iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Some managed security service providers (MSSPs) are exploring ways to own more of their security telemetry stack, but there is no reliable figure showing how many have left licensed SIEM platforms. The appeal is control over how data is ingested, retained, analyzed, and billed—not a guaranteed reduction in total cost. Building a custom stack also means taking responsibility for the engineering and 24/7 operations that a licensed platform may otherwise provide.
Why would an MSSP move away from a licensed SIEM?
The economic pressure comes from how platform costs can track telemetry volume. Microsoft says Microsoft Sentinel analytics-tier charges can be pay-as-you-go based on data volume or handled through commitment tiers. Retention beyond what is included and other Azure infrastructure can add costs, and the applicable charges depend on the tier and configuration. Microsoft’s billing guidance puts it plainly: “Pricing is based on the tier that the data is ingested into.” Microsoft Sentinel billing documentation
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Juniper SSG 520M Security Appliance (SSG-520M-SH) | $229.00 | Buy on Amazon |
That cost shape can matter when an MSSP’s revenue from a customer does not rise in step with the volume of logs the customer sends. A provider may want more control over which sources it ingests, how long it keeps the data, and how it routes or analyzes it. A custom approach can also let the provider shape tenant workflows and differentiate its service. Those are plausible reasons to explore a change, not proof that a custom platform is cheaper or that a migration wave is underway.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Does building a SIEM mean building every component?
No. Moving away from a particular licensed SIEM does not necessarily mean replacing every commercial product or writing an entire platform from scratch. An MSSP could combine cloud services, commercial software, open-source components, and its own code. The available evidence does not establish a typical migration pattern or a standard stack used by providers.
#1 Best Overall
- Juniper ssg 520m security appliance - 4 x 10/100/1000base-t
- Juniper ssg 520m security appliance
- 4 x 10/100/1000base-t
A data platform can be one part of such an architecture, but it is not the whole security service. ClickHouse, for example, describes pricing for a database platform with separately scalable storage and compute. That does not establish that it supplies an MSSP with detection engineering, alert triage, incident response, or a complete managed security operation. ClickHouse pricing
Where do the costs go in a custom stack?
Lower or absent SIEM license charges do not erase the underlying work. The provider must account for the infrastructure and people needed to collect, process, protect, and act on telemetry. The sources do not quantify the total cost of a custom stack or establish that it saves money compared with a licensed alternative.
- Compute and storage: Processing queries and retaining data still consume resources, even if they are billed differently from a SIEM license.
- Ingestion and parsing: Pipelines must accept different sources, parse their formats, normalize fields, and recover when feeds fail or change.
- Detection content: Someone must create, test, update, and tune detection logic for the customers and telemetry the service supports.
- Operations and security: The provider must maintain availability, manage access, resolve component failures, and support incident handling around the clock.
- Usage and commitment risk: A commitment tier may not suit a workload if actual ingestion differs from the amount the provider planned to use. Storage, query, compute, and network charges also need to be included in a customer-specific estimate.
For comparison, Microsoft’s Sentinel billing documentation describes pay-as-you-go and commitment-tier options and notes that retention and other Azure infrastructure can affect the bill. Use current estimates for the actual configuration and workload rather than relying on a single per-gigabyte figure as if it applied universally. Microsoft Sentinel billing documentation
How do tenant boundaries affect the decision?
An MSSP needs to serve multiple customers without exposing one customer’s data to another or creating governance problems. Microsoft documents a Sentinel design in which a provider centrally monitors and manages multiple customer workspaces. It identifies role assignment, reduced data-ownership and privacy or regulatory challenges, minimal network latency and charges, and easier onboarding and offboarding among the design’s stated benefits. Microsoft Sentinel guidance for multiple workspaces and tenants
A provider-built stack must meet its own requirements for tenant isolation, permissions, data ownership, and regulatory obligations. The effort involved depends on the architecture and the customers’ needs; the cited documentation does not quantify that effort or establish that a custom system will satisfy a particular provider’s obligations by default.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should an MSSP compare licensed and custom approaches?
The right comparison is a workload-specific operating model, not a license line item against a database price. Evaluate each option across these dimensions:
| Decision factor | What to examine |
|---|---|
| Cost shape | Ingestion and analysis charges, retention, query and compute, storage, network, and whether commitment use matches actual demand. |
| Tenant isolation and governance | Access controls, data ownership, privacy and regulatory constraints, and the work required to onboard or offboard customers. |
| Engineering capacity | Who owns parsers, pipeline failures, normalization, detection rules, upgrades, and recovery when components break. |
| Service capability | Whether the proposed components cover only data storage and analytics or also support detection, alert handling, and incident response. |
| Flexibility and reliability | Whether the provider can maintain secure, available systems and consistent customer outcomes as it gains control over the stack. |
There is no comparative uptime or customer-outcome evidence in the cited sources. Providers therefore need to judge reliability against their own service obligations rather than assume that either a licensed or custom design will perform better.
Recommended Free Tools
Does the MSSP market data prove a SIEM migration trend?
No. The 2024 Top 250 MSSPs report search-result excerpt says nearly 90% of larger MSSPs provide their own managed detection and response (MDR) in-house. That is a finding about MDR delivery, not evidence that those providers built or migrated their SIEM. The figure should not be used as a measure of SIEM ownership or migration. MSSP Alert / CyberRisk Alliance, Top 250 MSSPs Report 2024
No reliable market-wide statistic establishes the share of MSSPs leaving licensed SIEM platforms, and the available sources do not validate before-and-after savings. Treat the movement as interest in greater control over telemetry and platform economics—not a proven majority shift.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
