rapid7 vulnerability management.
- −SaaS only, with no self-hosted option.
- −Less customisable than platforms built around a query language.
Best for SMB and mid-market teams wanting quick time to value without deep expertise.
Watch out Per-asset pricing plus SaaS delivery limits both flexibility and residency control.
Rapid7 Incident Command (InsightIDR) vs nPro →Fortinet FortiSIEM
Fortinet
Self-hosted appliance or virtual machine.
Reviews
G2 4.3 (41)
Licensing
EPS, device or GB/day ingest
Average score
7.6
- +Genuinely self-hosted as an appliance or virtual machine.
- +Includes configuration management database and asset discovery.
- +Cost-effective where Fortinet infrastructure is already in place.
- −Interface and workflow rated below newer platforms by most reviewers.
- −Licensing is by events per second, device count or daily ingest. Each needs sizing for peak load.
Best for Fortinet-standardised networks wanting self-hosted SIEM without a new vendor.
Watch out Evaluate the analyst experience directly. This is where reviewers are most critical.
Fortinet FortiSIEM vs nPro →ManageEngine Log360
Zoho / ManageEngine
Self-hosted, SMB-oriented.
Reviews
G2 4.3 (17)
Licensing
Per log source
Average score
7.8
- +Self-hosted with straightforward per-log-source licensing.
- +Strong Active Directory auditing and prebuilt compliance reporting.
- +Considerably cheaper than enterprise SIEM for comparable log volume.
- −Advanced threat detection is weaker than dedicated security platforms.
- −Scales less comfortably into large, high-volume environments.
Best for SMB and mid-market needing compliance reporting and AD auditing on-premises.
Watch out If advanced threat detection is the goal, this is a compliance tool first.
ManageEngine Log360 vs nPro →Security Onion
Security Onion Solutions
Open source: network security monitoring.
Reviews
G2 4.5 (2)
Licensing
Free; paid support available
Average score
7.8
- +Free and open source with excellent network security monitoring depth.
- +Bundles Suricata, Zeek and full packet capture in one distribution.
- +Widely used for training, research and incident response work.
- −Network-focused. Endpoint and identity coverage is comparatively thin.
- −No commercial support unless purchased separately from the project.
Best for Teams prioritising network visibility and detection engineering practice.
Watch out Not a full enterprise SIEM replacement on its own. Plan the endpoint layer separately.
Security Onion vs nPro →Capability matrix
| Capability | NP | SP | MS | QR | EL | WZ | GL | SL | EX | SX | DV | R7 | FS | ME | SO |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Self-hosted deployment | ✓ | ✓ | — | ✓ | ✓ | ✓ | ✓ | — | ~ | ~ | — | — | ✓ | ✓ | ✓ |
| Fully air-gapped operation | ✓ | ✓ | — | ✓ | ~ | ✓ | ~ | — | ~ | — | — | — | ✓ | ~ | ✓ |
| Open-source core | — | — | — | — | ~ | ✓ | ~ | — | — | — | — | — | — | — | ✓ |
| No per-GB ingestion charge | ✓ | — | — | ~ | ~ | ~ | — | — | ~ | ~ | — | ~ | ~ | ✓ | ✓ |
| Bundled network monitoring | ✓ | — | — | ~ | — | — | — | — | — | — | — | — | ✓ | ✓ | ✓ |
| Behavioural analytics (UEBA) | ~ | ✓ | ✓ | ✓ | ✓ | ~ | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | ~ | — |
| SOAR / playbook automation | ✓ | ✓ | ✓ | ✓ | ~ | ~ | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | — |
| STIX / TAXII ingestion | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | ✓ | ✓ | ✓ | ~ | ✓ | ✓ | ~ | ✓ |
| MITRE ATT&CK mapping | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ | ✓ |
| Prebuilt compliance reporting | ✓ | ✓ | ✓ | ✓ | ~ | ~ | ~ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ~ |
| Deploys in under one day | ✓ | — | ~ | — | — | ~ | ~ | ✓ | — | — | ✓ | ~ | — | ~ | ~ |
✓ supported · ~ partial or requires an add-on · — not available
How to read this comparison
Price the model, not the licence. Per-gigabyte and events-per-second billing both charge you for visibility. So compare three years out, at the growth rate you have actually seen, rather than the quote in front of you.
Watch the cost that never reaches an invoice. A platform can be free to licence and still need a tuned Elasticsearch cluster behind it. That is a headcount cost. It is often the bigger of the two numbers.
The real test is simple. Which log sources will you still collect in year three? Any model that makes noisy sources expensive ends with someone turning them off. Those are the sources that show lateral movement.
Compare two platforms
Comparison data last verified 2026-10-06. Vendors change packaging frequently — tell us if anything here is out of date and we will correct it.