What is the difference between LogRhythm SIEM and LogRhythm Axon?

LogRhythm SIEM is the self-hosted on-premises SIEM, priced per MPS under the ULP model. LogRhythm Axon is the cloud-native SIEM launched in 2022 and is now the strategic go-forward product. Axon is priced per GB of daily log ingestion on tiered pricing that steps down at 250 GB/day, 1 TB/day, and 2.5 TB/day. New cloud-native deployments default to Exabeam New-Scale SIEM after the merger (vendorbenchmark.com, 2026).

What is the typical LogRhythm SIEM annual contract value?

The median Fortune 1000 LogRhythm subscription is approximately $285,000 per year on 500 GB/day ingestion scope. SIEM Self-Hosted at 15,000 MPS runs $180,000 to $285,000 in maintenance annually. Large Axon deployments at 3 TB/day ingestion run $785,000 to $2.1 million per year. Multi-year enterprise agreement discounts of 20 to 30 percent are common above $300,000 list value (vendorbenchmark.com, 2026).

What is the MPS to GB conversion for LogRhythm?

A rough source-dependent rule of thumb is 60 to 80 MPS per GB/day of mixed enterprise log volume. So 5,000 MPS corresponds to roughly 60 to 80 GB/day of log ingestion. MPS to GB conversions should be sampled from the customer's own log sources rather than assumed. The ULP model also offers unlimited-MPS options that compress the effective per-MPS rate at high volume (siemcostcalculator.com, July 2026).

How does LogRhythm pricing compare to Splunk and Microsoft Sentinel?

LogRhythm per-MPS pricing rewards organizations with predictable sustained event rates; per-GB pricing (Splunk, Microsoft Sentinel) rewards organizations with high-volume but low-complexity ingest. For a 5,000 MPS deployment, LogRhythm SIEM lands at $285,000 to $415,000 per year in license plus maintenance, comparable to a Splunk Cloud 100 GB/day deployment at $50,000 to $90,000 per year. LogRhythm's TCO is competitive when staffing and detection engineering cost are included (underdefense.com, July 2026).

LogRhythm SIEM Pricing 2026: Per-MPS ULP Cost Guide

Q: How is LogRhythm SIEM priced in 2026?

LogRhythm SIEM prices on Messages Per Second (MPS), the sustained event rate the platform processes, under the Unified License Program (ULP). DetectX analytics runs roughly $65 per MPS per year, RespondX SOAR runs roughly $8.50 per MPS per year, and named user access runs roughly $184 per user per year. NetMon NDR is priced per monitored bandwidth and UEBA is a per-unit add-on (siemcostcalculator.com, July 2026).

Q: What is the LogRhythm-Exabeam merger impact on pricing?

LogRhythm and Exabeam merged in 2024, with the combined company now operating as Exabeam. The LogRhythm SIEM self-hosted product continues under the LogRhythm brand with MPS pricing intact. New cloud-native deployments default to Exabeam New-Scale SIEM rather than LogRhythm Axon. UEBA capabilities are now primarily delivered via Exabeam Fusion technology integrated with LogRhythm Axon, priced at $28 to $65 per user per year (vendorbenchmark.com, 2026).

Quick Answer

LogRhythm SIEM pricing in 2026 is per-MPS under the Unified License Program (ULP). DetectX analytics runs roughly $65 per MPS per year, RespondX SOAR runs roughly $8.50 per MPS per year, and named user access runs roughly $184 per user per year. The post-merger strategic go-forward cloud product is Exabeam New-Scale SIEM; LogRhythm Axon remains the cloud SIEM option at $0.85 to $1.20 per GB per day at 500 GB ingestion (siemcostcalculator.com, July 2026).

The MPS line, not seat count, is where the bill lives. A 10,000 MPS deployment runs roughly $550,000 to $750,000 per year before professional services.

Last verified: Sep 15, 2026.

At a glance

DetectX analytics ~$65 per MPS per year
RespondX SOAR ~$8.50 per MPS per year
User Access License ~$184 per user per year
500 MPS = ~$33K-$40K per year
10,000 MPS = ~$550K-$750K per year
50,000+ MPS = $2.5M+ per year list (ULP-unlimited territory)
New Axon cloud SIEM $0.85-$1.20 per GB per day at 500 GB/day

LogRhythm SIEM pricing model and SKU breakdown

LogRhythm SIEM prices on Messages Per Second (MPS) under the Unified License Program (ULP). The line items are per-unit rather than a base-fee-plus-tier structure. DetectX analytics runs roughly $65 per MPS per year and is the core that drives most of the bill. RespondX SOAR runs roughly $8.50 per MPS per year and is priced per-MPS rather than per-playbook or per-execution. Named user access runs roughly $184 per user per year. NetMon NDR is priced per monitored bandwidth and UEBA is a per-unit add-on rather than an edition upgrade (siemcostcalculator.com, July 2026).

