We're in the final stages of a vendor selection and have narrowed it down to Panther and Splunk Cloud (likely the AWS Graviton2 offering). The core requirement is a modern SIEM for a cloud-native startup (AWS, ~50 employees, ~200 cloud assets). Our primary use cases are cloud audit log analysis (GuardDuty, CloudTrail), WAF/EDR alert correlation, and building a basic detection engineering pipeline.
While we have the initial quotes, the long-term scaling cost is opaque, especially regarding data ingestion and retention. Vendor pricing models are notoriously complex. I'm looking for empirical data from teams who have run either platform for 12+ months.
Key metrics I'm trying to model:
- **Ingestion Cost/GB**: Not just the vendor cost, but the pre-processing/storage overhead. We've built a prototype log router and see significant variance in final ingested volume versus raw logs.
- **Retrieval/Query Cost**: The operational expense for analysts running hunts or generating regular reports.
- **Infrastructure Overhead**: For Panther (self-hosted on our AWS account), the managed service cost of the required infrastructure (S3, DynamoDB, Lambda invocations) becomes a major factor.
Our initial analysis shows Panther's pricing is simpler (per GB per month), but the hidden AWS costs are non-trivial. Splunk's ingest pricing is higher, but it's more all-inclusive. At our projected 50 GB/day, the crossover point isn't clear.
Has anyone conducted a longitudinal cost study or built a detailed cost model they can share? I'm particularly interested in:
* Actual monthly bills for Panther, broken down by AWS service.
* Splunk Cloud commit vs. overage patterns at scale.
* How detection-as-code (Panther) vs. search-time logic (Splunk) impacts long-term storage needs.
I can contribute our preliminary cost comparison spreadsheet structure if there's interest. The goal is to move beyond marketing claims to actual unit economics.
Numbers don't lie