What a SIEM costs when you build it yourself, hire a partner or buy SaaS
The core software license for Wazuh, Graylog Open and OpenSearch is zero, so the money you spend goes to ingest, retention, storage, compute and detection engineering. Those cost components scale with how many gigabytes per day you collect, how long you keep them searchable, and how many people write, tune and maintain the detections. The answer depends on your daily ingest, your retention period, the skills already on your team and the constraints of your deployment, such as air-gapped networks or data residency rules. DeployOpen does not publish a price list, so this section gives no figure. Each quote follows from a written scope, and the sections below show which lines belong in that scope.
Split the total into one-time and recurring costs before you compare options. One-time costs include design, initial deployment, onboarding of log sources and the first set of detection content. Recurring costs include hardware or cloud capacity, storage growth, upgrades, backups, support and staff time for alert triage. In a self-built deployment your team pays for all of them directly. With a partner, you pay for the implementation and any retainer for ongoing operation, while the platform itself remains yours. With a SaaS SIEM, the vendor bills for ingest or workload and the retention tiers, and your costs shift toward data onboarding and detection tuning. Ask any vendor or partner to show the assumed daily ingest, retention in days for hot and archive storage, and who is responsible for each recurring line.
Which cost components sit with you, a partner or a SaaS vendor
This table compares who carries each SIEM cost component under three models: building on open source yourself, having a partner implement and run it, or buying a SaaS SIEM. Read each row as a question of who pays and whether the cost is one-time or recurring. The main takeaway is that open source removes the license line but moves storage, detection work and upkeep onto whoever operates the platform.
| Cost component | Build in-house | Partner implements and runs | SaaS SIEM |
|---|---|---|---|
| Software license | Open source core, usually no license fee for the platform itself; check the license of each component and any paid edition | Partner fee for the platform plus any paid edition you choose; confirm whether the partner resells licenses or passes through software at cost | Subscription, often priced on ingest, retention or workload; confirm the metering unit and any overage rules in writing |
| Infrastructure for storage and compute | You pay cloud or hardware for indexers, servers and storage, recurring; scales with daily ingest and retention | Same infrastructure cost, usually billed to you directly or inside the partner quote; confirm who owns the accounts | Included in the subscription or metered separately; long retention often bills at a higher storage rate |
| Implementation and integration | Internal engineering time, one-time for initial build, then recurring for changes | Fixed-scope project fee, one-time, covering architecture, deployment and initial parsers; confirm what is excluded | Vendor onboarding and professional services, often one-time; confirm whether connectors are included |
| Log source onboarding | Your staff build each parser and agent rollout, recurring as new systems appear | Included in scope for agreed sources; new sources usually need a change request | Connectors may be included or charged by volume; confirm which sources are covered |
| Detection content and tuning | Your analysts write, test and tune rules continuously, the largest recurring staff cost | Partner may write initial rules and tune them under retainer; ownership of rules should be stated in the contract | Vendor provides prebuilt content; custom rules and tuning are often your staff or a paid service |
| Upgrades and patching | Your team tracks releases and tests them; Wazuh and OpenSearch both publish frequent patch releases | Covered under a support retainer if contracted; confirm the upgrade window and test environment | Handled by the vendor, but you still test custom content and integrations after changes |
| Support | Community support or an internal on-call rotation, recurring staff time | Support tier agreed in writing, recurring; confirm response targets, which the contract should state | Vendor support tiers, recurring within the subscription; confirm after-hours coverage |
| Staff time | Dedicated SOC and platform engineers, recurring; hardest to forecast | Smaller internal team for analysis and oversight, recurring | Smaller platform team, but analysts still investigate and tune; plan for ongoing SOC time |
What moves the cost of a self-hosted SIEM up or down
A self-hosted SIEM is priced mostly by the infrastructure it runs on and the people who keep detections working, so the same platform can cost very different amounts depending on a few choices. The six drivers below are the ones to fix in writing before you compare build, partner and SaaS quotes.
Daily ingest volume
Ingest sets the size of almost every other line item. Storage, indexer nodes, message processing capacity and network transfer all grow as the number of gigabytes per day grows, so a quote is only comparable when it states the daily volume it assumes. Ask each vendor or partner to show the daily figure per source class, including firewalls, cloud audit trails and endpoint telemetry, which are often the largest contributors. Ask whether the figure is measured before or after any filtering.
