Fluency Business
Published rates$1,050
estimated per month
- Users + servers
- $1,050
- Included data
- 410 GB/mo
- Volume over allowance
- $0
205 metered assets with one year of retention included, including 90 days hot and searchable.
Executive SIEM economics
How much does a SIEM cost? Model the whole TCO.
Model Fluency’s per-asset pricing and data-volume allowance for your environment. The estimate does not add separate data-source, events-per-second, onboarding, AI, or token-usage fees.
Fluency cost estimator
Estimate the budget you can explain.
Enter your protected users, servers, and average daily data volume. The estimate uses Fluency’s published software rates, included data allowance, and volume pricing.
Your environment
EditablePre-filled at the plan allowance—not an assumed usage forecast. 410 GB/month is included.
Estimated Fluency software cost
Calculated from Fluency’s published user, server, and data-volume rates.
410 GB / month
Estimated annual software cost
$12,600
Planning estimate only. Taxes, negotiated discounts, migration overlap, and third-party data-pipeline tools may change the result. Validate the model against a written Fluency proposal.
The complete cost model
The license is one line. TCO is the decision.
A defensible SIEM budget separates the vendor meter from the work required to operate it. That makes proposals comparable even when one vendor prices by identity, another by ingest, and another by workload or compute.
01 · License
The primary pricing meter
Users, endpoints, servers, ingest volume, workload, compute, or a platform minimum. Identify the meter and model how it grows.
02 · Data
Collection and routing
Include collectors, pipelines, egress, parsing, filtering, and any duplicate storage required before data reaches the SIEM.
03 · Data retention
One year retained, 90 days hot
The common framework standard for audit data is a minimum of 90 days hot and one year retained, designed to cover breach-detection timelines that can exceed 200 days. Fluency includes both.
04 · Services
Onboarding and engineering
Migration, content conversion, custom parsers, rule development, premium support, and partner services can be recurring or front-loaded.
05 · Operations
People and process
Measure analyst time spent maintaining searches, tuning detections, moving evidence, preparing reports, and administering the platform.
06 · Hidden costs
Look beyond the published package
Many packages publish their basic capabilities without making every recurring meter obvious. Ask whether adding data sources, increasing event rates, using AI features, or consuming AI tokens creates another charge. Fluency does not charge separately for any of them.
SIEM pricing models compared
Ask what makes the bill move.
No model is automatically inexpensive. The key is whether the meter aligns with the growth you expect and the telemetry you cannot afford to discard.
| Model | Primary meter | Budget advantage | Question to ask |
|---|---|---|---|
| Per asset / identity | Protected users, endpoints, or servers | Maps spend to the protected environment and is usually easier to forecast. | What counts as an asset, and what data allowance or overage is attached to it? |
| Per GB ingested | Billable telemetry volume | Simple unit math when the exact billable volume and exclusions are known. | Do enrichment, rehydration, replication, and retained copies create additional meters? |
| Workload / compute | Search, analytics, or processing capacity | Can separate storage from active analytics and reward deliberate workload design. | How does an incident, investigation burst, or new detection workload change capacity needs? |
| Platform / tenant | Base subscription, workspace, or customer tenant | Predictable floor and potentially attractive unit economics at scale. | Which core capabilities, data sources, support levels, and retention periods are outside the base fee? |
Vendor pricing references
Published terms behind the SIEM quote.
Compare the measurable terms vendors publish: ingestion rates, retention periods, search charges, asset definitions, data allowances, commitment windows, and renewal policies.
References were checked August 24, 2026. List prices, promotions, regions, bundles, and negotiated discounts can change; confirm every item in the order form.
Splunk
Ingest, activity, or workload capacity
Published billing details
- Ingest model
GB per day
More data requires purchasing the next available ingest level.
- Activity model
Ingest + search activity
The two activities contribute to the commercial meter.
- Workload model
SVC or vCPU capacity
Search quantity, complexity, daily indexing, compute, and storage influence sizing.
