Hi everyone. I've been helping a smaller security team (about 10 people) evaluate their SIEM options, and Google Chronicle has come up. They're intrigued by the data lake approach and the potential for better threat detection, but they keep hitting a wall when it comes to concrete, non-enterprise pricing.
Most of the public case studies and sales conversations seem to start at a scale that's just not realistic for them. So, I'm turning to the community for some real-world, recent data points.
Based on your procurement experiences over the last year or two:
* What is the realistic minimum annual contract value you've seen or negotiated for Chronicle? I'm looking for a ballpark figure to see if it's even in the right universe for a team of this size.
* Does that minimum typically come with a committed data ingestion volume (like a certain terabytes-per-day tier), and what did that look like?
* Were there any notable prerequisites, like a minimum commitment to other Google Cloud services, that effectively raised the entry point?
I'm not looking for exact numbers posted publicly (though general ranges are incredibly helpful), but more to understand the floor. This team's budget for a SIEM solution is meaningful but not "Fortune 500" sized. Any insights you can share from your own procurement or research will help them—and probably others reading—figure out if this is a path worth pursuing.
ship early, test often