Graylog vs Elastic Security: when each SIEM fits
Choose Graylog Security when your estate already runs Graylog and you want a SIEM layer on top of it. Graylog Security is a paid edition priced from 18,000 US dollars a year, on top of the SSPL licensed Graylog Open core, and it adds risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content. Stream and pipeline routing is the strength here: if your team already sorts syslog, GELF and Beats traffic into streams and processing pipelines, the SIEM features extend a workflow your operators know. Choose Elastic Security when you already run Elasticsearch or Kibana, or when you want endpoint protection delivered through Elastic Agent and Fleet, since Elastic Defend sits in the same agent that collects logs. Elastic Security's detection engine, prebuilt rules and Elastic License 2.0 terms are the main reasons to pick it on a greenfield build. Confirm before you commit which Elastic subscription tier you need, because the self-managed page lists Platinum as no longer sold to new customers and places endpoint prevention and SAML or OpenID Connect single sign-on under Enterprise.
The decision turns on four things. First, the existing stack: a team with a working Graylog cluster gains more from Graylog Security than from a parallel Elastic deployment, and the reverse holds for a team already operating Elasticsearch. Second, the paid tier you need: list the features your auditors and detection engineers actually require, such as archive restore, correlation, SSO or endpoint prevention, and map each one to the edition or subscription that includes it. Third, license terms: SSPL and Elastic License 2.0 are both not OSI approved, so ask legal to review how each applies to your internal use and any managed service you plan to offer. Fourth, the operating effort of the storage backend. Graylog 7.2 recommends Data Node as the search backend and needs MongoDB for configuration, while Elastic Security runs on Elasticsearch with its own cluster sizing. Ask both vendors, or your implementation partner, for a sizing worksheet based on your daily ingest and retention, and compare the number of components each one asks your team to patch and back up.
Which SIEM fits your team: scenario by scenario
This table matches common team situations to the platform that usually fits better and names the condition that would change that answer. Read each row as a starting point, then check the licensing and feature conditions against your own environment and written quotes before deciding.
| Scenario | Better fit | Why and what changes the answer |
|---|---|---|
| Existing Graylog estate with analysts working in streams and pipelines | Graylog | Streams, pipelines and event definitions are already how your team works. Staying avoids retraining, but correlation, archive restore and prebuilt detection content sit in paid Graylog Enterprise or Graylog Security, so confirm which edition you need. |
| Existing Elasticsearch or Kibana estate with Elastic Agent deployed | Elastic Security | Detection rules, Timeline and Cases can run on the stack you already operate. The answer changes if you need Graylog's log routing, or if your team does not want to adopt Elastic's licensing tiers. |
| Greenfield self-hosted SIEM with no existing log platform | Depends on team skills | Graylog suits teams that want a log-first workflow with a paid SIEM tier added later. Elastic Security suits teams comfortable operating Elasticsearch and Kibana. Pilot both against your own log volumes before choosing. |
| Endpoint malware prevention and host isolation required | Elastic Security (paid tier) | Elastic Defend covers this, but malware and ransomware prevention and host isolation are listed under Enterprise, not the free Basic tier. Graylog does not offer equivalent endpoint prevention in the facts we hold, so confirm with the vendor if this is a hard requirement. |
| SAML or OIDC single sign-on required | Elastic Security (paid tier) | Elastic lists SAML and OpenID Connect single sign-on under Enterprise. Graylog Enterprise and Security editions add SSO features, so confirm the exact protocols and editions for your identity provider with Graylog before relying on either platform. |
| Team wants MITRE ATT&CK mapped rules out of the box | Confirm with each vendor | Graylog Security describes MITRE ATT&CK mapped rules as part of its paid detection content. Elastic publishes prebuilt detection rules through its detection-rules repository. Compare rule coverage and mapping depth directly on each platform. |
| Strict open-source license requirement | Elastic Security (AGPLv3 or SSPL option) or neither as default | Elastic offers Elasticsearch and Kibana source under AGPLv3 as well as the default Elastic License 2.0. Graylog Open uses SSPL, which is not OSI approved. Check your legal team's position on each license before shortlisting. |
How each stack is built and what it asks you to run
Both stacks sit on the same search technology family, but the parts you run differ. Graylog wraps its own server nodes around a separate search backend, while Elastic Security ships agents, detection content and endpoint protection on top of Elasticsearch and Kibana. Each card below names a component and the operating duty it creates for your team.
