Sheet 45 / Retention Cost Modeler
Digital Signet / SIEM Vendor Dossier 2026
Verified 2026-06-20
SIEM retention cost modeler
You set GB/day and retention months. You get an annual retention-loaded cost per vendor that publishes a unit price. Vendors that publish none return Quote rather than a modelled number.
| Microsoft Sentinel (Analytics) | $784,750 |
| Microsoft Sentinel (Basic Logs) | $182,500 |
| Elastic Serverless ingest | $155,125 |
| Graylog Cloud Security | $273,750 |
| Snowflake lake only | $219,000 |
| Google Chronicle (12 months hot retention bundled) | Quote |
| Sumo Logic Cloud SIEM (Flex) | Quote |
PCI-DSS (1 year) and HIPAA (6 years)
For PCI-DSS at 12 months Chronicle removes the retention line item altogether, because all three Google SecOps packages bundle 12 months of hot retention; Google publishes no rate, so the size of that saving only comes out of a quote. For HIPAA at 72 months Elastic Serverless plus self-managed cold tier or Snowflake lake-only with a detection layer beats any per-GB SIEM with a per-month archive line item.