Just finished a Chronicle POC. The data ingestion is impressive, but the pricing model gave our finance team sticker shock. The per-GB cost seems straightforward until you account for how much *contextual* data gets pulled in automatically (asset, user, geo). That "effective" GB rate can balloon.
I need to build a business case for a full rollout. For those who got budget sign-off:
* What forecasting method actually worked? Did you lock in committed use?
* Any specific log sources you excluded to control volume?
* How do you track "cost per alert" or similar ROI metrics to justify it?
Our current on-prem SIEM has high fixed costs but predictable margins. Chronicle's value is clear, but the scaling cost is opaque.
Ask me about hidden egress costs.