SIEM Tools Compared: Open Source vs. Enterprise SIEM in 2026

SIEM tools fall into 2 categories, open source and enterprise, and both aggregate, normalize, and correlate security logs. The real choice between them is not features but who carries the operational cost. German IT security budgets stayed flat at 18% of the total IT budget in 2026, the same share as 2025 and still below the 20% that BSI and Bitkom recommend, according to Bitkom’s Wirtschaftsschutz 2026 study. That gap forces a direct question: fund a SIEM through a subscription, or fund it through engineering hours instead. This guide compares total cost of ownership, the 4 pricing models SIEM vendors actually use, German compliance evidence duties under NIS2 and BSI C5:2026, data sovereignty, the main open source tools, and the types of enterprise vendors active in Germany, then sets out when each category fits.

What distinguishes an open source SIEM from an enterprise SIEM?

An open source SIEM publishes its source code under a license that permits free use, inspection, and modification, while an enterprise SIEM, such as SecureVisio, sells a commercial license bundled with vendor support, maintained detection content, and an integrated platform. Security Information and Event Management (SIEM), the category itself, aggregates, normalizes, and correlates log data from across an organization to detect threats. The license does not remove cost; it relocates it. An open source SIEM shifts spend from a subscription line to engineering hours, hardware, and the time a team spends maintaining detection rules. An enterprise SIEM keeps that spend visible as one subscription line, with the vendor absorbing the engineering behind it.

What do open source licenses like GPL, AGPL, and SSPL actually permit?

Open source and source-available licenses fall into 3 practical categories for a company evaluating a SIEM.

• Permissive licenses, such as the Apache License 2.0, let an organization use, modify, and redistribute the code with almost no restrictions, including inside a closed-source product.
• Copyleft licenses, such as the GNU General Public License version 2 (GPLv2) or the Affero GPL version 3 (AGPLv3), require that modifications distributed to others stay open under the same license; AGPLv3 extends that requirement to software offered only as a network service, closing what is often called the SaaS loophole.
• Source-available licenses, such as the Server Side Public License (SSPL) or the Elastic License 2.0 (ELv2), publish the code and allow free self-hosted use, but are not approved by the Open Source Initiative (OSI) and typically restrict offering the software as a competing hosted service.

Several well-known SIEM projects sit in the source-available group rather than the open source group, and the overview of open source and source-available tools further below lists the license of each one. The exact license determines what a company may legally do with the code, not only whether it costs money.

Which deployment models exist for a SIEM: on-premises, SaaS, or hybrid?

A SIEM runs in 3 deployment models.

• On-premises: the organization installs and operates the SIEM on its own hardware or private cloud, keeping full physical control of the data.
• Software as a Service (SaaS): the vendor hosts and operates the platform, and the organization sends logs to infrastructure it does not control.
• Hybrid: collection and correlation stay on-premises or in a private environment, while specific functions, such as long-term storage or AI-assisted analysis, run in the vendor’s cloud.

Open source tools default to on-premises or self-managed cloud deployment; some projects also sell a vendor-hosted SaaS tier. Enterprise vendors offer all 3 models, and the deployment choice interacts directly with the data sovereignty question addressed further below.

What does a SIEM actually cost beyond the license?

A fair SIEM cost comparison includes 5 categories: the license or subscription fee, engineering hours, hardware and storage, detection-content maintenance, and support. German companies already operate with little room to absorb an underestimate here. IT security spending stayed at 18% of the total IT budget in 2026, unchanged from 2025 and up from just 9% in 2022, yet still below the 20% mark BSI and Bitkom recommend, and more than half of German companies spend even less than that 18% average, according to Bitkom’s Wirtschaftsschutz 2026 study. A license price that looks like a saving on paper can still strain a budget that has no slack left for engineering hours, hardware, or a support contract bought later under pressure.

How many engineering hours does a self-hosted open source SIEM require?

Self-hosted open source SIEM software carries no license fee, and the engineering hours to run it replace that fee rather than adding to it invisibly. A small single-host deployment for up to around 100 monitored endpoints runs on modest hardware (4 to 8 vCPU, 8 GiB RAM, 50–200 GB of storage for 90 days of retention, according to the sizing guidance of Wazuh). Beyond that range, the deployment splits into a multi-node cluster, which adds cluster administration, patching, and capacity planning to a team’s workload. Automated response typically runs through scripts (Bash, Python, or PowerShell) that the team writes and maintains itself, not through a built-in workflow builder. An organization that cannot staff this work buys it back as a hosted tier from the project vendor or as a managed service, which converts a free platform into a subscription again.

Which pricing models do SIEM vendors use?

SIEM vendors price on 1 of 4 models.

