A SIEM that works well for one company can be a poor fit for a managed service provider. An MSP or MSSP (managed security service provider) runs the same platform for dozens or hundreds of customers, has to keep their data apart, bills each of them, onboards new ones every month and answers to each of their auditors. Those needs, not detection features, usually decide which SIEM makes money and which one eats the margin.
This guide covers what to demand from a SIEM before you build a service on it, the main types of platforms MSPs choose, and the business model questions that matter as much as the technology. We build UTMStack, a multi-tenant SIEM with a partner program, so read our view with that in mind.
The short answer: the best SIEM for an MSP has native multi-tenancy that separates each customer’s data, users and settings; a license that allows you to run it as a service; pricing that maps to how you bill customers, ideally per device rather than per gigabyte; fast onboarding; per-customer tuning and automated response; and branded reports your customers and their auditors can read.
Why MSP needs are different
- Many small environments instead of one large one. Onboarding speed and per-customer overhead matter more than raw scale.
- Separation is a contract issue. A technician at one customer must never see another customer’s alerts. Customers, insurers and auditors ask how you guarantee it.
- Your costs must be predictable to be profitable. You sign fixed monthly contracts. If your SIEM bills by data volume, one customer’s noisy firewall erodes the margin on the whole account.
- Your brand is on the service. Reports, portals and emails should carry your name.
- Your customers have different rules. A dental clinic needs HIPAA evidence, a retailer needs PCI DSS, a defense supplier needs CMMC.
The checklist: 12 things to test in a demo
Ask each vendor to show, not tell.
- Native tenants with separated data. Each customer has its own users, alerts, integrations, response flows and audit records. Ask: “Show me a technician account that can only see one customer.”
- One console across tenants. Your analysts switch between customers without logging in again, and see alerts across all of them.
- A license that allows a managed service. Some free tools forbid it outright: Security Onion’s Elastic License 2.0 bans offering it as a hosted or managed service, and Graylog Open’s SSPL and Elastic’s own downloads restrict it. Commercial products may require a specific MSP agreement.
- Pricing that matches your contracts. Per-device pricing lets you resell per device. Per-gigabyte pricing turns every customer’s log volume into your risk.
- Onboarding in hours, not weeks. One-line agent installs, ready integrations for Microsoft 365, the main firewalls and endpoint tools, and templates you reuse for each new customer.
- Global rules, local exceptions. Manage detections once for everyone, and add exceptions for one customer without forking the rule set.
- Automated response, scoped per customer. Block an address, disable an account or isolate a host, with what each customer has approved.
- White-label reports and console. Your logo, including dark-mode versions, on what customers see.
- Compliance reports per customer. HIPAA, PCI DSS, CMMC, ISO 27001 and SOC 2 evidence produced from each customer’s own logs.
- Flexible deployment. All customers on one multi-tenant server, separate servers for large or regulated customers, and one view across both. Hosting regions that satisfy data residency.
- Strong access control for your own staff. Single sign-on, custom roles, multi-factor sign-in and an audit trail of what your technicians did in each tenant.
- An API. So alerts reach your ticketing system and onboarding can be scripted.
What real multi-tenancy looks like
One console for your team, separate data for every customer
- Own users and roles
- Own alerts and incidents
- Own integrations
- Own response flows
- Own audit trail
- Own users and roles
- Own alerts and incidents
- Own integrations
- Own response flows
- Own audit trail
- Own users and roles
- Own alerts and incidents
- Own integrations
- Own response flows
- Own audit trail
The main types of SIEM platforms MSPs use
| Type | How it works | Strengths | Watch out for |
|---|---|---|---|
| SIEM bundled with an MSP software suite | Sold alongside remote monitoring and ticketing tools | Familiar, one vendor, simple billing | Depth of detection, log retention, lock-in |
| Managed SIEM or MDR you resell | Someone else’s platform and analysts, your customer | No SOC to build | Lower margin, less control, their brand may show |
| Large cloud SIEM across customer workspaces | For example, Microsoft Sentinel managed across tenants with Azure Lighthouse | Powerful, deep Microsoft integration | Per-GB billing per customer, cross-tenant setup work |
| Open source you build on | Wazuh or OpenSearch, with your own separation and tooling | No license fees, full control | Tenant separation, response and reporting are your engineering project |
| Platform built multi-tenant | Tenants, branding and federation are part of the product | Separation and onboarding solved | Check license terms and partner model |
There is no single best for every MSP. A small MSP already standardized on one software suite may be well served by its bundled SIEM. An MSSP whose value is its own detection and response wants control over the platform, its brand and its costs.
