Tenzir pricing in 2026: Community, Enterprise and Sovereign
A Tenzir pricing reference. The free Community tier and its limits, what each paid tier unlocks, where Tenzir sits in the security data lifecycle, and an honest account of what is and is not publicly listed. Built from tenzir.com/pricing and Tenzir's product material, re-verified 13 October 2026. Updated October 2026.
Page updated 13 October 2026/First published 16 June 2026
The tier structure (Community, Enterprise, Sovereign), the Community tier limits and the paid-tier feature splits were read from tenzir.com/pricing on 13 October 2026. Tenzir first confirmed the tier structure and where it sits relative to a SIEM to us on 13 July 2026.
What Tenzir is, and why it matters for SIEM cost
Tenzir is a security data pipeline. It sits between your log sources (servers, firewalls, applications, endpoints) and your SIEM (Splunk, Sentinel, QRadar, Elastic). Telemetry flows into Tenzir, gets shaped and reduced, then routes to one or many destinations. The expensive SIEM only receives the data that matters for detection. The verbose noise goes to cheap storage or gets dropped before it is ever metered at SIEM rates.
This matters because SIEM pricing is overwhelmingly ingest-metered. Splunk Cloud lists at $765 to $2,049 per GB/day per year depending on commit volume ($1,265 at 50 GB/day). Microsoft Sentinel runs $2.96 to $4.30 per GB. At those rates, every gigabyte of debug chatter, DNS noise or verbose Windows event you do not actually use for detection is taxed at SIEM list prices.
Tenzir's lineage is part of why buyers take it seriously. It grew out of VAST (Visibility Across Space and Time), a research engine for security telemetry with roots in the Zeek lineage, and its pipeline language TQL handles parsing, reshaping and routing of events. Tenzir's own material frames the goal as slashing SIEM, cloud and data costs; in practice most environments find 30 to 50 percent of their ingest is detection-irrelevant, which is the headroom a pipeline reclaims before the SIEM ever meters it.
How Tenzir fits, in three parts
Tenzir is a security data pipeline. It sits upstream of the SIEM, between your log sources and Splunk, Sentinel, QRadar or Elastic. Telemetry flows into Tenzir, gets shaped, reduced and routed, and only the data that matters for detection reaches the expensive SIEM.
Tenzir grew out of VAST (Visibility Across Space and Time), an open research engine for security telemetry with roots in the Zeek/Bro lineage. The pipeline language is TQL (Tenzir Query Language), which handles parsing, reshaping and routing of events.
SIEM pricing is overwhelmingly ingest-metered. Splunk Cloud lists at $765 to $2,049 per GB/day per year depending on commit volume ($1,265 at 50 GB/day); Microsoft Sentinel runs $2.96 to $4.30 per GB. Every gigabyte of low-value telemetry is taxed at those rates once it lands in the SIEM.
The three Tenzir tiers
- · Unlimited nodes
- · 1 TB/day ingress + 1 TB edge storage
- · Nodes in your environment, Tenzir-hosted Platform (AWS, Europe)
- · Platform API, community support
- · Unlimited workspaces
- · External secrets, RBAC, audit logs
- · Nodes in your environment, Tenzir-hosted Platform (AWS, Europe)
- · 24x7 support and SLAs
- · Multiple platform instances
- · Custom identity provider
- · Self-hosted Platform, including air-gapped
- · Dedicated support
Source: tenzir.com/pricing, read 13 October 2026. Nodes run in your own environment in every edition. For Community and Enterprise, Tenzir hosts the Platform in AWS in Europe; Sovereign self-hosts the Platform, including air-gapped deployments. Enterprise and Sovereign are "Talk to sales". Community tier limits are published; the paid tiers publish feature sets and support levels but not prices, so this page does not invent dollar figures for them.
The SIEM savings math, worked
Illustrative. The filter ratio (40 percent) sits inside the typical 30 to 50 percent of ingest that most environments find detection-irrelevant (verbose Windows events, DNS chatter, debug streams). That 30 to 50 percent is our own market figure for ingest reduction. Tenzir's SIEM cost optimisation page gives a reference example of 800 GB/day raw reaching the SIEM as 399 GB/day after filtering (tenzir.com/solutions/initiatives/siem-cost-optimization), cited here as their example rather than adopted as ours. Net saving depends on Tenzir's quote, which is not publicly listed, so the licence line is left as a quote rather than a fabricated number.
When a pipeline like Tenzir is the right call, and when it is not
- + SIEM bill above $300K/yr and ingest-metered
- + 30%+ of ingest is detection-irrelevant noise
- + Multiple destinations needed (SIEM + data lake + analytics)
- + Migrating SIEMs and need to reshape data in flight
- + On-premise deployment requirements (Sovereign tier)
- - SIEM bill is under $100K/yr (the math does not work)
- - Single destination, simple log flow
- - Already on Sentinel with free Microsoft 365 source data
- - No engineering capacity to design pipelines properly
- - Below 200 GB/day total ingest (Community tier may be enough)