Graylog server nodes and MongoDB
Graylog server nodes handle inputs, streams, pipelines, alerting and the web interface, and MongoDB holds configuration and metadata. Your team patches both, manages the MongoDB replica set and keeps server versions aligned with the Graylog 7.2 compatibility matrix. Check who owns MongoDB backups and failover before you commit, because a Graylog outage often starts with the metadata tier rather than the log tier.
Graylog Data Node or self-managed OpenSearch
Log data lives in a search backend, and Graylog recommends Data Node for this role. Data Node installs and manages OpenSearch for you, while self-managed OpenSearch leaves certificates, cluster membership and version upgrades with your team. OpenSearch 1.x is deprecated since Graylog 7.0 and removed in Graylog 8.0, so any cluster still on 1.x is a migration item, not a steady state.
OpenSearch 2.0 for Graylog Security
Graylog Security requires OpenSearch 2.0 or later, so the SIEM edition sets a floor on your search backend version that Graylog Open does not. Before buying Security, confirm which backend version your current cluster runs and whether a move to Data Node or a newer OpenSearch line is needed. Treat that upgrade as part of the project scope, since it changes the storage layer your existing dashboards and retention rules depend on.
Elasticsearch and Kibana on 9.x
Elastic Security runs on Elasticsearch and Kibana, and the current release lines are 9.5.5 and 9.4.8, released October 6, 2026, with 8.19.23 still maintained. Your team owns cluster sizing, index lifecycle, snapshot policy and the upgrade path between lines. Confirm which line your security content and Elastic Agent versions support before picking a target, because mixed versions across agents and clusters are a common source of detection gaps.
Elastic Agent and Fleet management
Elastic Agent is the single agent that collects logs, metrics and security data, and Fleet manages its policies centrally. Fleet reduces per-host configuration work, but your team still owns the Fleet server, agent enrollment keys and certificate rotation. Ask who issues and renews the certificates between agents, Fleet and Elasticsearch, since expired certificates stop data collection quietly on the endpoint side.
Elastic Defend endpoint protection
Elastic Defend is the endpoint detection and response component, and it adds a second operating surface on each protected host. Endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on sit in paid Elastic subscriptions, so the endpoint tier determines what you can enforce. Confirm which features your license covers, and test host isolation in a non-production group before relying on it during an incident.
Detection content, identity and endpoint features side by side
This table compares the SIEM-layer features each platform offers, from detection content and correlation to endpoint protection and SSO. Read the rows where a cell says to confirm: those capabilities are either not covered by the public facts we reviewed or depend on edition and deployment choices. The main takeaway is that Graylog's SIEM features sit in its paid Security edition, while Elastic splits its security features between Basic and Enterprise tiers.
| Capability | Graylog (Open, Enterprise, Security) | Elastic Security (Basic, Enterprise) |
|---|---|---|
| Detection content source | Prebuilt threat detection content is part of Graylog Security, not Graylog Open. Confirm the content source, update cadence and licensing terms with Graylog. | Prebuilt rules are developed in the public elastic/detection-rules repository and delivered to the Kibana detection engine automatically. |
| Prebuilt rules | Included in Graylog Security as prebuilt threat detection content. Ask Graylog which rule sets and mappings ship in each edition. | Prebuilt rules ship with the detection engine and can be customized. Confirm which rules are available on your tier. |
| Custom rules | Graylog Open provides event definitions for alerting. Confirm how far custom SIEM detection logic can go in Open versus Security. | Custom detection rules are supported alongside prebuilt rules. Confirm rule types and any tier limits with Elastic. |
| Correlation | Correlation engine is listed under Graylog Enterprise, with Security adding SIEM features on top. Confirm which correlation features are in each paid edition. | Detection engine supports correlation, indicator match and threshold rules on the subscriptions page. Confirm rule-type availability by tier. |
| Anomaly detection | Anomaly detection is listed under Graylog Security. It is not part of Graylog Open. | Machine learning anomaly detection was listed under Platinum, which is no longer sold to new customers. Confirm the current path for new self-managed buyers. |
| Case management and investigations | Investigations are listed under Graylog Security. Ask how they compare with case workflows in other tools you run. | Timeline and Cases are part of Elastic Security. Confirm which case features are included in your chosen tier. |
