Sumo Logic SIEM Pricing: What Cloud SIEM Actually Costs

TL;DR: A 100 GB/day Cloud SIEM deployment costs about $340,800 for the first year at list price (before discounts), and goes up 10% every renewal (unless you negotiate differently). But calculating Sumo Logic SIEM pricing isn’t easy. The rate is 40 credits per GB, credits list at $0.2250 on Enterprise Security, and you multiply by your region and payment terms to figure out the price. In our example, that worked out to $3,285 per GB per day per year, though your own number will depend on volume, region, and what you negotiate. Realm sits in front of Sumo Logic and cuts the data reaching Cloud SIEM by 50% to 70%. Realm’s customer, Vensure Employer Solutions, cut FortiGate firewall log volume reaching Sumo Logic by 83%, without losing visibility into that data.

To purchase Sumo Logic Cloud SIEM, you first need to buy Sumo Logic’s Enterprise Security or Enterprise Suite platform, i.e., Cloud SIEM is not available on its own.

Then, you need to buy a pool of credits, which Cloud SIEM uses whenever it processes security data. That means that if Cloud SIEM uses more credits, there are fewer credits left for the rest of the Sumo Logic platform.

This article explains how the credit system works, how Sumo Logic Cloud SIEM consumes those credits when you ingest and analyze security data, and what a realistic annual bill looks like.

Sumo Logic Cloud SIEM Pricing Explained

Sumo Logic packages its platform into two categories: Essentials for smaller teams and Enterprise for everyone else. The Enterprise category splits into three tiers (Enterprise Operations, Enterprise Security, and Enterprise Suite).

Cloud SIEM is not available on Essentials or Enterprise Operations. It is only available through Enterprise Security and Enterprise Suite.

*Unlimited: there is no limit on volume that can be quoted, but fees will vary based on volume quoted.

Enterprise Security is aimed at SOC teams that need security analytics and PCI apps, whereas Enterprise Suite is for teams that want the full stack, including Cloud SOAR and the Flex licensing option.

How Sumo Logic Credits Work

Sumo Logic licenses everything through a single annual credit pool. So instead of buying separate licenses per product, you buy a pool of credits once a year, with every service using credits from that pool as you use it. This means that every GB you send to Cloud SIEM leaves fewer credits for everything else.

Each feature has a credit burn rate, which is the number of credits it consumes per unit of activity.

Usage data updates in near real time, so you always know what you have left. The exception is storage, which updates daily and can take up to 24 hours to appear. You decide where the credits go based on your organization’s day-to-day needs.

Some contracts also include promotional credits. Promotional credits are non-transferable and expire at the end of the promotional period. The system spends them first for their designated feature before it starts using the credits from your main, paid credit pool.

Burn rates

The burn rate depends on the data type and on which licensing model you are on. Sumo Logic publishes separate rate schedules for the Credits model and for Flex.

All published rates are examples, and a customer’s actual rates are set in their order form.

On the Credits model, credits are consumed mainly through ingest.

Flex is Sumo Logic’s newer licensing model, where ingest for standard logs is free, and credits are consumed by storage and by the data your searches scan. Metered Search activates once Upfront Search capacity runs out.

The two models price credits differently. Enterprise Suite Flex credits carry a suggested resale price of $1.50, while Enterprise Suite credits on the Credits model list at $0.2500.

A list price and a suggested resale price are different things, and a Flex credit and a Credits credit are not worth the same. So even where a burn rate looks identical in both tables, like Metrics at 10 credits, the money is not. The two models cannot be compared on credit counts alone.

The tier you store logs in sets the trade-off between ingest cost and search cost. Continuous has the highest ingest burn rate at 25 credits per GB, and searching it is free. Frequent sits in the middle at 12 credits per GB, again with free search, and Infrequent drops ingest to 5 credits per GB but charges 2 credits for every GB a search scans.

Scan volume is the total amount of stored data a query reads through. If a query scans 50 GB of logs to find one error string, that is 50 GB of scan volume, regardless of what the query returns.

Why Sumo Logic Cloud SIEM Ingest Is Billed On Its Own

Cloud SIEM has its own credit category, separate from ordinary log ingest, in both licensing models. It appears as CSE GB Ingest in section 4(f) of the Credits schedule and section 9 of the Flex supplemental update (second half of the Credits schedule).

At 40 credits per GB, Cloud SIEM is the most expensive type of data you can ingest on the platform. Every gigabyte you send there costs more than tracing data, and substantially more than ordinary log ingestion.

The schedule defines the billable GB as a gigabyte of log data ingested by the service, the same wording used for Continuous ingest.

Cloud SOAR, the other Enterprise Suite add-on, is billed differently again. It charges per named user rather than per GB, at a daily credit rate set on the order form. In Sumo Logic’s example, five named users at 274 credits each a day comes to 500,050 credits over a year.

This matters most under Flex. The selling point of Flex is that ingesting standard log data does not consume credits at all. Credits are spent when you store the data and search or query it. Cloud SIEM is the exception. Security data still burns credits on ingestion at 40 credits per GB, so the free-ingest benefit does not apply to anything you sent to Cloud SIEM.

The practical consequence is that sending data into Cloud SIEM that does not need security analytics is the fastest way to use up a credit pool, though you can use ingest budgets to limit or monitor how much data specific sources send each day.

