Many SIEM proposals look complete on the first page and expensive by the last. The core platform is quoted, then come the line items: behavioural analytics, automated response, threat-intelligence feeds, detection content, collectors, compliance reporting. Each may be licensed, metered and renewed separately.
"All-inclusive" is a useful promise, but only if you know what to check. This checklist is meant to help security and procurement teams compare SIEM offers on the same basis, whichever vendor they choose.
1. Licensing: what is metered, and what is extra?
Most SIEMs are sized on events per second (EPS), data volume or both. That is reasonable: ingest and retention drive hardware and storage. The question is what else is metered on top.
- Is the licence one platform price, or a base price plus separately licensed modules?
- Are any features unlocked per EPS tier, so that growth triggers a feature true-up as well as a capacity one?
- Is detection content included, or is it a separate subscription?
- What happens to detection if a renewal is late? Does correlation stop, or carry on?
Tip: ask for your current renewal quote and list every line item. Then ask each new vendor which of those lines they include.
2. UEBA, SOAR and threat intelligence: included or add-on?
These three capabilities are where costs often grow after the initial purchase.
- UEBA: how many behavioural models ship as standard? Is per-user risk explainable, showing which factors drove the score?
- SOAR: is automated response part of the same console, or a separate product with its own integration project? How many response actions are built in, and can playbooks require human confirmation before critical steps?
- Threat intelligence: are indicators bundled and matched inline, or does every feed require its own subscription?
- Case management: can incidents be worked inside the SIEM, or do you need an external ticketing system?
3. Agents and collectors: what does onboarding cost?
For endpoints and servers without a log forwarder, the agent or collector tier can become a significant, ongoing cost.
- Are agents licensed per endpoint or per collector?
- Is agent traffic encrypted, and does it buffer locally if the network link drops?
- Are agents managed and updated centrally from the server?
4. Deployment: on-premise and air-gap
Regulated and critical-infrastructure environments often cannot send logs to a third-party cloud.
- Can the platform run fully on-premise, with no mandatory cloud dependency?
- Can it run in an air-gapped network, including upgrades delivered offline?
- Are optional cloud services, such as AI assistants or online feeds, genuinely optional?
- How are high availability and disaster recovery delivered, and how many systems does that add?
5. Day-two effort: who keeps it useful?
The licence is only part of the cost. A SIEM that floods analysts with false positives on day one, or needs a dedicated rule-engineering team, is expensive to run.
- How does the vendor help you decide which detections to enable for your environment?
- Can new rules run in an observe-only mode before they raise incidents?
- Does the platform monitor its own health?
6. Evidence and interoperability
- Are compliance report packs included, and are reports tamper-evident?
- Is there an immutable audit trail of operator actions?
- Can events be forwarded to an existing SIEM or data lake, and is there a documented API?
Where NflowX fits
NflowX is Evelcra's self-managed SIEM. It was designed around the questions above.
- One all-inclusive platform licence. Sized from a sample of your real logs, using events per second and retention to set the node count. UEBA, SOAR, threat intelligence, compliance reporting, passive asset discovery and case management are in the base licence, with no per-feature metering. An AI assistant is available as an optional module.
- Detection content included. 3,437 correlation rules installed, 1,695 enabled by default, mapped to 395 MITRE ATT&CK techniques, with no separate content subscription.
- UEBA: 31 behavioural models, with explainable, time-decaying per-user risk that shows the top contributing factors.
- SOAR: 51 built-in response actions, such as blocking an IP, isolating a host or disabling an account, with branching playbooks and confirmation gates.
- Threat intelligence: more than 30,000 bundled indicators matched inline, plus GeoIP and on-demand enrichment.
- Free agents. Windows and Linux agents at zero licence cost, encrypted, buffered during network outages, managed centrally, with a per-agent host-footprint measure.
- On-premise and air-gap ready. Runs fully offline with offline upgrades; threat-intelligence feeds and the AI assistant are optional. A replicated peer at a second site provides high availability and geographic disaster recovery.
- Less tuning. A passive Learning Mode recommends which rules to activate based on your actual traffic, rules can run live, audit-only or disabled, and a Platform Health board checks every internal service.
- Evidence and interoperability. Report packs and control mappings for frameworks including PCI DSS, ISO 27001, HIPAA, GDPR and NIST 800-53, delivered as cryptographically signed PDFs; events can be forwarded in OCSF format to an existing SIEM or data lake, and a REST API is documented with an OpenAPI specification.
Use the checklist
Take your current SIEM quote, run it through the six sections above, and mark each item as included, add-on or not available. The result is a like-for-like view that is far more useful than a headline price.
If you would like to compare NflowX against your current setup, request an NflowX demo and share a log sample for sizing. MSSPs and SOC providers looking for free agents and one predictable licence can learn about partnering with Evelcra.