| Endpoint protection | Graylog does not list an endpoint agent in the supplied facts. Confirm whether any host-level protection is offered before assuming coverage. | Elastic Defend and Elastic Agent provide endpoint protection, with malware and ransomware prevention under Enterprise. Confirm exact coverage per operating system. |
| Host isolation | Not listed in the supplied facts. Confirm with Graylog whether host isolation exists in any edition. | Host isolation is listed under Enterprise on the self-managed subscriptions page. Confirm response actions with Elastic. |
| SSO protocols | Graylog Enterprise and Security editions are paid. Confirm the supported SSO protocols for your edition in the Graylog user authentication documentation. | SAML and OpenID Connect single sign-on are listed under Enterprise. Confirm the setup steps for your deployment. |
| Paid tier placement | Graylog Enterprise starts at 15,000 US dollars per year and Graylog Security at 18,000 US dollars per year, per the Graylog pricing page. Both have a 10 GB per day or 100 Compute Unit minimum. | Detection engine and case management sit under Platinum (no longer sold), while endpoint prevention, host isolation and SSO sit under Enterprise. Confirm current pricing and tier options with Elastic. |
What the license and paid tiers mean for each option
Graylog Open is licensed under the Server Side Public License version 1 (SSPL-1.0) starting with Graylog 4.0 in 2020, replacing the GPL v3 used by earlier releases. SSPL is not OSI approved, so legal and procurement teams that require OSI open source should treat Graylog Open as source available. The paid editions are where SIEM functionality sits.
- Graylog Open: free with no volume limits and community support, but it does not include archiving, correlation, reporting or prebuilt Illuminate detection content.
- Graylog Enterprise: starts at 15,000 US dollars per year and adds a data lake with archive restore, data tiering, a correlation engine and 24/7 support.
- Graylog Security: starts at 18,000 US dollars per year and adds risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content.
- Licensing basis: both paid editions carry a minimum of 10 GB per day or 100 Graylog Compute Units and are licensed on processed data, with no per-user or per-device fees.
- Quote scope: ask whether your daily volume or Compute Units determine the tier, and whether Graylog Security requires a specific Enterprise baseline.
Confirm the current price, the minimum volume terms and the licensed feature list in a written order form before you size the budget, because pricing pages can change between renewals.
Elasticsearch and Kibana are distributed under the Elastic License 2.0 by default, with SSPL 1.0 and AGPLv3 also offered for the source code, with AGPLv3 added in 2024 before the 8.16 release. Elastic Security runs on that stack, so the license you accept covers the platform, and the paid tier you buy determines which security features you can use on self-managed deployments.
- Basic (Free and open): the no-cost self-managed tier from Elastic's subscription page.
- Platinum: lists the detection engine, machine learning anomaly detection and case management, but Elastic states it is no longer sold to new customers.
- Enterprise: lists endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on.
- Buying path: new self-managed buyers of paid security features choose between Basic and Enterprise, or move to Elastic Cloud.
- Verification: confirm in writing which tier includes the detection engine, prebuilt rule updates and alert suppression for your version, since tier placement is the point most likely to differ from older materials.
Elastic's detection rules are developed in a repository licensed under the Elastic License v2, and prebuilt rules reach the Kibana detection engine automatically. Ask Elastic to confirm which rule content and features your Basic or Enterprise subscription entitles you to receive and update.
Compare the two stacks on the terms that actually drive cost and legal review, not on the headline 'free' label. Graylog Open is free software in price terms but not OSI open source, and its SIEM features are paid. Elastic Basic is free, but detection, machine learning and endpoint protection depend on which subscription you hold for a self-managed deployment.
- Open source status: both core licenses are not OSI approved in every offering, so legal review should cover each component you deploy.
- Paid unit: Graylog bills on processed data with a volume minimum, while Elastic subscriptions are sold per its own subscription terms.
- Recurring costs: both carry annual subscription fees for paid features, and both require your own infrastructure costs for storage and compute.
- Feature dependence: if you need endpoint isolation or SSO on self-managed Elastic, the Enterprise tier is the reference point; if you need Graylog archiving or correlation, the Enterprise or Security edition is.