Retention split between hot and archive
Retention is the multiplier on ingest. Graylog's architecture guidance sizes log storage as daily ingest times retention days times 120 percent, so doubling retention roughly doubles the storage bill. Keeping the most recent months on fast, searchable indices and moving older data to cheaper archive storage changes the hardware and restore process. Confirm with the partner which retention periods your regulator or auditor requires, how long each tier must stay searchable, and who pays for restore time when an investigation reaches back.
Number and type of log sources
Each source adds agent licences where they apply, parsing and decoder work, dashboard content and ongoing maintenance when a vendor changes its log format. Agents are free on Wazuh, but the labour to deploy, update and test them is not. Agentless sources such as firewalls and network devices need syslog collection and API polling, which adds collector capacity. Ask for a source inventory with a named owner for each source, and ask who maintains parsers when an upgrade changes a field name.
Detection engineering scope
Detection content is the largest recurring labour cost after infrastructure. Writing correlation rules, tuning noisy alerts, mapping detections to controls and testing them after each platform upgrade takes skilled analyst time every month, whichever platform you choose. Open-source platforms ship with rule libraries, but the rules still need to match your environment. Ask a partner to state the number of use cases in scope, who writes and tunes them, and whether tuning is included in the fixed scope or sold as a retainer.
High availability and cluster size
Redundancy multiplies the infrastructure line. Graylog's multi-node guide for medium to large deployments describes three Graylog and MongoDB nodes, three Data Nodes on their own cluster and a load balancer, which means roughly double the hosts of a single-node lab. Wazuh can run as a cluster for horizontal scaling. Ask whether the quote covers a single site or a second site for failover, and who owns the cost of the spare capacity during a disaster recovery test.
Offline or air-gapped operation
Running without internet access raises cost in several places at once: an internal mirror of packages and vulnerability data, manual media transfer for each update cycle, and more staff time per patch. Wazuh supports offline installation and an offline vulnerability repository in place of its online threat intelligence feed. Ask the partner how signature, rule and vulnerability content reaches the isolated network, how often it is refreshed, and who performs and records each transfer.
How storage and compute scale with ingest and retention
On a self-hosted SIEM, the recurring cost is usually storage and compute, not the license. Graylog Open is free with no volume limits, and Wazuh and OpenSearch are open source, so the bill that grows over time is the infrastructure that holds and searches your logs. Two inputs drive it: daily ingest and how many days you keep logs searchable. Graylog's system architecture guidance sizes log storage as daily ingest times retention days times 120 percent, and advises giving the message journal 3 to 5 times daily ingest on SSDs. Doubling retention roughly doubles the storage line, and a noisier log source raises it just as directly.
As an illustrative reference architecture for a medium to large deployment, Graylog's multi-node guide describes three Graylog server nodes and three MongoDB nodes run as a replica set, three Data Nodes in their own cluster, and a load balancer in front of the Graylog nodes, with is_leader set to false on the follower nodes. Each tier is a separate line item: the Graylog and MongoDB virtual machines or containers, the Data Node disks, the journal disks, and the load balancer. Ask your partner to show the sizing calculation for your own ingest and retention, and to name the disk type and capacity behind every tier, so you can see which input moves which cost.
Managed platforms follow the same logic, so retention length matters there too. Microsoft's Sentinel billing documentation states that data in a Sentinel workspace is retained at no charge for the first 90 days, and retention beyond 90 days is charged at Log Analytics retention prices. In a SaaS quote, ask for the price of ingest, of hot retention and of long-term archive separately, and confirm which tier your compliance retention period falls into. Our reader's first decision is therefore the retention period each log source truly needs, set per source rather than uniformly, because that single choice moves storage cost on every platform you evaluate.
How the three options compare on total cost
Your organization pays for the software licenses (none for Wazuh, Graylog Open or OpenSearch under their open-source terms, though Graylog Enterprise and Security are paid editions) and for everything else: servers or cloud instances, storage, networking, and the engineers who install, tune and upgrade the stack. Most of the recurring cost is people and infrastructure, and it scales with the daily ingest and the retention period you set.
- Infrastructure that scales with ingest: Storage for Graylog follows the sizing guidance of daily ingest times retention days times 120 percent, and the message journal needs fast disks. Costs rise as sources and retention grow.
- Staff time: Detection engineering, parser maintenance, agent rollout and alert triage are recurring. Ask yourself who owns each one before you start.
