LogRhythm pricing in 2026: the self-hosted SIEM line, per-MPS and full TCO
The LogRhythm pricing reference for 2026. Post-merger, LogRhythm SIEM is Exabeam's self-hosted line, sold as a subscription or perpetual licence under the True Unlimited Data Platform model with no published prices. This page gives the per-MPS anchors from the December 2022 LogRhythm price book (pre-merger, reseller-hosted), an extrapolation from those rates from 500 to 50,000 MPS, and where LogRhythm can beat per-GB SIEMs on TCO. Updated October 2026.
Page updated 13 October 2026/First published 15 May 2026
Per-unit anchors from the December 2022 LogRhythm price book (dated 30 December 2022, pre-merger, hosted by the reseller Presidio; not a public filing and not current list). Current model from Exabeam's LogRhythm SIEM page, which publishes no prices. Both read 13 October 2026.
How LogRhythm pricing actually works
LogRhythm bills on Messages Per Second (MPS), which measures the sustained event rate the platform processes rather than the gigabyte volume it stores. The MPS unit is the largest structural difference from Splunk and Sentinel, and it changes which buyer profiles win on cost. Quiet, predictable log sources where each event represents real detection value (Windows security events from a hardened estate, application audit logs, authentication systems) translate efficiently to MPS. Verbose, low-fidelity sources where each event is mostly noise (debug logs, NetFlow, deep packet inspection metadata) translate poorly: high MPS, low value-per-event. The pricing model rewards source discipline at the agent level.
The pricing model has changed since the merger. Exabeam now sells LogRhythm SIEM under its True Unlimited Data Platform model, a software subscription or perpetual licence that its LogRhythm SIEM page says has no tiers or hidden fees; it shows no MPS meter and no prices. The last per-unit card we can read is the December 2022 LogRhythm ULP price book, hosted by the reseller Presidio. In that book DetectX, the core analytics engine, listed at $65 per MPS per year on subscription and drove the bulk of a LogRhythm bill; RespondX, the SOAR module, added $8.50 per MPS per year, priced per-MPS rather than per-playbook. Those rates are pre-merger and nearly four years old, so use them to sanity-check a quote, not as today's list.
User access was a distinct line in the 2022 book: the User Access License listed at $184 per user per year on subscription. For most LogRhythm estates priced on that card the user line was a minor share of total cost next to the per-MPS DetectX analytics. Whether user access is still itemised under True Unlimited is a question for the quote.
The largest source of LogRhythm bill surprise is the gap between contracted MPS and observed MPS at peak. LogRhythm's licensing docs do not publish a standard overage mechanism, so how sustained breaches of the contracted rate are handled is contract-specific; the safe assumption is that under-sizing gets corrected at renewal on the vendor's terms. Sampling the true 95th percentile MPS over a representative window before signing avoids this. LogRhythm provides the visibility natively, but customers under-size and pay the spread.
Exabeam publishes no discount schedule, so any percentage you read elsewhere is anecdotal. Saving the negotiation for term renewal, and arriving with a competing quote, is the right discipline, particularly now that renewals can move a customer from the per-MPS card onto the True Unlimited model.
LogRhythm pricing by MPS band
| MPS band | GB equivalent | Profile | Annual licence |
|---|---|---|---|
| 500 MPS | ~6-8 GB/day (est.) | Small business, single data centre | $32.5K-$36.8K/yr |
| 2,500 MPS | ~31-42 GB/day (est.) | Mid-market, multi-site | $162.5K-$183.8K/yr |
| 10,000 MPS | ~125-167 GB/day (est.) | Lower enterprise | $650K-$735K/yr |
| 25,000 MPS | ~310-420 GB/day (est.) | Large enterprise, multi-region | $1.63M-$1.84M/yr |
| 50,000 MPS | ~625-830 GB/day (est.) | Global enterprise, regulated industry | $3.25M-$3.68M/yr |
Extrapolation, not a quote: each licence range is simply MPS multiplied by the December 2022 price-book subscription rates (DetectX $65 alone, up to DetectX plus RespondX at $73.50 per MPS per year), before any discount and excluding user access, NetMon and hardware. LogRhythm SIEM is now sold under the True Unlimited model with no published prices, so a current quote may differ substantially. GB/day equivalents use the rough 60-80 MPS per GB rule of thumb and are estimates.
LogRhythm SKU reference
| SKU | Pricing | What it actually buys |
|---|---|---|
| LogRhythm SIEM (self-hosted), current | True Unlimited Data Platform; subscription or perpetual | Exabeam's LogRhythm SIEM page (read 13 Oct 2026): "no tiers or hidden fees", no MPS meter shown, no prices published. Runs in your data centre or self-managed private cloud. |
| DetectX subscription (analytics) | $65 / MPS / yr (Dec 2022 book) | LR-ULP-DTX-MPS-S. Core SIEM analytics engine; drove the bulk of a 2022-era licence. Perpetual equivalent $120.75 / MPS. |
| RespondX subscription (SOAR) | $8.50 / MPS / yr (Dec 2022 book) | LR-ULP-RSX-MPS-S. Response automation, priced per-MPS, not per-playbook. Perpetual equivalent $15.25 / MPS. |
| User Access License subscription | $184 / user / yr (Dec 2022 book) | LR-ACC-AccessLicense-User-S. Named user access. Perpetual equivalent $375 / user. |
| DetectX Unlimited subscription | $325 / unit / yr (Dec 2022 book) | LR-ULP-DTX-UNL-S. The 2022 book's unlimited-MPS option; the book does not state the unit basis on the line. |
| NetMon / NDR subscription | $75,500 (Dec 2022 book) | LR-ULP-NDR-GBPS-S, a per-Gbps network detection subscription in the 2022 book. |
| UEBA add-on | Per-unit add-on | Behavioural analytics, licensed on top. Not an edition gate. |
| Exabeam New-Scale SIEM | Cloud-native subscription | Default for new cloud-native deployments post-merger. Not LogRhythm-branded. |
Five LogRhythm cost optimisations that genuinely work
Right-size MPS at peak, not average
Est. 10-15% on overage exposureLogRhythm SIEM bills against sustained MPS, and sizing against your true peak matters. Sample your 95th percentile MPS over a representative window before sizing. Customers who contract on optimistic averages end up renegotiating capacity mid-term from a weak position.
