What Is a Cloud SIEM? Types, Pricing and How to Choose

Most companies now run a large part of their business in the cloud: Microsoft 365 for email and files, a cloud account for servers, and a long list of web applications. A security information and event management (SIEM) system that lives on servers in a back room fits that world less and less. A cloud SIEM moves the platform itself to the cloud.

The catch is that “cloud SIEM” covers very different products. Some are shared services built for the cloud, some are hosted copies of products you could also run yourself, and some are ordinary SIEMs installed on cloud servers. They are priced differently, they store your logs in different places, and they are not equally easy to leave. This guide explains the differences, the honest pros and cons, how cloud SIEMs are priced, and what to check before you sign. We build UTMStack, which runs both in the cloud and on your own servers, so weigh our view accordingly.

The short answer: a cloud SIEM is a SIEM delivered as a service. The provider runs the servers, storage and updates; you send your logs to it over encrypted internet connections and work in a web console. It does what any SIEM does: collect logs, detect threats with correlation rules, raise alerts and keep logs for investigations and audits. Cloud-native services such as Microsoft Sentinel and Google Security Operations are usually priced by data volume. Hosted services such as Splunk Cloud Platform and UTMStack Cloud run a product that also exists for your own servers. The decisions that matter most are how the price grows, where your logs are stored and how you would leave.

Three kinds of cloud SIEM

All three run "in the cloud". They differ in who maintains the platform and how easily you can move.

Cloud-nativeA shared service built for the cloudThe provider runs one large platform for many customers and scales it for you. Usually priced by data volume. Examples: Microsoft Sentinel, Google Security Operations.

HostedA product you could run yourself, run for youThe vendor hosts and updates an instance of a SIEM that also runs on your own servers. Examples: Splunk Cloud Platform, UTMStack Cloud.

Self-hosted in the cloudYour SIEM on your cloud serversYou install a SIEM on virtual machines in your own cloud account. Full control, and all the upkeep is yours.

What a cloud SIEM does

A SIEM collects logs from your systems, puts them into one format, checks them against detection rules, raises alerts and keeps the logs so you can search them later. A cloud SIEM does the same work, but the processing and storage run in a provider’s data centers instead of yours.

Inside, most cloud SIEMs have the same four layers:

1. Collection. Agents on servers and laptops, syslog collectors for firewalls and network devices, and API (application programming interface) connectors that pull audit logs from Microsoft 365, AWS, Azure and Google Cloud.
2. Parsing and normalization. Each log is read and mapped to common fields, such as user, source address and action, so one rule can work across vendors.
3. Detection. Correlation rules, threat intelligence matching and, in some products, behavior analytics turn single events into alerts.
4. Storage and response. Logs stay searchable for a set period, and alerts lead to cases and automated actions such as blocking an address or disabling an account.

The cloud changes where the work happens, not what the work is: you still connect sources, tune rules and investigate alerts.

How your logs reach a cloud SIEM

Systems on your network need a local agent or collector; cloud services are read through their APIs

1. Your systemsServers, laptops, firewalls, switches
2. Agent or collectorRuns on your network and sends logs out over an encrypted connection
3. Cloud SIEMParses, checks rules and stores. Also pulls Microsoft 365, AWS, Azure and Google Cloud logs by API.
4. Your teamAlerts, search, reports and response from a web console

Cloud-native, hosted or self-hosted

	Cloud-native	Hosted	Self-hosted in your cloud
Who runs servers and upgrades	The provider	The vendor	You
Tenancy	Shared platform, your data kept apart logically	Varies; some give each customer a dedicated instance	Yours alone
How it grows	Scales automatically	The vendor resizes your instance	You add servers
Typical pricing	Data volume	Devices, data volume or capacity	Software license (or free) plus your cloud bill
Leaving	Export through APIs; rules and queries rarely move	Often possible to run the same product in-house	Already yours
Examples	Microsoft Sentinel, Google Security Operations, CrowdStrike Falcon Next-Gen SIEM	Splunk Cloud Platform, UTMStack Cloud	UTMStack, Wazuh or Elastic on your own virtual machines

Cloud-native services suit organizations that want no infrastructure at all and whose data already sits with the same provider. Microsoft Sentinel, for example, ingests Azure activity logs and Office 365 audit logs at no charge, which makes it a natural fit for Microsoft-heavy companies.

