LogRhythm pricing in 2026: the self-hosted SIEM line, per-MPS and full TCO
The independent LogRhythm pricing reference for 2026. Post-merger, LogRhythm is the self-hosted SIEM line priced per-MPS under the ULP model; new cloud-native deployments default to Exabeam New-Scale SIEM. Real per-unit anchors (DetectX, RespondX, user access), cost scenarios from 500 MPS to 50,000-plus, and where LogRhythm beats per-GB SIEMs on TCO. Updated July 2026.
Per-unit anchors from the publicly filed LogRhythm ULP price book (Dec 2022); product framing from the LogRhythm SIEM (Exabeam) page. Ranges reflect add-on lines and typical negotiated discounts.
How LogRhythm pricing actually works
LogRhythm bills on Messages Per Second (MPS), which measures the sustained event rate the platform processes rather than the gigabyte volume it stores. The MPS unit is the largest structural difference from Splunk and Sentinel, and it changes which buyer profiles win on cost. Quiet, predictable log sources where each event represents real detection value (Windows security events from a hardened estate, application audit logs, authentication systems) translate efficiently to MPS. Verbose, low-fidelity sources where each event is mostly noise (debug logs, NetFlow, deep packet inspection metadata) translate poorly: high MPS, low value-per-event. The pricing model rewards source discipline at the agent level.
The ULP price card is built from per-unit lines, not an Essentials-versus-Enterprise base fee. DetectX, the core analytics engine, lists at roughly $65 per MPS per year and drives the bulk of any LogRhythm bill. RespondX, the SOAR module, adds roughly $8.50 per MPS per year when licensed, priced per-MPS rather than per-playbook or per-execution. UEBA is a per-unit add-on layered on top rather than a tier you unlock. There is no platform base fee: the contract is the sum of the per-MPS analytics line, any per-MPS SOAR line, user access, and the network module.
User access is a distinct line: named analyst and monitored-user access lists at roughly $184 per user per year under the User Access License. For most LogRhythm estates the user line is a minor share of total cost next to the per-MPS DetectX analytics; the MPS line, not seat count, is where the money is.
The largest source of LogRhythm bill surprise is the gap between contracted MPS and observed MPS at peak. LogRhythm's licensing docs do not publish a standard overage mechanism, so how sustained breaches of the contracted rate are handled is contract-specific; the safe assumption is that under-sizing gets corrected at renewal on the vendor's terms. Sampling the true 95th percentile MPS over a representative window before signing avoids this. LogRhythm provides the visibility natively, but customers under-size and pay the spread.
Negotiated discounts of 15-25 percent at term renewal are standard for contracts above $200K list. Multi-year commits push the band to 25-30 percent. Mid-term upsells almost never trigger structural discounts; saving the negotiation for renewal time is the right discipline. LogRhythm has been aggressive on price competitiveness against Splunk and Sentinel since the LogRhythm-Exabeam merger (announced May 2024, completed July 2024) created a combined-portfolio SIEM provider, and the 2026 quarter-end environment is generally favourable for buyers running a competitive process.
LogRhythm pricing by MPS band
| MPS band | GB equivalent | Profile | Annual licence |
|---|---|---|---|
| 500 MPS | ~5-7 GB/day | Small business, single data centre | $33K-$40K/yr |
| 2,500 MPS | ~20-30 GB/day | Mid-market, multi-site | $160K-$190K/yr |
| 10,000 MPS | ~100-130 GB/day | Lower enterprise | $550K-$750K/yr |
| 25,000 MPS | ~250-320 GB/day | Large enterprise, multi-region | $1.3M-$1.9M/yr |
| 50,000+ MPS | ~500+ GB/day | Global enterprise, regulated industry | $2.5M+/yr list, ULP-unlimited territory |
Estimates derived from the Dec 2022 ULP price-book per-MPS rates; ranges reflect add-on lines and typical negotiated discounts. Multi-year EA discounts of 20-30 percent are a common outcome above $300K list value.
LogRhythm SKU reference
| SKU | Pricing | What it actually buys |
|---|---|---|
| LogRhythm SIEM (self-hosted) | Per-MPS ULP, subscription or perpetual | On-prem or self-managed private cloud. The only product still carrying the LogRhythm name post-merger. |
| DetectX (analytics) | ~$65 / MPS / yr | Core SIEM analytics engine. Drives the bulk of the licence. |
| RespondX (SOAR) | ~$8.50 / MPS / yr | Response automation, priced per-MPS, not per-playbook or per-execution. |
| User Access License | ~$184 / user / yr | Named analyst and monitored-user access. |
| NetMon / NDR | Per-monitored-bandwidth | Network detection module. |
| UEBA add-on | Per-unit add-on | Behavioural analytics, licensed on top. Not an edition gate. |
| Exabeam New-Scale SIEM | Cloud-native subscription | Default for new cloud-native deployments post-merger. Not LogRhythm-branded. |
Five LogRhythm cost optimisations that genuinely work
Right-size MPS at peak, not average
10-15% on overage exposureLogRhythm SIEM bills against sustained MPS, and sizing against your true peak matters. Sample your 95th percentile MPS over a representative window before sizing. Customers who contract on optimistic averages end up renegotiating capacity mid-term from a weak position.