- Upgrades and patching: Wazuh 4.14 received six patch releases in 2026, and OpenSearch ships a new minor version about every eight weeks. Each upgrade is recurring labor, and it is easy to underestimate.
- Main risk: Under-staffing. A self-built SIEM that no one tunes produces alert fatigue and gaps in evidence, and those costs appear later in incident response and audit findings.
Before committing, confirm the staffing hours and hardware plan with your own platform team, and check how much of the cost is one-time setup versus recurring operations.
A partner is paid through a written, fixed-scope implementation fee for design, installation, integration and documentation, and then through a recurring support or retainer agreement for operations, upgrades and tuning. Your organization still pays for the infrastructure and the storage, and usually keeps internal staff for the decisions a partner cannot make for you, such as which events matter and who responds to alerts.
- One-time implementation: Architecture, log source onboarding, parser work, dashboards and handover documentation. Ask for the deliverables and acceptance criteria in writing.
- Recurring run services: Upgrades, patch handling, health monitoring and detection tuning. Confirm the service levels and response times in the contract, since DeployOpen does not publish a price list and quotes follow from the written scope.
- Infrastructure you still own: Compute, storage and backups inside your cloud account or data center. These costs continue regardless of who operates the platform.
- Internal retained time: Someone must still review alerts and approve changes to detection content.
- Main risk: Scope creep. Log sources added after go-live, new compliance views or extra retention tiers can change the run fee. Define how changes are priced before work starts.
Ask for the sizing assumptions behind any quote, including daily ingest, retention per tier and the number of log sources, so you can compare the offer with the build and SaaS options on the same inputs.
A SaaS SIEM replaces most of the infrastructure and operations cost with a subscription. The price is set by the vendor's metering model, and that model determines how your bill changes as your log volume grows. Pricing is usually based on ingest volume, workload, events per second or a managed-virtual-server count, so the same environment can cost very different amounts across vendors.
- Ingest-based pricing: Splunk Cloud Platform offers activity-based, ingest or workload pricing for unlimited users. Microsoft Sentinel charges for data ingested into the workspace, with the first 90 days of retention at no charge and longer retention billed at Log Analytics prices. The data lake tier bills ingestion, processing, storage and queries separately.
- Events-per-second licensing: IBM QRadar SIEM offers a Usage model based on events per second and flows per minute, or an Enterprise model based on Managed Virtual Servers that allows unlimited log events. Your traffic peaks, not only daily totals, can drive the bill.
- Fixed annual fees for self-managed editions: Graylog Enterprise starts at 15,000 US dollars per year and Graylog Security at 18,000 US dollars per year, each with a minimum of 10 GB per day or 100 Graylog Compute Units. Licensing is on processed data with no per-user or per-device fees, so the cost moves with volume and tier rather than headcount.
- Main risk: Metering surprises. Verbose sources, debug logging and retention extensions raise the bill, and you may not be able to exclude them without losing evidence.
Ask the vendor for a worked estimate using your real daily ingest, retention tiers, peak rates and data egress, and confirm which costs are excluded from the headline price.
How to build your own SIEM cost estimate
This sequence turns an open-ended SIEM idea into a costed scope that you can compare across build, partner and SaaS options. Each step produces a number or a written decision that feeds the next one.
Measure daily ingest for each log source
Start by listing every log source you intend to collect, such as identity providers, endpoints, firewalls, cloud control planes, databases and business applications. For each source, measure or estimate the average and peak daily volume in gigabytes, using existing vendor exports, syslog counters or a short trial collection window. Your IT and security teams own this inventory, and the step is complete when every source has a daily volume and a named owner. Ingest is the main driver of storage and compute, so errors here carry through every later line of the estimate.
Set hot and archive retention per framework
Work through each regulation or internal policy that applies to your organization and record how long logs must be kept and how quickly they must be searchable. Separate the hot tier, which must support daily search and alerting, from the archive tier, which holds older data for audit requests. Compliance and legal teams should confirm these periods in writing, because they multiply directly into storage. The output is a retention table per log source group, with a hot and archive duration for each, that you can use to calculate total stored volume.
Choose the search backend and license model
Decide which engine will store and search the data, based on the platform you plan to run. Graylog Open uses Graylog Data Node or self-managed OpenSearch for storage, Wazuh uses its own indexer, and a custom OpenSearch-based build uses OpenSearch directly. Record the license terms of each option, since they determine whether you pay for features, support or nothing at all. Confirm the supported version combinations in the vendor compatibility matrix before you size hardware, and note that OpenSearch 1.x use is deprecated in Graylog 7.0 and will be removed in Graylog 8.0.