- Switching exposure: moving between a Graylog edition and an Elastic tier later means new licenses, new rules and re-tuned alerts.
Before comparing totals, ask each vendor for a written quote that lists every feature you need by name and the license tier that includes it.
What drives the running cost of each SIEM
The running cost of a Graylog deployment is mostly the search backend and the paid layer, and the two grow with data volume rather than user count. Graylog Security is priced from 18,000 US dollars per year on processed data, with a minimum of 10 GB per day or 100 Graylog Compute Units, according to the Graylog pricing page, and has no per-user or per-device fees. Ask the vendor how the processed-data measure is counted for your sources, what the yearly tier covers at your daily volume, and whether the Data Node or OpenSearch cluster is included or must be sized separately. Storage is the largest recurring infrastructure line. Graylog's system architecture guidance sizes log storage as daily ingest times retention days times 120 percent, and recommends giving the message journal 3 to 5 times daily ingest on SSDs. Each extra day of retention therefore adds disk on every search node, and a longer retention window is usually the fastest way to raise the bill.
Elastic Security costs follow a different shape. Its paid features are split across subscriptions: under the self-managed subscriptions page, the detection engine, machine learning anomaly detection and case management sit under Platinum, which is no longer sold to new customers, while endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on sit under Enterprise. A new self-managed buyer therefore prices an Enterprise subscription against the features it needs, or moves to Elastic Cloud. Confirm in writing which tier includes each detection and endpoint capability you plan to use, whether subscription pricing is per node, per resource or per data volume, and how renewals and tier changes are billed. Elasticsearch storage, hot and warm tiers and retention settings still drive hardware or cloud spend in the same way they do for Graylog.
Staff time is the recurring cost most often left out of the comparison. Graylog's multi-node guide recommends three Graylog and MongoDB nodes with MongoDB as a replica set, plus three Data Nodes on their own cluster and a load balancer, so the same platform now has six or more servers to patch, certify and back up before any log is searched. Upgrades, certificate rotation and cluster membership changes recur on each release cycle; Graylog 7.2.0 and Elastic 9.5.5 are current examples of the cadence to plan for. Ask any implementation partner, DeployOpen included, for a fixed-scope written quote that separates one-time work (design, installation, content tuning, migration) from recurring work (upgrades, retainers, testing), and states which of those items your own staff would otherwise carry.
Moving from Graylog to Elastic Security or back
This sequence moves detection, alerting and retained log data between Graylog and Elastic Security without losing track of what was rebuilt. It ends with the old platform's indices and retention settings retired on purpose, not by accident.
Inventory inputs, streams and pipelines
Start by listing every log source feeding the current platform, including syslog, GELF and Beats inputs in Graylog or the Elastic Agent and Fleet integrations in Elastic Security. For each source, record which streams and processing pipelines parse, route and enrich its messages, because these define the field names your searches and rules depend on. The output is a source register with one row per input, its parsing logic and its owner, reviewed by the security operations lead and the platform engineer who runs the pipelines today. The step is done when every active source has a row and no pipeline is unexplained.
Document event definitions, dashboards and retention
Export a full list of Graylog event definitions, dashboards and index rotation and retention settings, or the equivalent Elastic Security rules, Kibana dashboards and index lifecycle policies on the other side. Note which items are real-time and which run over historical data, since the two platforms handle scheduled and historical checks differently. Involve the detection engineer and the compliance lead, because retention settings often carry evidence obligations. The output is a documented baseline that states what each alert and dashboard is for. Confirm the retention periods your policies require before you map anything.
Map detection content to the target rules
Match each existing alert and correlation to a rule on the target platform. Elastic Security ships prebuilt detection rules that are developed in the elastic/detection-rules repository and delivered automatically, so compare that catalog against your own event definitions instead of assuming a one-to-one match. Graylog Security's prebuilt threat detection content and Graylog Enterprise's correlation engine are paid features, so check which of your rules depend on them before you plan the mapping. The output is a gap list that marks each rule as matched, partly matched or missing. Mark any rule without a clear equivalent as a design decision, not a copy task.
Rebuild identity and role mappings
Recreate who can see which streams, indices, dashboards and rules on the target platform. Graylog's authentication options and Elastic's single sign-on and role model use different structures, so map each existing group to a target role rather than exporting user records. Elastic's SAML or OpenID Connect single sign-on sits under the Enterprise subscription on self-managed deployments, so confirm the license tier before you design the login path. The output is a role matrix signed off by the identity owner, plus a test account for each role. The step is done when every role can reach its expected data and nothing more.
