We are evaluating a SIEM migration for a 300-employee manufacturing firm with a hybrid environment (on-prem SCADA, Azure for ERP, AWS for some new IoT data). The shortlist is LogRhythm (currently in use, but the maintenance renewal is punitive) and Google Chronicle. My expertise is in cloud cost structures, so my primary lens is TCO and the operational cost of scaling log ingestion.
The existing LogRhythm deployment costs approximately $85,000 annually for licensing and maintenance, not including the infrastructure overhead of the on-prem management console (two m5.2xlarge EC2 instances running 24/7, which is another ~$13,000/year in compute alone). The data ingestion is around 40 GB/day.
Chronicle's pricing model is fundamentally different. It's a consumption-based SaaS model on log volume. For a back-of-the-envelope calculation for 40 GB/day:
- Assume 30-day retention in hot tier: 40 GB * 30 = 1.2 TB
- Chronicle's listed price is approximately $0.50/GB per month for the hot analysis tier.
- Monthly cost: 1.2 TB * $0.50/GB = ~$600
- Annualized: ~$7,200 for the core platform.
However, this excludes several critical variables:
* Ingestion fees (if any) can be opaque.
* The cost of long-term storage if compliance requires 7+ years.
* The operational savings from eliminating server patching, log forwarding infrastructure, and the dedicated VM footprint.
From a FinOps perspective, the shift is from a large, predictable capital expense (LogRhythm renewal) to a variable operational cost. The potential savings are substantial, but you must manage the variable cost driver: log volume. Key questions for the Chronicle evaluation:
* What is the **effective cost per GB** after factoring in all fees, and does volume discounting apply?
* How does Chronicle handle and charge for **structured vs. unstructured** data? (e.g., Azure AD logs vs. raw firewall logs)
* What is the **egress cost** for data retrieval or migration if the platform is discontinued?
For a mid-market company, the lack of upfront hardware and software maintenance is a major advantage. However, you must implement strict log filtering and lifecycle policies from day one to prevent cost creep. A poorly configured ingestion could see the 40 GB/day balloon to 100 GB/day, tripling the annual cost.
I would be interested in real-world numbers from manufacturing or OT-heavy environments. Specifically:
- Actual Chronicle invoices for similar daily volumes.
- The comparative effectiveness of Chronicle's native detections for industrial protocols vs. the need to maintain custom LogRhythm AI Engine rules.
- The hidden cost of re-training your security team on a new query language (YARA-L vs. SQL).
Right-size or die