Size nodes, storage and compute
Convert the daily ingest and retention table into raw storage, then apply the sizing guidance from the vendor for your chosen platform. For Graylog, the system architecture documentation advises multiplying daily ingest by retention days and by 120 percent, and it recommends a message journal of 3 to 5 times daily ingest on SSDs. Add replicas, search headroom and separate node roles for medium and large deployments. Ask your engineers or partner to produce a hardware or cloud instance list with counts for each tier, which becomes the infrastructure line in your estimate.
List detection content and tuning hours
Inventory the detection content you need on day one, including vendor rule packs, compliance views, correlation rules and alert routing to on-call tools. Estimate who writes, reviews and tunes these rules, and how many hours per month the SOC or a detection engineer will spend reducing false positives. Paid editions and SaaS tiers often bundle some of this content, so compare what is included before counting it as new work. The output is a detection backlog with an owner for each item and a recurring tuning allowance.
Add integration and onboarding work
Estimate the effort to deploy agents, configure syslog or API collection, parse and normalize each source, and validate that events arrive with the expected fields. Include identity integration, such as single sign-on for dashboard access and access control on the logs themselves, and the work to route alerts into ticketing or paging systems. This is largely one-time effort, but each new source added later repeats part of it. Confirm with any implementation partner whether parsing, testing and documentation are included in their fixed scope.
Add upgrade and support lines
Separate the recurring operational costs from the one-time build. Upgrades for Wazuh, Graylog and OpenSearch follow vendor release cadences, and each upgrade needs test time, rollback planning and sometimes data migration. Decide whether your team, a partner retainer or a vendor support contract covers patching, backup testing, incident support and 24/7 coverage. The output is a recurring line item that states who performs each task and how often, so the total cost of ownership can be compared with a SaaS subscription.
Request a written fixed-scope quote
Once the inputs above are documented, send the same scope document to each build, partner and SaaS option so that the proposals can be compared on equal terms. Ask each provider to state one-time and recurring charges separately, the assumptions behind ingest and retention, what happens when volume grows, and which items are excluded. DeployOpen does not publish a price list, and it agrees on scope, deliverables and timelines in writing before work starts, so the quote follows from the written scope. The step is complete when you hold written proposals that reference the same inventory, retention table and detection backlog.
Questions buyers ask before they fund a SIEM
What does a self-hosted SIEM cost in license fees?
For Wazuh and OpenSearch, the software itself carries no license fee to pay: Wazuh is distributed under GPL version 2 and OpenSearch under Apache License 2.0, and the OpenSearch FAQ does not describe any paid edition. Graylog Open is free with no volume limits, but Graylog Enterprise starts at 15,000 US dollars per year and Graylog Security at 18,000 US dollars per year, each with a minimum of 10 GB per day or 100 Graylog Compute Units, according to Graylog's pricing page. The larger cost is infrastructure: storage and compute grow with daily ingest and retention. Confirm with each vendor whether optional modules or support contracts apply to your scope.
How much effort does it take to run a SIEM in-house?
Effort depends less on the software than on the work around it: keeping the platform patched, tuning detection rules, onboarding new log sources, watching storage growth, and reviewing alerts on a schedule. Wazuh shipped 4.14 patch releases on 17 March, 23 April, 1 July, 29 July, 23 September and 14 October 2026, so a team should plan for regular upgrade cycles. Graylog's multi-node guide recommends three Graylog and MongoDB nodes plus three Data Nodes for medium to large deployments, which means real operational responsibility. Ask your team to estimate hours per month for each of these tasks before you compare options.
How long does a SIEM rollout take, and what does it depend on?
The rollout length is set by the number of log sources, the sizing of ingest and retention, the detection content you need, and whether the platform must run offline or in a segmented network. Sizing is the first gate: Graylog's system architecture guidance advises calculating log storage as daily ingest times retention days times 120 percent, and placing the message journal at 3 to 5 times daily ingest on SSDs. Each new source type needs parsing and testing. A fixed-scope agreement should state the timeline in writing, and you should confirm it against your own source inventory before work starts.
Can our team deploy and run a SIEM without outside help?