• Per-GB ingest pricing charges for the raw volume of log data sent into the platform each day.
• Per-EPS pricing charges for EPS (events per second, the rate of individual log events a SIEM processes), which reflects processing load but still scales with activity.
• Per-node or per-asset pricing charges for the number of protected systems, IP-based assets, or endpoints, independent of how much log data each one generates.
• Flat or unlimited pricing charges a fixed platform fee regardless of volume.

The pricing model decides how the bill reacts to log growth, and log volume grows every year through cloud workloads, containers, and verbose security tooling. The hidden costs of SIEM, and why ingest pricing blows up SOC budgets explains that mechanism in detail.

What evidence does NIS2 require a SIEM to produce, and how do DSGVO and BSI C5:2026 fit in?

NIS2 requires covered organizations to prove they can detect, report, and document a security incident within fixed deadlines, and a SIEM is the practical mechanism most organizations use to produce that evidence. The NIS2UmsuCG, Germany’s transposition of the EU’s NIS2 Directive, in force since 6 December 2025, brought roughly 29,500 companies across 18 sectors into scope, applying in general to organizations with at least 50 employees, or with both annual turnover and balance sheet total above €10 million, plus certain entities regardless of size.

What must an organization prove under the NIS2 evidence duty?

§ 38 BSIG obliges management to implement the NIS2 risk-management measures and to oversee their implementation; tasks can be assigned to others, such as a CISO or a service provider, but the final responsibility stays with management. § 39 BSIG obliges KRITIS operators (Betreiber kritischer Anlagen) to prove their measures to the BSI every 3 years through audits, inspections, or certifications, and the BSI can order besonders wichtige Einrichtungen (essential entities) to undergo audits at any time. Incident reporting inside that framework runs on a fixed clock: an early warning within 24 hours of becoming aware of a significant incident, stating whether unlawful or malicious action or a cross-border impact is suspected; an incident notification within 72 hours with an initial assessment of severity, impact, and, where available, indicators of compromise; and a final report within 1 month of that notification. Reconstructing an attack’s timeline inside that window by manually reviewing surviving logs is rarely realistic once an attacker has destroyed local log databases, which is why a SIEM that ships logs to a separate, unaffected location before an attack startsis the most practical way to produce that evidence; for KRITIS operators, § 31(2) BSIG goes further and explicitly requires systems for attack detection (Systeme zur Angriffserkennung). Fines for non-compliance reach up to €10 million for besonders wichtige Einrichtungen and up to €7 million for wichtige Einrichtungen (important entities); for entities with a worldwide turnover above €500 million, the cap becomes 2% or 1.4% of that turnover. Under § 38(2) BSIG, managing directors who culpably breach their risk-management duties are liable to their own organization for the resulting damage, under the company-law rules for its legal form, such as § 43 GmbHG or § 93 AktG. The evidence duty applies to the organization, not to a specific vendor, so an open source and an enterprise SIEM face the identical bar; only the effort to configure and demonstrate it differs.

How does DSGVO shape SIEM log retention?

Security logs routinely contain personal data: usernames, IP addresses, and device identifiers all qualify as personal data under the EU General Data Protection Regulation (Datenschutz-Grundverordnung, DSGVO), supplemented in Germany by the Federal Data Protection Act (BDSG). A SIEM must retain that data long enough to support investigation and the NIS2 reporting windows above, while applying DSGVO’s data-minimization and storage-limitation principles, which forbid keeping personal data longer than the stated purpose requires. Access to raw logs needs the same role-based restriction DSGVO expects for any personal-data processing, regardless of whether the SIEM is open source or commercial; the licensing model has no bearing on that obligation.

What does BSI C5:2026 require from cloud-hosted SIEM?

An organization considering a SaaS or hybrid SIEM should check the provider’s Cloud Computing Compliance Criteria Catalogue (C5) attestation before signing. BSI published the current edition, C5:2026, in spring 2026, replacing the prior C5:2020 baseline and adding coverage for container management, post-quantum cryptography, and confidential computing, reflecting how far cloud architecture has moved since 2020. Existing Typ-1 attestations must transition to the new criteria by 1 June 2027, and the Typ-2 review period, which assesses controls over an extended period rather than at a single point in time, starts from the same date. A C5 attestation is an independent auditor’s report against BSI’s baseline, not a self-declared badge, and it applies to the cloud provider hosting the SIEM rather than to the SIEM software itself, a distinction that matters specifically for any SaaS or hybrid deployment.

Does hosting location or legal jurisdiction decide data sovereignty?