The Cloud SIEM cost formula

Because Cloud SIEM is an add-on billed in credits, ingest cost comes down to one formula:

✦SIEM ingest cost = list price per credit x credit burn rate x GB ingested

Unfortunately, we’re not done yet. Before you can calculate your ingest cost, you first have to work out what a credit actually costs.

The list price per credit depends on three things:

• Your plan. Enterprise Security credits list at $0.2250, while Enterprise Suite credits list at $0.2500.
• Your deployment region. Sumo Logic applies a regional multiplier. The United States uses 1.00, Canada, Ireland, and US Federal use 1.10 (+10%), Germany, Switzerland, Australia, Japan, South Korea, and Global use 1.20 (+20%), and the European Sovereign Cloud uses 1.40 (+40%).
• Your payment terms. Standard annual Net 30 billing uses 1.00. Quarterly and other payment arrangements can increase that multiplier to as much as 1.30.

Once you’ve worked out the price of a credit, the rest of the calculation is much easier.

Cloud SIEM always consumes 40 credits for every GB ingested, regardless of plan.

The only remaining variable is how much security data you send into Cloud SIEM each day, measured in GB. If you ingest 50 GB in a day, the calculation uses 50. If you ingest 1,000 GB, it uses 1,000.

Storage is billed separately. Both pricing schedules charge 0.05 credits per GB stored, so you need to add storage on top of ingest costs:

So a complete SIEM cost adds:

✦Storage cost = list price per credit x 0.05 x GB per day x retention days.

Both formulas return a daily cost, so multiply by 365 for an annual figure.

A Worked Example of Sumo Logic Pricing

Now that we have the theory out of the way, let’s see what Sumo Logic SIEM pricing looks like in practice.

Say a company sends 100 GB of security logs per day into an Enterprise Security account hosted in the United States, on standard annual Net 30 billing.

First, the list price per credit. The base price of $0.2250 times the US multiplier of 1.00 times the Net 30 multiplier of 1.00 gives $0.2250 per credit.

Next, the cash cost per ingested GB. $0.2250 per credit times the 40 credit burn rate gives $9.00 per GB.

Then the daily cost. $9.00 per GB times 100 GB gives $900 per day.

Over a year, that is $900 times 365 days, or $328,500 in ingest alone.

Storage is billed separately at 0.05 credits per GB held, which adds about $12,300 a year at 30 days retention and more as retention grows. So the total first year cost is around $340,800.

Sumo Logic’s renewal policy, set out in section 1(D) of the same schedule, raises net annual subscription fees by 10% at the end of each service period unless the customer separately agrees otherwise in writing. In this example, that is roughly $374,900 in year two and $412,400 in year three, on flat volume.

The same deployment costs about $409,000 in Germany and about $477,100 in the European Sovereign Cloud, on identical volume.

Saying Sumo Logic SIEM pricing is complicated would be an understatement. But don’t let the calculations distract you from the main (and pretty simple) point: the more data you ingest into Cloud SIEM, the more you pay.

Reduce Sumo Logic SIEM Costs with Realm Security

Cloud SIEM ingest uses up credits faster than anything else on the platform. At 40 credits per GB, it costs eight times what the same gigabyte costs in Infrequent ingest. As such, if you want to cut Sumo Logic SIEM costs, you should review your data and send only logs that actually need SIEM security analysis into Cloud SIEM.

Realm Security is the SOC-aware security data pipeline that sits between your data sources and Sumo Logic.

It collects, cleans, normalizes, and routes your telemetry so only the data you need reaches Cloud SIEM. The rest is filtered out or streamed into Realm Data Haven, a retention layer that keeps full-fidelity normalized logs available for compliance and forensics at a fraction of SIEM storage cost, with default retention of one year and the ability to extend to five.

Realm filters events instead of altering them. When it identifies noise (for example, a routine health check or other low-value log), it removes the whole event before it reaches your SIEM, but only after it checks that the event is not needed by any known detection rule used in Cloud SIEM. If an event is required by a known downstream detection, it doesn’t get filtered.

Under Sumo Logic’s pricing model, reducing unnecessary data saves money in three ways.

• You pay less to ingest and store data. Storage costs depend on how much data you send to your SIEM, so reducing data volume lowers both ingestion and storage costs. For example, if you reduce the amount of data sent to Cloud SIEM by 70% (from 100 GB/day to 30 GB/day), your estimated first-year cost goes from roughly $340,800 to about $102,200.
• You have more credits to spend on other Sumo Logic services. Because Cloud SIEM shares the same annual credit pool as Sumo Logic’s other services, reducing unnecessary SIEM data means you have more credits available for logs, metrics, tracing, or other workloads.
• You pay less at every renewal. Sumo Logic increases subscription fees by 10% at each renewal (unless you agree otherwise with them), so reducing your data volume today reduces your current bill and also helps you keep future price increases smaller.

The article’s worked example (100 GB/day, Enterprise Security, US region, Net 30) run at a 70% volume reduction. Credit figures apply the published 40 credits/GB Cloud SIEM burn rate.

Most Realm customers see impact within the first week. Typical outcomes are a 40% or greater reduction in SIEM cost, a 50% to 70% reduction in ingested volume, and time back for analysts.

Vensure Employer Solutions used Realm to cut daily log volume by 83%, reducing both short-term and long-term storage costs in Sumo Logic without losing visibility into their FortiGate firewall data.

Get a demo of Realm today.