The business model questions
How will you price your service? Most MSPs sell security monitoring per device or per user per month, in tiers: monitoring only; monitoring with response; and a compliance package with monthly reports. A SIEM priced the same way as your contracts makes margins easy to forecast.
Two customers with the same 60 devices: what the platform costs you
Customer B's firewalls log three times as much as Customer A's. Platform cost indexed to Customer A = 100.
Who watches at night? A 24/7 service needs about five analysts for one seat around the clock. Many MSPs start with business-hours coverage plus automated response, and add outside analysts for nights, weekends and overflow before they hire a full night shift.
What happens when a customer leaves? You need to export their data, delete it completely, and prove you did. Ask how the platform terminates and purges a tenant.
What is in the partner program? Margins or discounts, white-label rights, training and certification, technical support, and whether the vendor ever sells directly to your customers.
How UTMStack works for MSPs and MSSPs
UTMStack was built multi-tenant. In the Enterprise edition, each customer is a tenant with its own settings, users, alerts, integrations, response flows, audit records and AI usage, all on one server. Tenant cards show each customer’s users, data sources, open alerts and AI usage at a glance. You can put your own name and logos, including dark-mode versions, on the console customers see, broadcast a message to all tenants, give your support team read or full access to a tenant when needed, and terminate and purge a tenant cleanly when a contract ends. Large or regulated customers can have their own server, connected with the others in one federation console with consolidated alerts and logs. Staff sign in through SAML or OpenID Connect single sign-on, with custom roles and required multi-factor sign-in.
Detection and response are the same for every tenant: 600+ rules checked as each log arrives, automated response flows through the agent, incidents with a full history, and compliance reports for nine frameworks from each customer’s own logs. UTMStack is priced per device, never by log volume. The free Community edition is AGPL-3.0, which allows running it for customers, and the Enterprise license and partner program cover multi-tenant service providers.
The partner program has options for resellers, white-label partners and managed service providers. If you need help covering nights, weekends or alert overflow, UTMStack’s SOC extension analysts can work under your brand and procedures, and your customers stay your customers. Read more about multi-tenancy.
Frequently asked questions
What is a multi-tenant SIEM? A SIEM that runs many separate customers or business units on one platform, with each tenant’s data, users, settings and alerts kept apart, and a central console for the provider.
What is the best SIEM for an MSSP? One with native tenant separation, a license that allows a managed service, predictable per-device pricing, automated response and white-label compliance reports. Test those in a demo before comparing detection features.
Can I use an open source SIEM for a managed security service? Yes, if the license allows it. UTMStack (AGPL-3.0), Wazuh (GPLv2) and OpenSearch (Apache 2.0) do. Security Onion’s Elastic License 2.0 forbids offering it as a managed service, and Graylog Open’s SSPL restricts it.
Should each customer get its own SIEM server? Small customers usually share a multi-tenant server, which keeps costs down. Large or regulated customers, or those with data residency rules, may need their own server. A federation console lets you run both models from one place.
How do MSPs price SIEM services? Usually per device or per user per month, in tiers for monitoring, response and compliance reporting. Matching your SIEM’s pricing model to your own keeps margins predictable.
What is a white-label SIEM? A SIEM you can sell under your own brand, with your name and logos on the console and reports. UTMStack offers white-label options through its partner program.
