SIEM vendor FAQ

Procurement questions, answered tersely.

What is the difference between a SIEM, an XDR, and a SOAR in 2026?

A SIEM ingests, indexes, and queries security telemetry across the estate. An XDR is a vendor-bounded detection-and-response stack typically anchored on endpoint plus identity. A SOAR is the orchestration layer that sits above either. In 2026 the lines blur: Cortex XSIAM and CrowdStrike Falcon Next-Gen SIEM are positioned as SIEM replacements for endpoint-led shops; native SOAR is bundled into most large SIEMs.[1]

Why do most SIEM vendors not publish prices?

Because Workload Pricing, Flex scan credits, and per-event/per-asset/per-identity bundles let the floor move per-quarter without re-papering the contract. Two vendors moved further in 2026: Google retired the per-employee Chronicle model and now prices its SecOps packages on ingestion volume with no rate card, and Sumo Logic's Flex model stopped charging for ingest altogether and bills on data scanned instead. The procurement answer is to request the vendor's pricing worksheet (Splunk SVA, Microsoft Sentinel Commitment Tier scenario, Sumo Logic Flex pricing calculator) before signing.[1]

What changed with Cisco's $28B Splunk acquisition for existing customers?

Renewal posture firmer. A 35-50% list-price uplift on multi-year renewals at the upper enterprise band is the channel-reported number. Cisco XDR and SecureX cross-sell is now standard inside larger Cisco enterprise agreements.[1]

Is Microsoft Sentinel really a SIEM, and is it free with E5?

Yes it is a SIEM. It is not free with E5, but E5 includes a 5 MB/user/day free Sentinel benefit and Defender XDR data ingested into Sentinel is free. At 1,000 users that is 150 GB/month of free ingest. For most Microsoft-aligned mid-market shops the floor is well under what they thought.[1]

How long does a SIEM migration take?

Plan for 4-6 months of parallel-run for a 500 GB/day estate. The dominant cost is content rewrite, not data move. Professional services overhead typically runs 15-25% of first-year SIEM cost.[1]