SKU	Pricing model	What it buys
LogRhythm SIEM (self-hosted)	Per-MPS ULP, subscription or perpetual	On-prem or self-managed private cloud. Only product still carrying the LogRhythm name post-merger.
DetectX (analytics)	~$65 per MPS per year	Core SIEM analytics engine. Drives the bulk of the license cost.
RespondX (SOAR)	~$8.50 per MPS per year	Response automation, priced per-MPS not per-playbook or per-execution.
User Access License	~$184 per user per year	Named analyst and monitored-user access.
NetMon / NDR	Per-monitored-bandwidth	Network detection module.
UEBA add-on	Per-unit add-on	Behavioral analytics, licensed on top of DetectX. Not an edition gate.
Exabeam New-Scale SIEM	Cloud-native subscription	Default for new cloud-native deployments post-merger. Not LogRhythm-branded.

The MPS-to-GB conversion is the most common budgeting question. A rough source-dependent rule of thumb is 60 to 80 MPS per GB per day of mixed enterprise log volume. So 5,000 MPS corresponds to roughly 60 to 80 GB per day of log ingestion. Customers should sample from their own log sources rather than assume the rule of thumb applies to their environment (siemcostcalculator.com, July 2026).

Worked cost examples at common MPS bands

Multi-year enterprise agreement discounts of 20 to 30 percent are common above $300,000 list value. The table below uses the December 2022 ULP price-book per-MPS rates and typical negotiated discounts to estimate annual license cost at five common MPS bands (siemcostcalculator.com, July 2026).

MPS band	GB equivalent	Profile	Annual license
500 MPS	~5 to 7 GB/day	Small business, single data center	$33K to $40K per year
2,500 MPS	~20 to 30 GB/day	Mid-market, multi-site	$160K to $190K per year
10,000 MPS	~100 to 130 GB/day	Lower enterprise	$550K to $750K per year
25,000 MPS	~250 to 320 GB/day	Large enterprise, multi-region	$1.3M to $1.9M per year
50,000+ MPS	~500+ GB/day	Global enterprise, regulated industry	$2.5M+ per year list (ULP-unlimited territory)

The ULP model offers unlimited-MPS options that compress the effective per-MPS rate at high volume. Customers at 50,000+ MPS negotiate unlimited-MPS contracts that change the per-MPS math from a declining rate curve to a fixed-fee model. Without the unlimited option, the per-MPS rate continues to climb at high volume but with diminishing marginal cost (siemcostcalculator.com, July 2026).

LogRhythm Axon cloud SIEM pricing

LogRhythm Axon is the cloud-native SIEM and the strategic go-forward product, priced per GB per day of daily log ingestion. Axon pricing at 500 GB/day list runs $0.85 to $1.20 per GB per day, scaling to $0.55 to $0.85 per GB per day at 2 TB per day. Axon is positioned against Microsoft Sentinel, Chronicle Security Operations, and CrowdStrike Falcon LogScale as cloud-native SIEM alternatives (vendorbenchmark.com, 2026).

Axon deployment	Per-GB-per-day rate	Annual list estimate
250 GB/day Axon	$0.95 to $1.40	$85K to $155K per year
500 GB/day Axon	$0.85 to $1.20	$180K to $320K per year
1.5 TB/day Axon	$0.70 to $1.00	$385K to $785K per year
3 TB/day Axon	$0.55 to $0.85	$785K to $2.1M per year

Post-merger with Exabeam, new cloud-native deployments default to Exabeam New-Scale SIEM rather than LogRhythm Axon. Existing Axon customers continue under the LogRhythm brand. UEBA capabilities are now primarily delivered via Exabeam Fusion technology integrated with LogRhythm Axon, priced at $28 to $65 per user per year depending on tier (vendorbenchmark.com, 2026).

Hidden costs and the staffing line

Staffing is the single largest hidden cost in LogRhythm deployments. Real mid-market LogRhythm total cost of ownership lands near $351,000 per year once everything is counted. License is around $69,000 annually, storage is around $1,000 and up with log volume, and staffing runs around $282,000. Staffing alone makes up roughly 80 percent of the bill. In-house SIEM broadly runs $200,000 to $450,000 in year one for a mid-market deploy, and labor alone can hit $500,000 over a 9 to 12 month rollout (underdefense.com, July 2026).

The renewal license that customers negotiate is the small part of what they actually spend. The realistic LogRhythm TCO conversation should focus on staffing and detection engineering rather than the per-MPS license rate. Most mid-market teams underestimate the analyst time required for detection tuning, content development, and on-call coverage in the year-one deployment phase (underdefense.com, July 2026).