Yes, many teams do, but the question is whether they have the skills and capacity to keep it running. Wazuh offers all-in-one installation, Docker, Kubernetes, Ansible and Puppet options, and Graylog installs from Debian or RPM packages or Docker Compose. Initial installation is the easier part. Ongoing needs include detection engineering, index lifecycle management, certificate and access administration, and upgrades, such as Graylog's removal of OpenSearch 1.x support in Graylog 8.0. Assess whether at least two people can cover these tasks, and whether you have a rotation for after-hours alerts.
What does the work need from our staff?
Expect demand on security engineering, infrastructure, and the people who review alerts. Security engineers write and tune rules and decide what counts as an incident. Infrastructure staff manage servers or Kubernetes, storage, backups, and network paths from endpoints to the indexer. Analysts review alerts and document outcomes, which auditors may sample. Compliance staff define which events must be kept and for how long. Name a single owner for the platform and confirm which tasks your staff keep versus which a partner performs under a retainer.
How does SaaS ingest pricing compare with a self-hosted SIEM?
SaaS SIEM pricing usually scales with data volume, retention, or workload, so a cost comparison needs your real ingest and retention numbers. Splunk Cloud Platform is offered with activity-based, ingest, or workload pricing for unlimited users. Microsoft Sentinel keeps data at no charge for the first 90 days, and charges for retention beyond that under Log Analytics prices, plus data lake ingestion, processing, storage and queries. IBM QRadar SIEM uses either events per second and flows per minute or a Managed Virtual Server count. Model each option at your expected daily volume and retention for at least a year, and ask each vendor to show its billing for that case.
What should we ask a partner to include in a SIEM quote?
Ask for a written scope that lists log sources, daily ingest and retention assumptions, hot and archive storage tiers, the platform components and versions, and the detection content included. Request the hours and roles behind each deliverable, the handover plan, and what happens after go-live, including retainer options for upgrades, tuning, and testing. Ask how the partner sizes storage with the formula your platform vendor publishes, how they handle offline updates if needed, and which costs are one-time versus recurring. DeployOpen provides fixed-scope quotes based on this written scope, and does not publish a price list.
What to ask for in a SIEM implementation quote
A fixed-scope quote for a self-hosted SIEM should state its assumptions in writing before any figure appears. Ask the partner to list the daily ingest in gigabytes per day, the retention for each storage tier (hot, warm and archive), and the log sources in scope with the parsers and decoders that will normalize each one. Ask whether the quote assumes Wazuh agents on endpoints, syslog collection from agentless devices, or both. Storage sizing should be shown as a formula the partner can defend, such as daily ingest multiplied by retention days and a overhead factor, with the source of that factor named. Request the same written scope from every option you compare, including a SaaS vendor, so that the ingest assumptions, retention periods and source counts match line by line.
Detection content and high availability are the items most often left out of a quote and most often expensive later. Ask who writes, tests and tunes the correlation rules and compliance views, how many detection use cases are included at go-live, and how many are added per month afterward. For Wazuh, ask how the server cluster, indexer nodes and dashboard are laid out and whether a single node failure is covered in the design. For Graylog or OpenSearch, ask for the node count, the replica settings and the load balancer. Confirm which OpenSearch or Graylog versions the partner will deploy against the Graylog compatibility matrix and how upgrades will be tested, since a platform upgrade can change the quoted effort.
Post go-live terms decide whether the quoted figure is the full cost. Ask for the support hours, the response expectations for a production outage, the number of planned upgrade cycles included in the year, and whether security patches are covered between releases. Ask which items are one-time (design, deployment, initial parsing, rule build-out) and which recur (licenses, hosting, retained storage growth, retainers for tuning and upgrades). Ask for any third-party license costs, such as a paid Graylog edition, and for a statement of what changes the price if ingest or retention grows beyond the agreed assumptions. A quote that cannot answer these questions in writing is not yet comparable with the others.
Which official sources to check before you finalize the budget
This sequence turns vendor pricing pages, license files and release notes into a verified cost baseline before any quote is compared. Each step ends with a dated record your finance, procurement and legal reviewers can check against the original source.
Fix the license and edition baseline first
Start by confirming which license governs each candidate platform and which edition contains the features you need. For Wazuh, read the LICENSE file in the GitHub repository, which states GPL version 2 with an OpenSSL linking exception. For Graylog, read the LICENSE file in the Graylog2/graylog2-server repository, which states that Graylog Open is licensed under SSPL-1.0, a license that is not OSI-approved. Your platform or security lead does this, and the output is a one-page table listing each product, its license, and the edition in scope. Keep the commit or tag reference next to each entry.
