Splunk vs Sentinel vs Elastic vs Graylog: which SIEM fits
Choose Microsoft Sentinel if you already live in Microsoft 365 and Azure. Choose Splunk if you need the deepest search and have the budget and people to run it. Choose Elastic if you have engineers who like running search clusters. Choose Graylog if you mainly need central logging with security on top, on a small team.
The four at a glance
| Platform | Fits best | Licensing shape | Effort to run |
|---|---|---|---|
| Splunk | Large or regulated estates, mature SOCs | Ingest volume, or a workload-based option | High on-premises, lower as a cloud service |
| Microsoft Sentinel | Microsoft 365 and Azure shops | Data ingested and retained | Low infrastructure, steady cost watching |
| Elastic | Teams with search engineering skills | Free tier; paid tiers by resources or usage | High self-managed, moderate hosted |
| Graylog | Smaller teams centralizing logs | Free open edition; paid editions add security features | Moderate |
Licensing terms change often. Treat the middle column as the shape of the meter, and read the current terms on each vendor’s own page before you budget.
Splunk: deepest search, highest running cost
Splunk’s search language is strong for ad hoc investigation, and it has a large app ecosystem and a deep pool of analysts who already know it. It has long been licensed on daily ingest, with a workload-based alternative now offered as well.
The catch is that ingest pricing makes every noisy log source a budget decision. Teams end up dropping the logs they would need in an incident.
Microsoft Sentinel: the default for Microsoft estates
Sentinel is a cloud-native SIEM that runs in Azure and queries with KQL. Its connectors for Entra ID, Defender and Microsoft 365 are quick to switch on, and Microsoft publishes which of its own data sources are free to ingest in the Sentinel billing documentation.
There is no infrastructure to run. Cost grows with data ingested and kept, so someone has to watch retention and filter third-party sources before they arrive.
Elastic: flexible, if you can run it
Elastic Security sits on the Elasticsearch, Logstash and Kibana stack, often called ELK. The free tier includes a detection engine and a large set of prebuilt rules; the subscription tiers add machine learning and other features.
Self-managed Elastic is priced on resources rather than data volume, which suits high-volume logging. The cost moves into engineering: sizing, upgrades and cluster health are yours to own.
Graylog: central logging first
Graylog began as a log management tool and is still easiest to justify on that basis. The free open edition collects, parses and searches logs well. Security analytics, correlation and prebuilt detection content sit in the paid editions.
It is simpler to operate than a self-managed Elastic cluster. Its detection library is smaller than Splunk’s or Sentinel’s, so expect to write more rules yourself.
What matters more than the platform
Every one of these can miss an intrusion. The deciding factors are which logs you feed it, whether the fields parse, and whether anyone tunes the rules after go-live. A well-tuned Graylog is more useful than a neglected Splunk.
Measure coverage against attacker techniques rather than rule counts. Mapping detections to MITRE ATT&CK shows how.
Questions we are asked
Which SIEM is best?
There is no best SIEM in general. The right one is the platform your team can feed, tune and afford at the data volume you actually produce, and that usually follows from where your systems already live.
Which SIEM is cheapest to run?
It depends on your data volume. Look at what is metered, not at the list price. Ingest-based licensing punishes noisy log sources, so the real cost depends on how much you collect and how well you filter it before it arrives.
How hard is it to switch SIEM platforms?
Switching is possible but slow. Rules, parsers, dashboards and analyst habits are all written in one platform’s query language, and they have to be rebuilt, not copied, which is why most teams tune what they have before they migrate.
Is a free SIEM good enough?
It can be, for a small team with engineering time to spare. Elastic and Graylog both have free editions that collect and search logs. They cost engineering time instead of licence fees, and the detection content and support are thinner than in the paid tiers.
Getting more from the SIEM you have
We sell none of these platforms. Our SOC and SIEM detection engineering work tunes whichever one you run. If a managed provider runs it for you, vCISO, CISO or MSSP covers what they own. More comparisons are on writing.