Cloud Log Management: Running It in the Cloud vs. Pulling Logs Out of It Cloud log management means two things: a platform hosted in the cloud, or collecting cloud logs from your SaaS. See zcrLog pricing, integrations and limits.
Cloud Log Management: Running It in the Cloud vs. Pulling Logs Out of It
When someone asks whether we have a cloud log management product, the honest answer starts with another question: which kind do you mean? The phrase covers two things that have almost nothing to do with each other, and when the two sides of a conversation are quietly using different definitions, the mismatch surfaces at go-live — the worst possible moment for it.
The first meaning is that the log platform itself runs in the cloud . Someone else racks it. You pay monthly and point your syslog at it.
The second is pulling cloud logs out of the SaaS you already use — Microsoft 365, Google Workspace, AWS.
These are not the same problem. A platform hosted in the cloud might not be able to pull a single log out of another cloud; an appliance sitting in your own server room might pull them just fine. So they need separate answers, and the two sections below give zcrLog's answer to each.
Meaning one: log management that runs in the cloud
zcrLog comes in a cloud-hosted version, so there's no hardware of your own to buy, rack, or replace in three years.
Plan Price Log volume / day EPS Devices Retention zcrLog-Cloud1 THB 4,000/month 1 GB Follows ingest volume Unlimited 90 days zcrLog-Cloud2 THB 10,000/month 3 GB Follows ingest volume Unlimited 90 days zcrLog-Cloud3 THB 14,800/month 5 GB Follows ingest volume Unlimited 90 days zcrLog-Cloud4 THB 26,800/month 10 GB Follows ingest volume Unlimited 90 days
All four tiers ship the same feature set. They differ in capacity only. Nothing is fenced off behind the expensive plan — no premium-only correlation engine, no paywalled report. A small organisation starting on Cloud1 gets MITRE ATT&CK mapping, the AI detection rule, executive summary reporting, alerting, log backup and multi-tenancy — the same list Cloud4 gets.
Which makes sizing the whole decision — not EPS or device count, which are reference figures rather than billing limits, but daily ingest volume: 1, 3, 5 or 10 GB a day. The step from Cloud1 to Cloud2 is THB 6,000 a month for an identical feature list, which makes a week of real ingestion data worth considerably more than an estimate.
The number people skim past is 90 days in the last column. That figure comes straight out of Thai law: the Computer Crime Act requires service providers to retain computer traffic data for no less than 90 days. If you're comparing cloud log management quotes right now, check whether the price in front of you includes 90-day retention or bills it as an add-on — that's where a quoted figure quietly doubles. If you need something an auditor will accept, we've gone through the retention requirements under the Computer Crime Act in more detail.
Meaning two: collecting cloud logs from your SaaS
This is where vendor copy tends to go soft, so here's the actual list.
Here's the cloud SaaS side of what zcrLog collects (see the zcrLog product page for the current list):
Cloud log source Status What it collects Microsoft Entra ID (Azure AD)✅ Available Sign-in Logs, Audit Logs, Directory Sync, Multi-tenant Microsoft 365 (Exchange, SharePoint, Teams)✅ Available Workload audit logs through the Office 365 Management API SentinelOne (EDR)✅ Available API Ingestion, Real-time Alerts, Threat Detection, Endpoint Monitoring AWS CloudTrail ✅ Available CloudTrail events Google Cloud ✅ Available Cloud Audit Logs CrowdStrike Falcon (EDR)✅ Available EDR logs Google Workspace ⏳ Coming Soon — Okta ⏳ Coming Soon —
What's live today: the identity layer, Microsoft 365, AWS CloudTrail, Google Cloud audit logs, and both EDRs (SentinelOne and CrowdStrike Falcon). Google Workspace and Okta are still queued.
That table is zcrLog's. zcrSIEM , a separate product, keeps its own integration catalog
One caveat that trips people up: Google Cloud is not Google Workspace . Both zcrLog and zcrSIEM collect GCP Cloud Audit Logs from Google Cloud, and zcrSIEM's integration reads admin activity, data access and policy denials. Gmail and Drive audit logs are a different product and are not collected by either platform today.
The Entra ID side covers more ground than people expect, because Entra ID is the identity layer sitting under all of Microsoft's cloud. Who signed in to Microsoft 365 and from where, whether MFA passed, who was handed an admin role, who registered a new app — Entra ID records all of it, and zcrLog can put those events on one timeline beside your firewall and EDR logs.
The boundary needs saying just as clearly. Entra ID does not cover in-app activity inside Microsoft 365 — Exchange, SharePoint, Teams. Those events land in the Unified Audit Log, a different system managed through Microsoft Purview, on a separate pipeline. zcrLog collects that pipeline too: Exchange, SharePoint and Teams audit logs, through the Office 365 Management API. zcrSIEM what Entra ID log collection does and doesn't include separately, along with why you'd export them at all when Microsoft is already storing them. Short answer: Microsoft keeps audit and sign-in logs for 7 days on Entra ID Free and 30 days on P1 and P2 — well short of the 90-day minimum Thai law sets for service providers.
Comparison CTA: Entra ID, Microsoft 365, AWS CloudTrail, Google Cloud audit logs, SentinelOne and CrowdStrike Falcon are live today; Google Workspace and Okta are on the list. Compare zcrLog Cloud, Dedicated and Appliance capacity on zcr pricing , or see the full feature set on the zcrLog product page .
What to do if you need Google Workspace now
AWS CloudTrail isn't the gap: zcrLog collects it, as the table above shows. Google Workspace is. zcrLog can't connect to it directly, neither product collects it today, and if it's a hard requirement this quarter, don't wait on zcrLog.
Every zcrLog plan accepts syslog ingestion, and for Google Workspace that is the way in. Google Workspace doesn't emit syslog on its own, though, so something on your side has to translate and forward those events, and the field mapping is yours to build and keep working. That's a project someone has to own, with a maintenance cost attached. Scope it honestly rather than planning around it as though it already ships.
The other thing worth weighing is priority order. The log volume that actually carries security signal usually comes from firewalls, Active Directory and endpoints. Google Workspace logs usually get pulled during a post-incident investigation rather than watched in real time. If that describes your environment, connect what's available now and carry the rest as a known gap — a real one, just lower down the list than your firewall logs.
Cloud or on-premise
Two things decide this. The first is whether you have a policy that logs may not leave the corporate network, which is a hard stop for cloud that no amount of pricing will move; in Thailand that policy turns up most often in government agencies and the financial sector. The second is arithmetic. Cloud3 is THB 14,800 a month, or THB 177,600 over twelve months of monthly billing, and THB 159,840 if you buy it annually (10% less). Put that beside the annual price of a dedicated ICTC tier or the one-off cost of an ICT appliance, and the crossover point is a sum you can do on one line.
Capability doesn't enter into it. The feature set is identical across cloud, dedicated instances (ICTC1-3) and the on-premise appliance (ICT1-3) — where the box sits and how much it can take are the only variables.
Still working out how log management, SIEM and SOC differ, and which one your organisation should start with? The comparison of log management, SIEM and SOC walks through where each one begins and ends.
Try the real thing first
The zcrLog demo needs no form and no sales call first, only the demo login (demo / demo). Go to Log Viewer, then the Microsoft Entra ID tab: audit logs and sign-in logs, a Sync Now button, and 1h / 24h / 7d / 30d / Custom time-range filters to narrow them down.
If you'd rather talk through your own log volume and which tier to start on, here's how to reach us.
Products | Pricing | Resources | Insights | Contact 