Rebuild alert tuning in the target platform
Rebuild the rules, thresholds, suppression and notification routes on the target platform, and test each one against historical events where the platform supports it. Expect this to be the largest manual step, because rule logic and alert tuning are usually rebuilt rather than transferred. Notification channels such as PagerDuty, Slack and email need new connectors and new credentials on the other side. Confirm with each vendor which rule export formats are supported and how far they carry thresholds and notifications before you assume any rule can be moved as a file. The output is a tested rule set with a change record for each rule.
Run both platforms in parallel
Feed the same sources to the old and new platforms for a period you set in the cutover plan, and compare alert counts, false positive rates and search results for the same events. Parallel running shows whether the rebuilt rules fire on the events that matter and stay quiet on noise. Have the security operations lead review the differences each week and record every rule that needs tuning. The output is a parallel-run report that states the agreed exit criteria, such as no unexplained gaps for critical alerts. Do not cut over until those criteria are met.
Cut over sources in controlled batches
Move log sources to the new platform in batches, starting with the lowest-risk sources and ending with those that feed critical detections. Update each forwarder or agent configuration, confirm events arrive with the expected fields and check that the matching rules fire. Keep a rollback path for each batch until its checks pass. The output is a cutover log that records each source, its change date, the owner who approved it and its verification result. The step is done when every source appears on the target platform and the old forwarders are disabled.
Retire old indices and retention settings
After the old platform has been idle for your agreed retention window, decide what happens to the stored data. Raw logs transfer only if you keep and re-index the old indices or export them into an archive the new platform can read, so confirm the export and archive formats with each vendor and with your auditor before deletion. Then remove old index rotation, retention and archive settings, disable stale event definitions and revoke retired service accounts. The output is a decommissioning record that names every deleted index set, the retention basis for each and the approver. Keep this record with your compliance evidence.
Where SIEM implementations usually run long
The schedule for either platform is set less by installation than by the work that follows it. On the Graylog side, installation itself is straightforward: packages for Ubuntu, Red Hat, SUSE and Debian, or Docker Compose, as the Graylog installation guide describes. The multi-node layout takes more planning. Graylog recommends three Graylog and MongoDB nodes with MongoDB as a replica set, three Data Nodes in their own cluster, a load balancer, and is_leader set to false on every follower Graylog node. Decide early whether to use Graylog Data Node or a self-managed OpenSearch cluster as the search backend, because that choice determines who patches, certifies and upgrades the indexing layer. Confirm the supported OpenSearch range for your Graylog version before you build anything.
On the Elastic side, the first milestone is Fleet enrollment, where Elastic Agent is enrolled and managed centrally. Each host then receives one or more Elastic Agent policies, and Elastic Defend is attached to the policies that cover endpoints. Policy design is where teams lose time: deciding which hosts get which integrations, which policies enable prevention and which only collect, and how changes roll out. The prebuilt detection rules are the next source of delay. They are delivered to the Kibana detection engine automatically, which is useful, but the initial alert volume usually needs tuning through rule exceptions and alert suppression before analysts can trust the queue. Plan a tuning phase for both platforms rather than treating the default rule set as ready for production.
Five areas drive most overruns regardless of platform. Log source onboarding is the largest: every source needs an owner, a transport and an agreed retention period. Parsing and field mapping follow, because detections are only as good as the fields they read, and inconsistent field names across sources stall correlation work. Alert tuning is continuous, not a single phase. Storage sizing is often underestimated; Graylog's architecture guidance suggests daily ingest multiplied by retention days and by 120 percent, plus a message journal of 3 to 5 times daily ingest on SSDs, so confirm ingest volumes with your own traffic data before you commit to hardware. Identity integration comes last and is frequently the slowest, since single sign-on and role mapping depend on your identity provider. Check which SSO options your chosen edition includes before the project starts, and ask your partner to put each area in the written scope.
Graylog vs Elastic Security questions buyers ask before hiring help
Is Graylog Security or Elastic Security cheaper to run?
