In short
SIEM as a service is security information and event management delivered from the cloud: logs from your endpoints, identities, email, firewalls and cloud services are collected, correlated and kept without servers to run. Managed SIEM adds a team that onboards sources, tunes detections and, in some services, monitors alerts 24/7. Forever Systems sets up and manages the options we supply.
Get a quote for SIEM as a service
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What does a SIEM do?
A security information and event management (SIEM) system brings security-relevant logs from across your organisation into one place. It then:
- Collects events from endpoints, servers, identity providers, Microsoft 365, email security, firewalls, cloud platforms and applications
- Normalises them, so a sign-in from one system can be compared with a firewall event from another
- Correlates events into detections, spotting patterns no single tool would flag, such as an impossible-travel sign-in followed by a new mailbox forwarding rule
- Retains data so you can investigate months back and evidence controls to auditors, insurers and regulators
- Reports through dashboards and compliance views
A SIEM is a tool, not a service: on its own, it raises alerts that someone has to read. That is why SIEMs usually sit inside a security operations centre, and why the line between managed SIEM and managed SOC services is blurring.
Why SIEMs are hard to run
SIEM projects have a reputation for cost and effort. The reasons are practical:
- Ingest: every source has to be connected, parsed and kept working when the source changes its log format
- Volume and cost: many SIEMs charge by data volume, so noisy sources drive up the bill without adding much security value
- Retention: keeping a year or more of searchable data costs money, but short retention can leave an investigation blind
- Tuning: out-of-the-box rules produce false positives until they are adjusted to your environment
- Watching: detections are worthless if nobody acts on them outside office hours
SIEM as a service removes the infrastructure problem: the vendor runs the platform in the cloud. Managed SIEM goes further, with someone onboarding sources, tuning detections and, depending on the service, monitoring alerts around the clock.
SIEM as a service vs managed SIEM
The two terms are often used interchangeably, but they mean different things:
| SIEM as a service (cloud SIEM) | Managed SIEM | |
|---|---|---|
| Platform | Hosted by the vendor; no servers for you to run | Hosted by the vendor or provider |
| Onboarding log sources | Your team, or Forever Systems | The provider, with your input |
| Detection tuning | Your team, using vendor rules | The provider |
| 24/7 alert monitoring | Not included | Included in some services, such as those combined with MDR or MXDR |
| Typical fit | Organisations with analysts who want a modern platform | Organisations that need logging and monitoring without security staff |
At Forever Systems we can set up and manage a cloud SIEM for you, and where 24/7 monitoring is needed we pair it with a vendor service whose SOC watches the data. We do not monitor SIEM alerts ourselves around the clock.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Cloud SIEM and managed SIEM options we supply
These are the SIEM options we supply and set up. Licensing units differ a lot, which is one of the biggest factors in what a SIEM costs you.
| Option | How it is licensed | Retention | Managed option |
|---|---|---|---|
| Sophos Next-Gen SIEM | Add-on to Sophos XDR or Sophos MDR, priced per user and server rather than by data volume | 13 months as standard, extendable to 3, 5, 7 or 10 years | Available alongside Sophos MDR, Sophos's 24/7 managed service |
| CrowdStrike Falcon Next-Gen SIEM | Per gigabyte of data | 365 days in the add-on we supply | A Complete version in which CrowdStrike's Falcon Complete team monitors and responds |
| SentinelOne Singularity AI SIEM | On the volume of data ingested, measured as a monthly average | Agreed at quote; SentinelOne offers long retention in hot storage | Run by your team or Forever Systems; Wayfinder MDR is SentinelOne's separate 24/7 service |
| Todyl SIEM | Per device, with a choice of retention tier | Tiers from 7 days to 5 years | Todyl MXDR runs on the same SIEM, with Todyl's 24/7 analysts |
| Exium XDR360 | Per user or per asset | 7, 30, 90 or 365 days | Exium sells round-the-clock SOC monitoring separately; we confirm what is included |
| TrendAI Vision One Agentic SIEM | By data volume, under TrendAI Flex | Analytic and archival retention options | Part of Vision One Security Operations, with XDR and Agentic SOAR |
| Blackpoint CompassOne Standard | Package priced on endpoints and identities | 365 days of log storage | Blackpoint's SOC provides MDR and ITDR in the same package |
| Check Point MXDR 360 | Service package | Security data lake for long-term retention | Fully managed SIEM within a co-managed SOC framework |
| Splunk Enterprise Security | Splunk licensing, confirmed at quote | Configured to your requirements | For organisations with their own SOC team; Splunk is a Cisco company |
Package contents change as vendors update them, so we quote against the current service description. For licensing detail, see Todyl SIEM licensing, SentinelOne AI SIEM licensing, CrowdStrike Falcon Next-Gen SIEM licensing and Exium XDR360 licensing on our software licensing site.