Pull the current pricing pages for each vendor
Next, open the pricing pages directly and record what each one says on the date you review it. For Graylog, that means the Graylog pricing page, which lists Graylog Enterprise and Graylog Security starting prices with a minimum of 10 GB per day or 100 Graylog Compute Units. For Splunk, use the Splunk platform pricing page, which describes activity-based, ingest or workload pricing. For IBM QRadar, use IBM's pricing page covering the EPS and FPM Usage model and the Managed Virtual Server Enterprise model. For Microsoft Sentinel, use Microsoft's billing documentation. Your finance lead records each figure with its source URL and capture date.
Confirm the Sentinel and QRadar billing meters
Ask each SaaS or licensed vendor to confirm exactly which meters apply to your workload. For Sentinel, the billing documentation states that data ingested into a workspace is retained at no charge for the first 90 days and that longer retention is charged at Log Analytics retention prices, and the data lake tier bills ingestion, processing, storage and queries separately. For QRadar, confirm whether events per second, flows per minute or managed virtual servers drive the price in your case. Written answers from the vendor, dated and filed with the pricing record, are the evidence that this step is complete.
Check the open-source release and support calendars
For the self-hosted options, verify the release line and support window you will be committing to. Wazuh publishes patch releases in the 4.14 line, with 4.14.9 released on 14 October 2026 according to its release notes, so confirm which line your upgrade plan will follow. For OpenSearch, check the releases page for the current minor version cadence and the maintenance rules, which keep a version in maintenance until the next major version enters maintenance or one year passes, whichever is longer. For Graylog, check the tags on the Graylog2/graylog2-server repository and the compatibility matrix, since OpenSearch 1.x use is deprecated from Graylog 7.0 and is to be removed in Graylog 8.0. Record the upgrade cadence your team must budget for.
Have counsel review the license implications
Send the license table to legal or open-source compliance counsel with specific questions. Ask whether SSPL-1.0 terms affect how you host Graylog as a service for others or embed it in a product you ship, and whether GPL-2.0 obligations apply to any Wazuh modifications you redistribute. Ask whether your internal use, hosting by a partner, and any customer-facing deployment each trigger different obligations. Counsel's written memo, or a documented decision not to escalate, is the output. DeployOpen does not provide legal advice, so this review belongs with your own counsel.
Convert the verified figures into a cost model
Build the cost model from the verified inputs, separating one-time costs from recurring ones. Label each line with its source, such as the vendor pricing page, the billing documentation or the license file. Mark the assumptions you made, including daily ingest and retention, which the Graylog system architecture page advises sizing as daily ingest times retention days times 120 percent. Use the same ingest and retention assumptions for every option so the comparison is fair. Finance and the platform team own this model, and it is done when every line traces to a source or a named assumption.
Confirm open items in writing before procurement
Before you issue a request for quote or sign a purchase order, send each vendor and each partner a list of the items you could not verify from public sources. Ask for written confirmation of current pricing, minimum commitments, included support, and the edition that contains the detection and correlation features you require. For a partner-run deployment, ask the partner to tie its quote to the written scope and to the same ingest and retention assumptions. The completed set of written confirmations, filed with the cost model, closes the sequence.
How DeployOpen scopes and delivers a fixed-scope SIEM implementation
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For SIEM cost, that means the build, partner or SaaS comparison is worked out against a written scope, so the cost components you are quoted match the sources, volumes and retention you actually need.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope states daily ingest, retention tiers, log sources and the platform option being costed, such as Wazuh, Graylog or OpenSearch.
- Scope lists which costs are one-time implementation work and which are recurring hosting, storage and support.
How we build
- Sizing models storage and compute from your daily ingest and retention, so cost estimates trace back to stated inputs.
- Log source onboarding, parsing and detection content are built and tested against the agreed scope.
- Build records document the architecture, licenses in use and the paid editions, if any, that the design depends on.
How we hand over
- Handover includes runbooks for index retention, upgrades and storage growth so your team can track recurring costs.
- Documentation covers the architecture, configuration and operating procedures, delivered to your own environment.
- Evidence packs describe controls and log retention for your assessors, which DeployOpen prepares but independent auditors assess.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, priced separately from the implementation.
- Retainers can cover platform upgrades, detection tuning and capacity reviews as ingest grows over time.
- Ask any partner to confirm in writing which support, response and upgrade terms apply after go-live.