Hosted services suit teams that want the convenience of the cloud with sizing they can predict, and the option to bring the same platform in-house later without relearning it.

Self-hosted in your own cloud account suits teams that need control over regions, encryption keys or custom integrations, and that have the people to patch, scale and back up the system. It is the same work as running a SIEM in your own data center, on rented hardware. Our guide to self-hosted SIEM covers that path.

In practice almost every cloud SIEM deployment is hybrid: the platform is in the cloud, and collectors on your network forward logs from the systems that stay on-premises.

Pros and cons of a cloud SIEM

What you gain:

• No servers to buy, patch or replace, and no storage planning when log volume grows.
• A faster start. Setup is mostly connecting sources, not building infrastructure.
• Updates without maintenance windows. The provider upgrades the platform and ships new detection content.
• Easy cloud connections. Connecting Microsoft 365 or a cloud account is usually a matter of granting read access.

What you give up or must manage:

• Your logs leave your network. Logs carry user names, email addresses, IP addresses and host names. You rely on the provider’s security and on where it stores data.
• Costs that follow your data. Under volume pricing, every new source, verbose logging setting and incident raises the bill.
• Bandwidth. Every log crosses your internet link. Sites with thin links are poor fits.
• Lock-in. Rules, saved searches and dashboards are written in the provider’s query language and rarely move with you.
• Less control. The provider decides when upgrades happen and which features sit in which tier.
• No offline option. Networks with no internet connection, common in defense, utilities and industrial sites, need a SIEM installed inside them.

How cloud SIEMs are priced

The pricing unit decides how your bill grows, so it matters more than the starting price.

• Per gigabyte ingested. Microsoft Sentinel bills its analytics tier by the gigabyte, pay-as-you-go or through commitment tiers that start at 100 GB a day. The first 90 days of retention are included. Longer retention goes to its data lake tier, which has separate meters for ingestion, processing, storage and queries.
• By ingestion volume, with retention included. Google Security Operations prices all three of its packages by ingestion volume and keeps 12 months of data by default, which can be extended to up to five years in the purchase order.
• By ingest or workload. Splunk offers data-ingest pricing and workload pricing, which charges for the computing capacity your searches and detections use.
• Per device. You pay for each log source, whatever it sends. UTMStack Cloud works this way.

Costs that sit outside the headline price:

• Retention beyond the included period, and fees to search archived data.
• Automation and connectors. In Sentinel, playbooks run on Azure Logic Apps and some data connectors use Azure Functions; Microsoft bills both separately.
• AI features. These are often metered on their own. Microsoft, for example, bills some Sentinel AI tools in Security Compute Units.
• Data transfer out of your own cloud account, when the SIEM runs in another cloud or region.
• People. A cloud SIEM removes server work, not alert work. Someone still triages, tunes and investigates.

To see how volume pricing moves, take the example company in our SIEM cost guide: 134 log sources sending about 12 GB of logs a day, or about 360 GB a month. If its firewalls start logging allowed traffic, adding about 4 GB a day, a per-gigabyte bill rises by about a third. A per-device bill does not change, because no devices were added.

Data residency: where your logs live

Logs are personal data more often than people expect: they are full of names, email addresses and IP addresses. Before you choose a cloud SIEM, find out where it will keep them.

• Pick the region at the start. Ask where logs, backups and copies used by support or AI features are stored. Some services cannot move later: Microsoft documents that a Microsoft Defender tenant cannot be moved to a different region once it is created.
• European Union. The General Data Protection Regulation (GDPR) restricts transfers of personal data outside the European Economic Area unless an adequacy decision or another safeguard, such as standard contractual clauses, applies. For the United States, the European Commission adopted the EU-US Data Privacy Framework on 10 July 2023. It covers only U.S. companies certified under the framework. The EU General Court dismissed a challenge to it on 3 September 2025 (Case T-553/23). Many European buyers still prefer a provider that stores logs in Europe, which avoids the question.
• U.S. defense contractors. If your logs may contain controlled unclassified information (CUI), DFARS 252.204-7012 requires a cloud provider that meets security requirements equivalent to the FedRAMP Moderate baseline. Our guide to CMMC SIEM requirements explains when that applies.
• Air-gapped and restricted networks. If logs may not leave a site at all, the SIEM must run inside it.