Get in writing
The selected pricing model, included capacity and storage, burst treatment, security-product scope, and support level.
Microsoft Sentinel
Azure data tiers and consumption
Published billing details
- Pay as you go
$4.30 per analytics GB
Published Azure retail rate for US East; agreement and region can change the price.
- 50 GB tier
$161.25 per day
Promotional US East rate: $3.225 per committed GB, available through December 31, 2026.
- Lake storage
$0.026 per GB-month
Data-lake ingestion is $0.05/GB and processing is $0.10/GB in the US East retail feed.
- Search
$0.005 per GB scanned
Applied to uncompressed data scanned by data-lake KQL queries and jobs.
- Compute
$0.15 per insight hour
Custom graph building is listed separately at $3/hour.
- Commitment
31-day reduction window
A tier can be increased sooner, but reductions are allowed only every 31 days.
Get in writing
Workspace age and tier, daily commitment, overage rate, retention path, lake and query assumptions, connector infrastructure, and every non-Sentinel Azure resource.
Rapid7 Incident Command
Protected assets and package tier
Published billing details
- Asset
Workstation or server host
Counted when data has been attributed to the host during the preceding 30 days.
- Log retention
90 or 180 days
Essential publishes 90 days; Advanced and Ultimate publish 180 days. Longer retention is an add-on.
- Alert retention
13 months
Published for alerts and audit records, with additional retention available as an add-on.
- Data allowance
Fair-use limit by asset tier
Rapid7 does not publish the GB-per-asset allowance; additional consumption may require a separate plan.
- Feature limits
EDR, NDR, IDS in Ultimate
Managed Detection and Response is priced separately from Incident Command.
- Price
Custom annual quote
Rapid7 publishes the asset meter and volume discounts, but not a public dollar rate.
Get in writing
Per-asset rate, asset-count tier, the exact monthly fair-use allowance, retention add-ons, package level, deployment services, and MDR scope.
CrowdStrike Falcon
Data ingestion and retention entitlement
Published billing details
- Primary meter
Ingested data volume
Some Next-Gen SIEM offers also use the retention period as a license dimension.
- Licensed limit
Defined in the order
CrowdStrike says ingestion can be stopped when data volume exceeds the licensed amount.
- PAYG
Actual GB billed in arrears
Available for specified offers, including qualifying AWS Marketplace purchases.
- Bundle example
10 GB/day + 365 days
Published Falcon Plus bundle entitlements include this SIEM allowance; terms vary by bundle.
- Price
Custom quote
The licensing rules are public, but a general Next-Gen SIEM dollar rate is not.
Get in writing
Daily ingest entitlement, which data is included, retention entitlement, overage behavior, bundle allowance, PAYG rate, and the price of each required module.
Huntress Managed SIEM
Connected data sources
Published billing details
- Displayed rate
$4 per source/month
The public calculator displays $200/month for 50 SIEM sources.
- Minimum
50 units for direct purchase
Huntress states that MSP purchases do not have a Huntress-required minimum.
- SOC coverage
24/7 monitoring included
Investigation and staged remediation are included in the published unit price.
- Retention
Extended retention add-on
The public calculator exposes the option without publishing a universal add-on rate.
- Outside scope
Deployment and daily management
Partner integration, deployment, and portal management are not included in the published platform price.
Get in writing
What counts as one source, included retention, extended-retention price, minimum commitment, overage handling, and partner implementation or management fees.
The quote normalization checklist
- Define exactly which data is billable and whether enrichment or copies count again.
- Separate included searchable retention from archive, restore, and query charges.
- List platform minimums, support, connectors, modules, and professional services.
- Model base, growth, investigation-burst, and compliance-retention scenarios.
- State overage handling, commitment changes, true-ups, and renewal uplift in the order.
- Include migration overlap, internal labor, and the cost to export data at exit.
Written estimate
Put the configuration and price in writing.
Bring the user count, server count, and monthly data estimate from the calculator. Fluency will validate the package, included allowance, retention, and monthly software price in a written proposal.