If you are standardised on Microsoft, Microsoft Sentinel is Microsoft's cloud SIEM; our cloud security site explains it.
Choosing a SIEM: the questions that matter
Start from the outcome you need, not the product:
- Why do you need a SIEM? Detection, investigation history, compliance evidence or an insurer's requirement each point to different options.
- Which sources matter? Identity sign-ins, Microsoft 365 audit logs, firewalls, email security and key servers usually give the most security value. Verbose debug logs add cost without much benefit.
- How long must you keep data? Match retention to what your regulator, contracts or insurer actually require. UK GDPR also expects you not to keep personal data longer than necessary.
- Who will watch it? If nobody can act on alerts out of hours, pair the SIEM with a vendor MDR or MXDR service.
- How is it licensed? Per device or per user is easier to budget; per gigabyte rewards careful source selection.
For standards and regulation, see ISO 27001 logging and monitoring, the NIS Regulations and the Data Security and Protection Toolkit.
Is SIEM as a service the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Forever Systems helps
We set up and manage SIEM as a service and managed SIEM options from the vendors we supply:
- Scope: inventory your log sources and estimate volumes, then recommend a platform and retention period
- Onboard: connect sources, check they parse correctly and enable the detections that matter to you
- Pair with monitoring: where you need 24/7 watching, combine the SIEM with a vendor MDR or MXDR service and agree escalation
- Manage: handle source changes, tuning requests, retention and licence changes, and review usage with you
What is included in your service, and what stays with your team, is confirmed at quote. Ask us for a quote, or contact us to talk through your logging and monitoring needs.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What is SIEM as a service?
SIEM as a service is a security information and event management platform delivered from the cloud. The vendor runs the infrastructure, and you or your provider connect log sources, tune detections and act on alerts.
What is managed SIEM?
Managed SIEM is a SIEM run for you by a provider: they onboard log sources, tune detections and, depending on the service, monitor alerts. With Forever Systems, 24/7 monitoring comes from a vendor service, such as CrowdStrike's Next-Gen SIEM Complete or Todyl MXDR, which we set up and manage.
What does a SIEM do?
A SIEM collects logs from across your organisation, normalises them, correlates events into detections, keeps data for investigation and compliance, and provides dashboards and reports. It does not investigate or respond by itself.
How is a SIEM priced?
It depends on the product. Some are priced per user or server (Sophos Next-Gen SIEM) or per device (Todyl SIEM); others on data volume (CrowdStrike Falcon Next-Gen SIEM per gigabyte, SentinelOne AI SIEM on average monthly ingest). Retention is usually a factor. Ask us for a quote.
Do I need a SIEM if I have MDR?
Not necessarily. MDR services already watch your endpoint and connected data. A SIEM adds long-term, searchable log retention and correlation across more sources, which you may need for compliance, an insurer or deeper investigations.
How long should SIEM logs be kept?
Long enough to investigate an attack back to its start and to meet your regulatory, contractual and insurance requirements, but not longer than necessary for personal data under UK GDPR. The services we supply offer retention from a few days up to years, so we help you match the period to what you actually need to keep.
Still have a question about SIEM as a service?
Ask us and a member of our team will reply by email.