Alright, so my team's been on-call for a small MSP client (~50 endpoints, mix of cloud and on-prem). They're outgrowing their basic log collection and want proper SIEM/Security use-case coverage without the complexity of a Splunk.
We're down to two main contenders after some initial scoping: **Elastic Security** (the open-core ELK stack route) and **ManageEngine Log360**. Budget is a major factor, but so is my team's sanity at 3 AM when an alert fires.
From my dashboard-and-alerting obsessed viewpoint, here’s the breakdown I’m wrestling with:
**Elastic Security (Open Source / Free Tier)**
* **Pros:** The stack is incredibly powerful if you know your way around it. You own everything. The alerting engine (using Elastic Rules) is flexible. I can build custom dashboards in Grafana (yes, I'd still pipe data there) that show exactly what the night shift needs.
* **Cons:** "Free" becomes expensive in time. You're the admin, the updater, the rule tuner. The learning curve for writing detection rules (KQL) is real. For a small MSP, the operational overhead can be a killer.
**ManageEngine Log360**
* **Pros:** It's a managed product. Out-of-the-box reports, compliance templates, and a more guided SOC workflow. The support burden shifts away from my team. The initial setup and getting value is faster.
* **Cons:** Less flexibility. The alerting and dashboards are what they are. I can't just write a PromQL-like query to drill into a weird anomaly. It can feel like a "black box" compared to Elastic.
My core question for the community, especially those running similar small-scale ops:
**Where does the balance tip for you between control and overhead?**
Specifically:
* How manageable is Elastic Security's rule tuning and stack maintenance for a team with limited dedicated security engineers?
* Does Log360's "batteries-included" approach hold up when you need to investigate something it doesn't have a pre-built report for?
I'm leaning towards the "spend more on the managed product to save on-call brain cycles," but I hate losing the deep visibility. Would love to hear your war stories.
zzz
Sleep is for the weak
Your point about the operational overhead of Elastic is the critical one for an MSP of that size. The "free tier" cost model shifts from licensing to labor, specifically the specialized labor required to maintain and tune the stack. For a 50-endpoint environment, you'll likely spend more on engineer hours for upkeep and alert refinement than you would on a Log360 subscription.
However, don't discount Elastic's flexibility entirely if your team has the bandwidth. Its data normalization and pipeline preprocessing are superior for heterogeneous environments. If you're already collecting logs for other operational purposes, the ability to unify that data layer can provide long-term analytic benefits that a closed product like Log360 can't match.
The 3 AM sanity test you mentioned is the deciding factor. Log360 will get you a working, auditable SIEM faster. With Elastic, you're building a security operations platform from components, and that project is never truly finished.
measure what matters
You're right about the operational overhead, but you're missing the cloud cost angle if this is a mixed environment. That "free" Elastic stack still runs on instances. For 50 endpoints, you're looking at maybe a couple of mid-sized VMs, which is cheap until you factor in 24/7 uptime and attached storage. Have you priced out a three-year reserved instance commitment vs the Log360 subscription?
Log360's "managed product" line means their cloud bill is baked into your license, and they're not incentivized to keep it low. Ask them about data egress charges if you're pulling from cloud tenants, because that's where the surprise invoice comes from.
Your sanity at 3 AM has a direct hourly rate. Compare that to the annual support contract for Log360. Which one actually breaks even?
Show me the bill