Legal jurisdiction decides data sovereignty more than physical hosting location does. SecureVisio, a European vendor, keeps SIEM data in European infrastructure only, deployed on-premises or in a European private cloud, so the data stays under EU law. The same test applies to every provider: a cloud provider can process data exclusively in German or EU data centers and still remain reachable by US law when a US parent company owns or controls it. The US CLOUD Act and Section 702 of the Foreign Intelligence Surveillance Act (FISA 702) both apply based on corporate ownership and control, not on where servers physically sit, so a CLOUD Act warrant or a FISA 702 directive served on a US parent can reach data held by its EU subsidiary regardless of an EU-only hosting commitment. An organization weighing SIEM sovereignty should ask a SaaS or managed provider directly about its ownership structure and the jurisdictions its parent entities answer to, not only where its data centers are. Self-hosted deployments, open source or commercial, sidestep this question only when they run on infrastructure the organization or an EU-controlled provider operates; a self-managed SIEM on a US hyperscaler’s cloud inherits that provider’s jurisdictional exposure.

How does detection content differ between open source and enterprise SIEM?

Enterprise SIEM vendors typically ship and continuously update prebuilt correlation rules and threat-intelligence feeds as part of the subscription, while open source SIEM ships a smaller rule set that a team extends itself or imports from community sources. The strongest open source stacks ship more than 2,000 prebuilt Sigma detection rules mapped to MITRE ATT&CK (a knowledge base cataloguing attacker techniques from initial access through exfiltration), which gives a fully open source deployment genuine detection-as-code capability at no license cost. Other projects draw a paid line: the free tier ships log management only, while correlation rules, user and entity behavior analytics (UEBA), and compliance packs sit in a separate commercial product. Detection content is also where a SIEM hands off to the rest of the security operation: how SIEM and SOC work together covers how a correlated alert actually becomes an investigation, regardless of which SIEM category produced it.

Why does alert fatigue become an engineering cost?

A detection engine that generates too many low-value alerts costs a team time whether the software itself was free or not. The 2025 SANS Detection and Response Survey found that 73% of security organizations name false positives their top detection challenge, and the share reporting very frequent false positives rose from 13% to 20% year-over-year. Tuning that noise down is detection-content work: writing, testing, and retiring rules, which falls entirely on the operating team under a self-maintained open source rule set, and partly on the vendor under an enterprise subscription that includes managed detection content.

How well does each SIEM category scale as log volume grows?

Open source SIEM scales through manual cluster sizing, while enterprise and SaaS SIEM scale through vendor-managed elasticity billed back to the customer. A self-hosted deployment built on an open source search index, the engine behind most open source SIEM projects, needs its RAM, CPU, and node count planned ahead of growth; Wazuh, for example, recommends its single-host deployment for up to around 100 monitored endpoints and a distributed multi-node cluster beyond that. A SaaS platform scales automatically, but every additional gigabyte or event still appears on the bill under whichever pricing model applies. Scalability, in other words, is never free in either category: open source spends engineering hours to add capacity, and enterprise or SaaS spends budget.

How much integration effort does each SIEM category require?

Enterprise SIEM ships with prebuilt connectors and, often, professional services to deploy them, while open source SIEM typically requires manual agent rollout and custom scripting for anything beyond the vendor’s own built-in integrations. Automated response in most open source projects runs through scripts a team writes for its own environment, and each new data source needs its own parser and field mapping. An organization short on that scripting capacity can reduce the burden by buying it back, either as a vendor-hosted SaaS tier for the open source platform itself, or through a service that operates an enterprise platform on the organization’s behalf. Managed SIEM lowers that investment hurdle specifically for organizations weighing that trade-off.

Which open source and source-available SIEM tools are worth evaluating in 2026?

Six widely used open source and source-available SIEM tools differ mainly in their license and scope, and each license carries different practical obligations.

Tool	License	What it is
Wazuh	GPLv2 (core engine); Apache 2.0 (OpenSearch-based indexer and dashboard)	Agent-based XDR and SIEM platform with file integrity monitoring, vulnerability detection, and security configuration assessment built in
Security Onion 3	Elastic License 2.0 (ELv2), source-available, not OSI-approved	Threat hunting, network security monitoring, and log management platform bundling Suricata, Zeek, Elastic Agent, and an Elasticsearch/Kibana backend
Graylog Open	Server Side Public License (SSPL), source-available, not OSI-approved	Free, unlimited-ingestion log management; SIEM detection content sits in a separate paid product
OpenSearch (Security Analytics plugin)	Apache License 2.0	Community-governed search and analytics engine (OpenSearch Software Foundation, Linux Foundation) with a security analytics plugin that ships 2,200+ prebuilt Sigma detection rules
Elasticsearch and Kibana (Elastic Stack)	Choice of AGPLv3, SSPL, or Elastic License 2.0 since August 2024	Search and analytics engine behind Security Onion on this list; the Elastic Security app ships its detection engine and prebuilt detection rules in the free Basic tier, while machine-learning detections and support require a paid subscription
UTMStack	AGPLv3	Combined SIEM, SOAR, and compliance-mapping platform with built-in pre-ingestion correlation

The license distinction matters beyond cost. GPLv2 and AGPLv3 are Open Source Initiative (OSI)-approved open source licenses that let anyone offer the software as a hosted service, although AGPLv3 requires the provider to publish its modifications to users who interact with the software over a network; SSPL and the Elastic License 2.0 are source-available licenses that publish the code but restrict exactly that use, which is why a managed service provider reselling a source-available SIEM as its own hosted product needs a separate commercial agreement with the vendor. An organization evaluating these tools purely as a self-hosted, internal platform is unaffected by that restriction either way.

