Some managed security service providers (MSSPs) are exploring custom security telemetry platforms to gain more control over ingestion, retention, tenant workflows and the link between data volume and platform cost. That is not evidence of a mass migration: available figures do not establish how many MSSPs have left licensed SIEM products, or whether building a replacement lowers total cost.
Why consider moving away from a licensed SIEM?
The main attraction is control over how telemetry enters the system, how long it is kept and how the platform’s cost responds to customer data volume. For an MSSP whose revenue and service model do not track neatly with SIEM ingestion charges, the licensed platform’s billing model can be a source of pressure. A provider-owned stack may let it shape those choices more directly, or differentiate its service.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Data Center Cybersecurity: From Beginner to Job-Ready: A Practical Guide to Zero Trust, Network... | $12.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Licensed products do not all bill the same way. Microsoft says Sentinel analytics-tier charges can be pay-as-you-go, based on actual data volume, or use commitment tiers. Retention beyond what is included and other Azure infrastructure can add cost, and the result depends on the tier and configuration. Microsoft’s billing documentation puts it this way: “Pricing is based on the tier that the data is ingested into.” Microsoft Sentinel pricing and billing
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That makes customer-specific estimates more useful than a single per-gigabyte figure. A comparison should account for ingestion and analysis, retention, query and compute, storage, networking, and whether a commitment tier is actually used efficiently. The published pricing page is not a universal forecast for an MSSP’s workload.
Building a stack moves costs and responsibilities
Leaving a license-based product does not make telemetry processing free. A provider may reduce or avoid some license charges, but it still needs infrastructure and people to make the service work reliably. Costs can include compute, storage, pipelines, parsing and normalization, detection content, maintenance, security, and continuous operations. The sources available do not quantify a net saving or provide a validated before-and-after total-cost comparison.
- Data handling: ingestion pipelines must keep working, and logs need to be parsed and normalized so they can be searched and used consistently.
- Detection: someone must create, tune and maintain detection rules and other security content.
- Operations: the platform needs upgrades, monitoring, failure recovery and security controls, alongside the provider’s customer-facing security service.
- Capacity and reliability: the provider must ensure storage and compute can meet workload needs and that customers receive predictable service.
These are decision factors, not measured staffing or uptime comparisons. A custom architecture can shift the cost mix; it does not by itself demonstrate lower total cost or equivalent outcomes.
A custom SIEM does not have to mean building every component
“Build their own” can describe a mixed architecture: commercial tools, open-source software, cloud services and provider-written code working together. It need not mean that an MSSP creates a database, analytics engine, detection system and SOC workflow entirely from scratch. The available sources do not establish a typical migration pattern or a standard reference stack.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFor example, ClickHouse describes separately scalable storage and compute on its pricing page, so it can serve as a data or analytics layer in an architecture. That does not make it a complete SIEM or managed detection and response (MDR) service: a database alone does not provide detection engineering, alert handling or incident response. ClickHouse pricing
Tenant isolation can make or break the design
An MSSP platform must serve multiple customers without confusing their access, data ownership or governance boundaries. Microsoft documents a multiple-workspace design for Sentinel in which an MSSP centrally monitors and manages workspaces across tenants. Microsoft lists benefits including role assignment, fewer data ownership, privacy and regulatory challenges, minimal network latency and charges, and easier customer onboarding and offboarding. Microsoft Sentinel guidance for multiple workspaces and tenants
A provider building its own system must meet its own tenant-isolation and governance requirements. That means evaluating access controls, customer data boundaries, privacy and regulatory obligations, and the practical effort required to add or remove customers—not just whether the platform can ingest logs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to compare a licensed SIEM with a provider-built stack
The right choice depends on the provider’s workloads and ability to operate the platform. Compare the real design and its responsibilities, rather than a license line item against an incomplete estimate of infrastructure.
Recommended Free Tools
| Decision area | Questions to answer |
|---|---|
| Cost shape | What are the costs for ingestion and analysis, retention, query and compute, storage, networking and commitments? Are estimates based on the provider’s actual workloads and customer-specific configurations? |
| Tenant isolation and governance | How are access controls, customer data ownership, privacy and regulatory needs handled? How much work does onboarding or offboarding take? |
| Engineering capacity | Who owns parsers, normalization, pipeline failures, detection rules, upgrades and recovery when a component breaks? Can the team sustain that work? |
| Service capability | Does the design cover only data storage and analytics, or also detection, alert handling and incident response? |
| Flexibility and reliability | Can the provider maintain availability, security and predictable customer outcomes as it changes the system? No comparative uptime or outcomes data is established here. |
A useful comparison therefore starts with a defined workload and service scope. Include the engineering and operational work required to achieve the same customer outcome on either design, and treat commitments, retention and infrastructure as part of the estimate.
Does the evidence show that MSSPs are moving off licensed SIEM?
No reliable market-wide figure establishes the share of MSSPs that have migrated away from licensed SIEM, or their savings after doing so. A 2024 Top 250 MSSPs report search excerpt says nearly 90% of larger MSSPs provide their own MDR in-house, but that is a statistic about MDR delivery—not proof that those providers own or have replaced their SIEM. MSSP Alert / CyberRisk Alliance, Top 250 MSSPs Report 2024
It is reasonable to describe provider interest in owning more of the telemetry stack as an observed or reported trend, but not to call it a quantified migration wave or a majority move. In-house MDR and a self-built SIEM are different claims.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