Filter low-fidelity sources at the agent
20-30% on MPSLogRhythm's System Monitor agent supports source-side filtering. Dropping non-actionable Windows event noise (Service Control Manager spam, routine logon successes) cuts the MPS line meaningfully without losing detection coverage.
Use SmartResponse instead of full SOAR
Drops the ~$8.50/MPS RespondX lineSmartResponse is the included automation feature on the LogRhythm SIEM platform. For organisations whose response playbooks are simple (notify, isolate, ticket), SmartResponse covers the use case without adding the RespondX SOAR line, which is priced per-MPS at roughly $8.50/MPS/yr, not per-playbook or per-execution.
Negotiate at term renewal, not mid-cycle
15-25% listLogRhythm's renewal cycle is the credible negotiation pressure point. Mid-term upsells lock in list pricing; term renewals open structural discounts in the 15-25 percent band, deeper at multi-year commit.
Move archive to S3 or Azure Blob
60-70% on long-tail retentionOn the self-hosted LogRhythm SIEM line, retention beyond the active window is driven by indexer and storage capacity you own. Configuring archive export to commodity object storage and querying back via the platform's archive search dramatically reduces long-tail retention spend versus scaling indexer appliances for it.
LogRhythm-Exabeam merger: what it means for buyers
LogRhythm and Exabeam announced their merger in May 2024 (financial terms were not disclosed) and closed it in July 2024. The combined entity operates under the Exabeam brand and folds LogRhythm's on-prem / private-cloud SIEM platform together with Exabeam's UEBA-led cloud-native SIEM portfolio. The merger's strategic intent, as publicly stated by the parties at announcement, was to give a combined customer base a wider choice of deployment models (on-prem, private cloud, cloud-native) under one vendor relationship rather than having to choose between them.
What buyers should weigh:
- Per-MPS pricing on the self-hosted LogRhythm SIEM line carries forward post-merger; the per-unit shape of the ULP price card on this page is the structure that persists. List prices and bundling can shift between renewals as the combined portfolio evolves.
- Renewal-cycle leverage has increased for incumbents. The combined entity has incentive to keep LogRhythm customers from churning to Splunk, Sentinel, or Sumo Logic during the integration period; this typically translates into more discount headroom at renewal if you signal a real evaluation of alternatives.
- Roadmap clarity is the open question. Customers evaluating long-horizon SIEM commitments should ask the account team specifically about the LogRhythm SIEM product roadmap relative to the Exabeam platform - the integration plan has been described publicly but the per-feature deprecation/consolidation cadence is the kind of thing that depends on a quote-time discussion, not a marketing page.
- For organisations whose detection content is heavily built on LogRhythm-specific analytics, migration cost to the Exabeam platform is non-trivial. Asking for migration-cost-protection language in the next renewal is a reasonable negotiation lever.
Verify the current combined-entity product strategy and any specific roadmap statements directly with the vendor before making a multi-year commitment; product-portfolio decisions continue to evolve post-merger.
When LogRhythm is the right SIEM
LogRhythm wins for organisations with stable, quiet log sources where MPS-based pricing rewards source discipline. The classical fit is regulated mid-market: financial services firms below 1,000 employees, regional healthcare networks, manufacturing with strong PCI scope. These organisations generate predictable event rates, value the shipped content packs and the option to add UEBA as a per-unit line, and want to keep data in their own estate without the per-GB price volatility that defines Splunk and Datadog at their scale. LogRhythm's depth on compliance reporting (PCI, HIPAA, SOX content packs ship in product) saves real implementation effort versus building equivalent reporting on Sentinel or Sumo Logic.
LogRhythm is the wrong pick for cloud-native, high-cardinality environments where event rates are inherently spiky and where logs originate from APIs and SaaS apps rather than systems and network appliances. The MPS model punishes this profile structurally; Datadog or Sentinel typically win cleanly. LogRhythm is also wrong for organisations whose detection content investment is built around custom analytics: Splunk's flexibility and content library are unmatched at that profile.
The 2026 buyer environment generally favours competitive processes. Following the LogRhythm-Exabeam merger (announced May 2024, completed July 2024), the combined entity has been positioning aggressively against Splunk, Sentinel, and Sumo Logic on new logos and renewals; quarter-end deal pressure can produce 25-30 percent discounts on previously-list business in the 2,500-15,000 MPS band. Buyers running a real competitive process against Sumo Logic or Sentinel land materially better terms than those who go single-source.