Comparing Log Systems in 2026 Against the มศอ. 4003-1-2560 (ICT Spec) Standard — SIEM vs Log Management
Compare 5 popular log storage systems in Thailand — zcrLog, Splunk, Elastic, Graylog, and ICT Spec appliances — plus how to pick the right one for you.
Comparing Log Systems in 2026 Against the มศอ. 4003-1-2560 (ICT Spec) Standard: SIEM vs Log Management
Choosing a log system in Thailand is not only a technical choice. It affects legal compliance, audit readiness, cyber defense, and budget.
Many buyers start with one simple question: Do we need log management, SIEM, or a dedicated ICT Spec appliance? The answer depends on what you need the system to do after the logs arrive.
Why comparison matters
Thai organizations usually choose log platforms for four reasons:
- Computer Crime Act compliance: retain logs for at least 90 days
- ICT Spec requirements: the MDES procurement schedule sets Type 1-3 device tiers, EPS ranges, and reference pricing; it references NECTEC's มศอ. 4003.1-2560 standard for general safeguards (access control, NTP time sync, tamper protection, 90-day minimum retention) — the มศอ. standard itself does not define the Type 1-3 tiers or pricing
- Threat detection: identify suspicious activity in real time
- Budget control: avoid buying enterprise tools that require a large team
If the system only stores logs, it may satisfy a narrow audit need. If the organization also needs security detection, SIEM is the better category.
Related guide: Computer Crime Act log retention guide
Log Management vs SIEM
| Capability | Log Management | SIEM |
|---|
| Main role | Store, search, and report logs | Analyze, correlate, and detect threats |
| Real-time alerting | Limited or none | Yes |
| Correlation rules | No | Yes |
| MITRE ATT&CK mapping | No | Yes |
| Compliance reports | Basic | More complete |
| Incident workflow | No | Yes |
| Cost | Lower | Higher |
| Best fit | Compliance-only needs | Security + compliance |
Rule of thumb: if you only need to prove logs exist, log management may be enough. If you need to catch attacks, choose SIEM.
Read more: Log Management vs SIEM vs SOC
Popular options in Thailand
1. zcrLog
Category: Compliance log retention, with threat views
- Supports ICT Spec Type 1-3 and virtual appliance models
- Collects firewall, AD, Entra ID, Microsoft 365, and endpoint logs
- Includes incident correlation and detection rules
- Maps alerts to MITRE ATT&CK
- Provides Thai-focused compliance reporting
- Starts from ฿4,000/month for SaaS
- SaaS onboarding is self-service, with no setup fee
Mid-article CTA: See zcrLog on the product page, or ask for sizing help on LINE @cyberdefense.
2. Splunk
Category: Enterprise SIEM / data platform
Splunk is powerful and flexible, but usually expensive. It often requires specialists, careful data volume planning, and a mature security team.
3. Elastic SIEM
Category: Open-source SIEM stack
Elastic is flexible and can be cost-effective for teams with strong DevOps and security engineering skills. The tradeoff is setup and maintenance effort.
4. Graylog
Category: Log management
Graylog is useful for central log search and operations visibility, but it is not a full SIEM by default.
5. Dedicated ICT Spec appliance
Category: Compliance appliance
Traditional appliances may meet ICT Spec requirements, but many focus on storage rather than real-time threat detection.
Comparison table
| Capability | zcrLog | Splunk | Elastic | Graylog | ICT Appliance |
|---|
| ICT Spec fit | Yes | No by default | No by default | No by default | Yes |
| Threat detection | Detection rules and incident views | Yes | Yes | Limited | Usually no |
| MITRE ATT&CK | Yes | Yes | Yes | Limited | No |
| Thai compliance focus | Yes | Needs customization | Needs customization | Needs customization | Yes |
| Thai dashboard | Yes | No | No | No | Varies |
| Starting cost | Low | High | Low license, high labor | Low license, labor needed | One-time hardware |
| Best fit | Thai compliance + security | Large enterprise SOC | Engineering-heavy teams | Log search | Compliance-only storage |
Comparison CTA: Compare zcrLog SaaS, Dedicated VM, and Appliance plans on zcr pricing, or see the full feature set on the zcrLog product page.
Which option fits your organization?
SME
Choose a SaaS log management platform. You get compliance, search, threat views, and reporting without buying hardware.
Mid-sized organization
Look for multi-source collection, SIEM alerts, reporting, and support. A dedicated VM can be useful if data separation matters.
Enterprise or government
Consider appliance or dedicated deployments, higher EPS capacity, longer retention, backup design, and formal support.
MSSP
Look for multi-tenant operations, incident workflow, and AI-assisted triage. zcrSIEM is designed for this model.
FAQ
Is 90-day retention enough?
It is the common legal baseline, but 365 days is safer for investigations and audits. Some attacks remain hidden for months.
Do I need SIEM if I already have firewall logs?
Firewall logs are useful, but they do not show the whole story. SIEM connects identity, cloud, endpoint, and network events.
Why not just use an open-source stack?
Open-source can work well if you have people to operate it. If you need fast compliance and support, a managed product is usually easier.
Summary
For Thai organizations, the right log platform should do more than store files. It should collect the right sources, protect integrity, support ICT Spec expectations, and detect real threats.
If compliance is the main job, zcrLog is built for it and adds threat views and detection rules; full SOC operations are what zcrSIEM is for, and it is a separate product.
Free consultation
Sources
- มศอ. 4003.1-2560 — NECTEC's technical standard for computer traffic data retention systems (general requirements only, no Type 1-3/EPS)
- MDES procurement schedule (เกณฑ์ราคากลางและคุณลักษณะพื้นฐานการจัดหาอุปกรณ์และระบบคอมพิวเตอร์) — defines Type 1-3, EPS tiers, and reference pricing
- Computer-Related Crime Act B.E. 2550 (2007), Section 26 (paragraph 1 as amended by the Act (No. 2) B.E. 2560) — 90-day minimum log retention requirement
- Graylog Products — Open/Enterprise/Security tier structure
- Graylog — Threat Coverage Widget — confirms MITRE ATT&CK mapping is a Security-tier feature