Which types of enterprise SIEM vendors are active in the German market?

Enterprise SIEM vendors in Germany fall into 4 types, and the type matters as much as the product for a multi-year contract.

Vendor type	Example	Typical pricing model	What to check before signing
European SIEM platform	SecureVisio	Per protected asset or flat licensing, independent of log volume	Deployment options (on-premises, European cloud); depth of SOAR, UEBA, and compliance reporting
Cloud-native SIEM from a US hyperscaler	Microsoft Sentinel	Per-GB ingest, with commitment tiers and separate long-term storage tiers	Ownership and CLOUD Act exposure; cost of retention beyond the default period
Established enterprise platform from a US vendor	Splunk (part of Cisco since March 2024)	Per-GB ingest or workload-based (compute consumed by searches and dashboards)	Roadmap and support commitments after the acquisition
Platform split by an acquisition	IBM QRadar (SaaS business sold to Palo Alto Networks in 2024; on-premises QRadar remains with IBM)	On-premises: IBM licensing; former SaaS customers: migration to Palo Alto Networks Cortex XSIAM	Long-term support roadmap for on-premises QRadar; migration path and cost for former SaaS customers

SecureVisio combines SIEM, UEBA, SOAR, and vulnerability management on one shared data model and licenses on protected assets rather than log volume, which keeps the bill tied to the size of the organization instead of its log growth. Ownership changed for several large SIEM products between 2024 and 2026. Palo Alto Networks announced in April 2025 the end of sale and end of life of the QRadar SaaS products it acquired, with end-of-life dates between 14 April and 31 August 2026, while on-premises QRadar products were not affected and remain with IBM. A buyer evaluating any enterprise SIEM should confirm in writing which company owns the product today, which deployment model is still sold, and how long it stays supported.

When does an organization choose open source, and when does it choose enterprise instead?

Choose open source SIEM when the organization has 3 conditions in place: dedicated engineering capacity to build and maintain a cluster, capacity to write and tune detection rules in-house or accept a smaller rule set, and a compliance posture that does not require a vendor-backed evidence package out of the box. Choose enterprise SIEM instead when any of the reverse applies: engineering hours for security tooling are scarce, which matches the 18%-of-IT-budget reality most German companies already operate inside; detection content needs to arrive maintained rather than authored from scratch, particularly under the alert-fatigue pressure described above; or NIS2 and DSGVO evidence needs to reach an auditor backed by vendor documentation rather than an internal team’s own paperwork, supported, for a SaaS or hybrid deployment, by the provider’s C5:2026 attestation. Some organizations land on a hybrid answer: an open source collection layer feeding a managed or enterprise correlation and compliance layer on top, trading part of the license saving for part of the support guarantee, without adopting either category outright.

Frequently asked questions

Is open source SIEM really free? No, open source SIEM is not really free once engineering hours are counted. The software itself carries no license fee under a license such as GPLv2 or AGPLv3, but running it still costs infrastructure, detection-content maintenance, and staff time, and several open source projects sell a paid hosted tier specifically for organizations that want that cost taken off their own team.

Can an open source SIEM satisfy the NIS2 evidence duty? Yes, an open source SIEM can satisfy the NIS2 evidence duty, provided the organization configures log retention, access control, and reporting workflows to meet the same 24-hour, 72-hour, and 1-month deadlines an enterprise platform would. NIS2UmsuCG does not mandate a specific vendor or license; it mandates evidence, and a correctly configured open source deployment produces the same audit trail a commercial one does, at the cost of building that configuration in-house rather than receiving it prebuilt.

Open source and enterprise SIEM solve the same detection problem through opposite cost structures: one relocates spend into engineering hours, hardware, and self-maintained detection content, and the other keeps it visible as a single subscription that bundles support and managed content in. Neither is the automatically cheaper option once total cost of ownership, NIS2 evidence duties, BSI C5:2026, and data sovereignty enter the calculation, and the right choice for a specific organization depends on which of those costs it can already absorb internally and which it needs a vendor to carry instead. German IT security budgets sitting flat at 18% of total IT spend make that calculation less forgiving than it looks on a feature comparison sheet, which is why the deployment model and pricing model deserve at least as much scrutiny as the feature list before an organization commits to either open source or enterprise SIEM in 2026.