Neither is cheaper in general, because the answer depends on what you already run and how much data you ingest. Graylog Security is priced from 18,000 US dollars per year according to the Graylog pricing page, with a minimum of 10 GB per day or 100 Graylog Compute Units, on top of the free SSPL-licensed Graylog Open. Elastic Security's self-managed cost depends on which subscription tier you buy, so ask Elastic for a quote against your data volume. Model both on processed data, server hardware, storage, and the staff hours to operate each stack.
What does the paid tier actually add on each side?
On the Graylog side, Graylog Security adds SIEM features such as risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content, according to Graylog's product pages. On the Elastic side, the detection engine, machine learning anomaly detection and case management sit under Platinum, which Elastic no longer sells to new customers, while malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on sit under Enterprise. Confirm in writing which features each tier includes before you compare totals.
Should we extend our existing Graylog or Elasticsearch estate or replace it?
Extend the estate when its storage, retention and data sources already meet your detection needs, because replacing a working log pipeline adds migration risk and parallel running costs. Replace it when the paid SIEM layer you need does not fit the current stack, or when the stack's license terms conflict with your policy. Graylog Security needs OpenSearch 2.0 or later according to the Graylog compatibility matrix, so check your current search backend version first. Document your retention, rule set and alert routing before any decision.
How long does a Graylog vs Elastic Security implementation take?
Duration depends on scope: the number of log sources, the detection content you need, the storage architecture and whether you move existing rules. No supplied figure gives a typical timeline, so ask any implementation partner for a timeline in the written scope rather than relying on a general estimate. A single-node test build differs greatly from a multi-node production cluster with a separate Data Node or OpenSearch tier. Agree on acceptance tests for detections and retention before work starts.
What does the work need from our internal team?
Plan for named owners across infrastructure, search storage, detection engineering and on-call response. On Graylog, the team operates MongoDB for configuration, Graylog server nodes and the search backend, and must size storage using daily ingest multiplied by retention days and 120 percent, as the Graylog system architecture page advises. On Elastic, the team manages Elasticsearch, Kibana, Fleet and Elastic Agent policies. Ask a provider to name which tasks it handles and which remain with your staff after handover.
Can our team implement and run this without outside help?
A team with Linux, search cluster and detection engineering experience can often do it internally, but the decision depends on skills, time and the number of data sources. Start with a small pilot that ingests one source, tunes one detection, and tests one alert path end to end. Track how much time upgrades, certificates and rule tuning consume. If that load exceeds available staff, a fixed-scope engagement with written deliverables may suit you better than an open-ended retainer.
Do SSPL or Elastic License 2.0 terms affect our organization?
For most internal use, the license terms affect your obligations only when you redistribute the software or offer it to others as a service. Graylog Open is SSPL-1.0 under the Graylog LICENSE file, and SSPL is not OSI approved, so have counsel review it against your policies. Elasticsearch and Kibana are available under Elastic License 2.0 by default, with SSPL 1.0 and AGPLv3 also offered, according to Elastic's licensing FAQ. Ask your legal team to confirm which terms apply to your deployment model.
How DeployOpen helps choose, implement or migrate
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure. For a Graylog vs Elastic Security decision, we work from your existing log sources, storage backend and detection requirements, then deliver a written scope before any build begins.
How we scope
- Map which log sources, detection use cases and retention periods the SIEM must cover
- Confirm whether the team already runs Graylog, Elasticsearch or OpenSearch and what must be reused
- Identify which paid edition features are required, and document the licensing terms that apply
- Agree deliverables, timelines and acceptance criteria in writing before any work starts
How we build
- Deploy the chosen stack in your cloud accounts, data centers or air-gapped networks
- Configure inputs, pipelines or integrations, and tune detection content against your own log data
- Run security testing against the detection and access paths, including AI and agent components where present
- Size storage and nodes from your ingest volume and retention, and record the assumptions used
How we hand over
- Deliver architecture, configuration and runbook documentation written for your operations team
- Walk your engineers through alert triage, rule changes, backup and restore procedures
- Provide evidence and control documentation to support your own compliance assessors
- Leave ownership of accounts, keys and licenses with your organization at handover
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover
- Plan version upgrades against the vendor's current release lines and compatibility matrix
- Review detection coverage and license tier needs as log volume and team size change
- Confirm support scope, response expectations and exclusions in the retainer agreement before signing
