SIEM and log-volume pricing for SOC services: estimating GB per day, retention and overages

SOC-as-a-service and managed SIEM are commonly priced by how much log data you send, measured in gigabytes ingested per day, events per second, or a volume tier, plus a charge for how long the data is kept. That makes the bill depend on choices you control: which systems send logs, how verbose they are, and how many days of searchable history you need. To budget, estimate your daily volume per source, decide on retention by purpose (detection, investigation, legal records), ask for the overage price in writing, and plan for growth.

This guide is part of managed cybersecurity service pricing in Canada. All volumes and prices are illustrative.

The units providers use

Unit	What it measures	How it can surprise you
GB per day ingested	Raw or compressed log data received each day	Averages hide peaks; a misconfigured device can double volume overnight
Events per second (EPS)	Number of log events	Small events from chatty sources add up
Per data source or device	Each firewall, server or cloud app connected	Adding sources raises cost even if volume is small
Tier	Bands such as up to 5, 10 or 25 GB per day	Crossing a band can be a step change
Retention	Days or months of data kept searchable or archived	Long hot retention is costly; archive may be slow to search

Ask whether the price is based on raw volume or after the provider filters and compresses, and whether the measure is a daily average over a month or a daily maximum.

Estimating your daily volume

The figures below are illustrative planning assumptions to get a first estimate. Measure your real volume during a trial or proof of concept before signing.

Source	Illustrative volume	Example	Daily estimate
Firewall (busy office)	1–3 GB per day each	2 firewalls × 2 GB	4 GB
Windows servers	0.2–1 GB per day each	6 servers × 0.4 GB	2.4 GB
Microsoft 365 or Google Workspace audit logs	0.5–2 GB per day per tenant	1 tenant × 0.8 GB	0.8 GB
Endpoint telemetry forwarded to SIEM	10–50 MB per endpoint per day	80 endpoints × 25 MB	2 GB
VPN and identity provider	0.1–0.5 GB per day	1 × 0.3 GB	0.3 GB
Total			9.5 GB per day

Illustrative pricing. At $200 per GB of daily volume per month, 9.5 GB per day costs 9.5 × $200 = $1,900 a month, or $22,800 a year before tax. If the provider rounds up to a 10 GB tier at $2,000 a month, the year is $24,000. Enter these figures in the cost estimator using the SOC option.

Retention: what you need and why

Separate three purposes:

Detection. Analysts look at recent data; 30 to 90 days of fast, searchable logs is often enough.
Investigation. Intrusions are often discovered weeks or months after they start. Longer searchable or quickly restorable retention, for example 6 to 12 months, helps establish what was accessed.
Records. PIPEDA's Breach of Security Safeguards Regulations require an organisation to keep a record of every breach of security safeguards for 24 months after determining that it occurred. That is a record of the breach, not necessarily all raw logs, but the logs are often your evidence. Quebec's CAI says incident register information must be kept for at least five years. Your own contracts or sector rules may require more.

Illustrative example. Moving from 90 days to 365 days of searchable retention adds an illustrative $40 per GB/day per month: 10 × $40 = $400 a month, $4,800 a year. Archiving the older data in cheaper cold storage might cost a fraction, at the price of slower searches. Ask the provider for both prices.

Overage and growth terms to negotiate

Overage price per GB above your band, in writing, and whether it is billed monthly or trued up annually.
Grace for spikes: many incidents and misconfigurations create short bursts; ask that short spikes be averaged out.
Notification when volume reaches, say, 80% of the band.
Right to filter: you or the provider can drop noisy, low-value logs (for example debug-level events) without losing detection.
Price for new sources such as a new branch firewall or cloud application.
Export at exit: format and fee to receive your logs when the contract ends; see exit and offboarding.

Reducing volume without reducing security

Forward only the event types that support detection rules and investigations.
Turn off debug logging that was left on after troubleshooting.
Deduplicate sources that send the same events twice (for example, a server and a log collector).
Keep detailed network flow logs in cheaper storage and send summaries to the SIEM.
Review volume each quarter with the provider; ask which sources produce alerts that matter.

Do not cut identity, email and firewall logs to save money: they are often what shows how an intruder got in. The Cyber Centre's baseline controls for small and medium organizations start with an incident response plan, and a plan is only as good as the records you can search when it is triggered; see baseline controls.

Frequently asked questions

Is per-GB pricing fair for a small business?

It is transparent but can be volatile. A small business with few systems may prefer per-user or per-endpoint MDR; see MSSP vs MDR vs SOC-as-a-service.

Who owns the logs?

Your contract should say that log data about your systems is your data, with a right to export it. Ask about format and timelines.

Can logs be stored outside Canada?

Canadian private-sector privacy law does not generally ban this, but accountability, transparency and Quebec's assessment rule apply. See SOC data residency and access.

How do I measure volume before signing?

Ask for a proof of concept of two to four weeks with your main sources connected, and use the measured daily average and peak in the contract.

Sources

Justice Laws Website — Breach of Security Safeguards Regulations (SOR/2018-64), 24-month record-keeping
Office of the Privacy Commissioner of Canada — what breach records should contain
Commission d'accès à l'information du Québec — incident register retention
Canadian Centre for Cyber Security — logging and monitoring guidance