What to look for in a cloud SIEM

Use a trial or proof of concept to test how you will operate, not just how the console looks.

1. Your own sources, tested. Connect your real firewall, domain controllers, Microsoft 365 and cloud accounts during the trial. Check that the fields you need are parsed.
2. Detection content you can read. How many built-in rules are there, are they mapped to MITRE ATT&CK (the public catalog of attacker techniques), and can you edit them or write your own?
3. Retention that matches your rules. How long are logs searchable at the quoted price, and can you search archives without a restore or an extra fee?
4. A pricing unit you can live with. Ask what the bill becomes if your log volume doubles.
5. Built-in response. Can it block an address, disable an account or isolate a host, or is automation a separate product?
6. Region and tenancy. Where is data stored, and is your instance shared or dedicated?
7. A way out. Can you export raw logs and rules in open formats? Can you run the same product on your own servers?
8. Provider security. Ask for independent audit reports, single sign-on, multi-factor sign-in and role-based access.

Moving to a cloud SIEM

1. List your sources and retention needs, and mark the ones an auditor or an investigation cannot do without.
2. Connect the high-value sources first: domain controllers, firewalls, Microsoft 365 or Google accounts, and cloud accounts.
3. Run old and new side by side for a few weeks, compare alerts, and move only the rules you still trust.
4. Switch off the old system once the new one has handled normal weeks and at least one busy one.

How UTMStack fits

UTMStack Cloud is a hosted SIEM. Each customer gets a dedicated UTMStack instance, not a shared index, in OVHcloud data centers in the United States, Canada, the United Kingdom, France or Poland, so European customers can keep logs in Europe.

• The same platform as self-hosted UTMStack. It checks every log against 600+ detection rules mapped to MITRE ATT&CK as it arrives, before storage. Response flows can block an address, disable an account or isolate a host through the agent. See log management for how collection and correlation work.
• Hybrid by design. Agents and collectors send logs from your network to your cloud instance over encrypted connections, and cloud integrations cover Microsoft 365, AWS, Azure and Google Cloud.
• Retention. Cloud plans keep about one month of logs in fast storage and archive older logs for a year. Archived logs stay searchable without a restore, and longer retention is available on request.
• Priced per device, never by log volume, with plans from 25 to 500 devices and custom sizing above that. Ask for a quote or see pricing.
• Move either way. Cloud and self-hosted run the same platform. If logs cannot leave your network, the free open source Community edition and the Enterprise edition run on your own servers, and the installer has an air-gapped mode.

One limit to know: UTMStack Cloud is not FedRAMP authorized, so defense contractors whose logs may contain CUI should run UTMStack on their own servers. To look around first, open the live demo (no sign-up) or start a trial from the UTMStack Cloud page.

Frequently asked questions

What is a cloud SIEM? A SIEM delivered as a service. The provider runs the servers, storage and updates, and you send logs to it over the internet and work in a web console.

Is a cloud SIEM better than an on-premises SIEM? Neither is better everywhere. A cloud SIEM saves infrastructure work and suits cloud-heavy companies. An on-premises SIEM suits networks whose logs cannot leave, very high log volumes and teams that want full control.

How much does a cloud SIEM cost? It depends on the pricing unit. Volume-based services grow with your gigabytes of logs, and per-device pricing grows with the number of sources. Add retention, automation, AI features and the people who watch alerts. Our SIEM cost guide walks through the models.

Is a cloud SIEM secure? It can be, but you are trusting the provider with sensitive data. Check where logs are stored, who at the provider can reach them, and what independent audits the provider can show.

Can a cloud SIEM monitor on-premises systems? Yes. Agents and collectors on your network forward logs to the cloud over encrypted connections. Only networks with no internet access need a SIEM installed inside them.

What is the difference between a cloud SIEM and a managed SIEM? A cloud SIEM is software you use as a service; your team still watches the alerts. A managed SIEM adds a provider’s analysts who watch, tune and respond for you.

Sources

• Microsoft Sentinel: plan costs and understand pricing and billing
• Microsoft Defender XDR: data retention and data storage location
• Google Security Operations packages and data retention
• Splunk platform pricing
• European Commission: EU-US data transfers
• General Court of the EU, press release No 106/25, Case T-553/23 Latombe v Commission (3 September 2025)
• DFARS 252.204-7012, Safeguarding Covered Defense Information
• UTMStack Cloud and pricing