Filter low-fidelity sources at the agent
Est. 20-30% on MPSLogRhythm's System Monitor agent supports source-side filtering. Dropping non-actionable Windows event noise (Service Control Manager spam, routine logon successes) cuts the MPS line meaningfully without losing detection coverage.
Use SmartResponse instead of full SOAR
Drops the RespondX lineSmartResponse is the included automation feature on the LogRhythm SIEM platform. For organisations whose response playbooks are simple (notify, isolate, ticket), SmartResponse covers the use case without adding the RespondX SOAR line, which the December 2022 LogRhythm price book listed at $8.50 per MPS per year on subscription. Under the current True Unlimited model, confirm whether RespondX is a separate line at all.
Negotiate at term renewal, not mid-cycle
Deal-dependentLogRhythm's renewal cycle is the credible negotiation pressure point. Mid-term upsells tend to price off the existing contract; a term renewal, especially one moving onto the current True Unlimited model, is where structural terms are reset. No discount band is published, so benchmark with a competing quote rather than an assumed percentage.
Move archive to S3 or Azure Blob
Est. 60-70% on long-tail retentionOn the self-hosted LogRhythm SIEM line, retention beyond the active window is driven by indexer and storage capacity you own. Configuring archive export to commodity object storage and querying back via the platform's archive search dramatically reduces long-tail retention spend versus scaling indexer appliances for it.
LogRhythm-Exabeam merger: what it means for buyers
LogRhythm and Exabeam announced their merger in May 2024 (financial terms were not disclosed) and closed it in July 2024. The combined entity operates under the Exabeam brand and folds LogRhythm's on-prem / private-cloud SIEM platform together with Exabeam's UEBA-led cloud-native SIEM portfolio. The merger's strategic intent, as publicly stated by the parties at announcement, was to give a combined customer base a wider choice of deployment models (on-prem, private cloud, cloud-native) under one vendor relationship rather than having to choose between them.
What buyers should weigh:
- The per-MPS ULP card on this page is the pre-merger structure. Exabeam now presents LogRhythm SIEM under the True Unlimited Data Platform model (subscription or perpetual, no tiers), so expect a renewal to be quoted on that basis rather than per MPS.
- Renewal-cycle leverage has increased for incumbents. The combined entity has incentive to keep LogRhythm customers from churning to Splunk, Sentinel, or Sumo Logic during the integration period; this typically translates into more discount headroom at renewal if you signal a real evaluation of alternatives.
- Roadmap clarity is the open question. Customers evaluating long-horizon SIEM commitments should ask the account team specifically about the LogRhythm SIEM product roadmap relative to the Exabeam platform - the integration plan has been described publicly but the per-feature deprecation/consolidation cadence is the kind of thing that depends on a quote-time discussion, not a marketing page.
- For organisations whose detection content is heavily built on LogRhythm-specific analytics, migration cost to the Exabeam platform is non-trivial. Asking for migration-cost-protection language in the next renewal is a reasonable negotiation lever.
Verify the current combined-entity product strategy and any specific roadmap statements directly with the vendor before making a multi-year commitment; product-portfolio decisions continue to evolve post-merger.
When LogRhythm is the right SIEM
LogRhythm wins for organisations with stable, quiet log sources where MPS-based pricing rewards source discipline. The classical fit is regulated mid-market: financial services firms below 1,000 employees, regional healthcare networks, manufacturing with strong PCI scope. These organisations generate predictable event rates, value the shipped content packs and the option to add UEBA as a per-unit line, and want to keep data in their own estate without the per-GB price volatility that defines Splunk and Datadog at their scale. LogRhythm's depth on compliance reporting (PCI, HIPAA, SOX content packs ship in product) saves real implementation effort versus building equivalent reporting on Sentinel or Sumo Logic.
LogRhythm is the wrong pick for cloud-native, high-cardinality environments where event rates are inherently spiky and where logs originate from APIs and SaaS apps rather than systems and network appliances. The MPS model punishes this profile structurally; Datadog or Sentinel typically win cleanly. LogRhythm is also wrong for organisations whose detection content investment is built around custom analytics: Splunk's flexibility and content library are unmatched at that profile.
The 2026 buyer environment generally favours competitive processes. Following the LogRhythm-Exabeam merger (announced May 2024, completed July 2024), the combined entity competes with Splunk, Sentinel and Sumo Logic on new logos and renewals. No discount figures are published; buyers running a real competitive process against Sumo Logic or Sentinel are in a better position than those who go single-source.