A recurring theme in our architecture reviews has been the escalating cost of observability platforms, particularly as we scale telemetry ingestion into the petabyte-per-month range. We are currently evaluating a potential migration from Sumo Logic to Anomali for our core security log analytics, and while feature parity is a significant discussion, the financial operational burden is paramount.
I've constructed a preliminary model for a direct cost-per-GB analysis, focusing on the raw ingestion fee as the primary variable. It's crucial to note that both platforms have nuanced pricing components (data tiering, query costs, retention periods), but for a like-to-like comparison of active, queryable data, the ingestion fee is the dominant factor. Based on our current contracted rates and Anomali's public pricing sheet, the breakdown for our volume tier (approx. 500 TB/month) is as follows:
* **Sumo Logic (Enterprise, 1-year commit):** Our effective rate is $0.85 per GB ingested. This includes a base rate with a volume discount, but does not factor in separate costs for longer-term archives or analytics query packs.
* **Anomali (Enterprise, projected):** The quoted rate for a comparable commitment and support tier is approximately $0.62 per GB. Their model appears to bundle a longer default retention period (180 days hot) into the ingestion cost, which simplifies the comparison for our primary dataset.
This yields a raw cost differential of **$0.23 per GB**. At our scale, the monthly pre-tax savings projection is significant:
```
Monthly Savings = (500,000 GB) * ($0.85 - $0.62) = $115,000
```
However, this purely arithmetic comparison is insufficient for a responsible evaluation. The material trade-offs we must model include:
* **Query Performance & Cost:** Sumo Logic charges separately for query operations beyond a certain threshold. Anomali's model claims unlimited queries on the hot tier. We need to profile our typical query patterns—volume of scanned data, complexity, concurrency—to quantify this. A seemingly higher per-GB cost might be justified if it includes heavy query workloads.
* **Data Pipeline Friction:** Any migration requires re-instrumenting collectors, modifying parsing logic, and potentially altering log schemas. The cost of engineering effort and the risk of data loss during cutover must be amortized over the projected savings.
* **Ecosystem Lock-in:** The cost of integrating with existing SOAR playbooks, custom dashboards, and internal tooling. Anomali's API and query language (KQL vs. Sumo's query language) differences will incur development and training overhead.
My question to the community is whether anyone has conducted a similar, deep-dive financial and operational analysis, particularly at a similar scale. I am especially interested in empirical data points regarding:
* Real-world query performance comparisons for complex, multi-source correlation searches.
* Hidden costs encountered in implementation, such as the need for additional preprocessing or bandwidth usage changes.
* The actual operational burden of managing the data lifecycle (archiving, restoration, deletion) in Anomali versus Sumo's automated tiers.
Anecdotal evidence on "savings" is less useful than a structured analysis of the total cost of ownership shift, including the engineering variables listed above.
brianh
Your focus on the raw ingestion fee is a solid starting point for the cost comparison, and that delta is significant. I'd gently push on the assumption that it's the dominant factor for a like-to-like comparison, though.
For security log analytics, the query and investigation patterns matter immensely. A lower ingest cost can be quickly eclipsed if the platform charges more per query or has less efficient query performance, leading to higher "time to answer" costs for your analysts. Have you modeled a typical investigation workflow - a series of complex, ad-hoc searches - against the query pricing structures for both? That operational burden often shifts the math.
Stay curious, stay critical.