zcrSIEM vs Splunk, Microsoft Sentinel, IBM QRadar: A Full Comparison Before You Buy
Compare zcrSIEM with Splunk, Microsoft Sentinel, and IBM QRadar on pricing, deployment, SLA, and AI features to help Thai enterprises pick the right SIEM.
zcrSIEM vs Splunk, Microsoft Sentinel, IBM QRadar: A Full Comparison Before You Buy
If you're sitting there right now comparing SIEM quotes, I'm guessing your problem isn't "what is a SIEM" — it's "why does every quote look completely different." One vendor gives you a number per GB. Another wants a sales call before they'll say anything about price. A third only runs in the cloud, and your team might have a data-residency requirement that rules that out on the spot.
This article is meant to be straightforward. We're putting our own zcrSIEM up against the three biggest global players — Splunk Enterprise Security, Microsoft Sentinel, and IBM QRadar — and we're going to say both where we think zcrSIEM is the better fit for a Thai organization, and where we have to admit these competitors are genuinely still ahead of us. If you haven't read the SIEM basics yet, start with What Is SIEM? or Log Management vs. SIEM vs. SOC — it'll make the rest of this easier to follow.
First, a status check on all three vendors
The global SIEM market has moved a lot in 2024–2026. If you're still picturing Splunk, Sentinel, and QRadar the way they looked a couple of years ago, it's worth catching up before you compare pricing.
Splunk Enterprise Security (now part of Cisco)
Splunk isn't an independent company anymore — Cisco closed its roughly $28 billion acquisition of Splunk on March 18, 2024. Splunk Enterprise Security now integrates bidirectionally with Cisco XDR (incidents from Cisco XDR flow into ES as investigations with AI-generated summaries), and the direction is clearly toward one combined Cisco SIEM/XDR platform.
On pricing: Splunk has no public list price. You talk to sales for a quote, period. There are two models — ingest-based (GB/day) or workload-based (Splunk Virtual Compute). Third-party cost calculators (not an official Splunk source) put out wildly different numbers depending on the source — some cite roughly a hundred dollars per GB/day for base ingest, others cite figures in the low thousands specifically for the Enterprise Security module — so treat any specific figure as an illustration of how wide the range can get, not a real reference price. What's easier to say with confidence is that Splunk has a well-known reputation for costs that get hard to predict as ingest volume grows — "how to control your Splunk bill" has basically become its own content category across the industry at this point.
To Splunk's credit: it's been a Gartner Magic Quadrant Leader for SIEM continuously since 2015, and it was named a Leader in the 2025 Gartner Magic Quadrant for SIEM (announced October 8, 2025) for the 11th year running — a streak nobody else in this market currently matches. Its app ecosystem on Splunkbase runs to 2,000+ add-ons (Splunk itself cites over 2,400), bigger than any of the other three vendors compared here. On the AI side, Splunk AI Assistant for SPL — which converts natural language into SPL — is already GA, and it's since expanded into an agentic "Agent Mode" that goes beyond writing queries into running searches and pulling dashboards on its own — non-trivial actions still route through a user approval step, so it's agentic with a human still in the loop, not fully autonomous.
Microsoft Sentinel
Of the three, Sentinel is the one with pricing that's actually public and easiest to verify — pure pay-as-you-go, around $4.30 per GB (US East, per Microsoft's official pricing page), with a commitment tier that can save up to 52% versus pay-as-you-go — both figures confirmed straight from Microsoft's own pricing page. As of October 1, 2025, a new 50 GB/day commitment tier entered public preview at a promotional rate; the first 10 GB/day for a new workspace is free for 31 days, and certain log types (Azure Activity, Office 365 audit, Defender alerts) don't incur ingest charges at all.
The limitation worth being upfront about: Sentinel runs on Azure only — there's no on-premises option, full stop. If your organization has a self-hosting or on-prem requirement, Sentinel disqualifies itself immediately. On AI, Sentinel is tied to Microsoft Security Copilot, which helps summarize and investigate incidents without needing query-language expertise. The Sentinel data lake reached GA on September 30, 2025, with Sentinel graph entering public preview the same day; the Sentinel MCP server has since reached its own GA around November 2025 too — together letting a Copilot agent analyze data across logs, graph, and context. Of the three, Sentinel's AI roadmap is arguably the most ambitious. Sentinel is also a Leader in the 2025 Gartner MQ.
IBM QRadar
QRadar has seen the most upheaval of the three over the past two years, and it's the part a lot of people may not have caught up on yet.
Palo Alto Networks bought QRadar's SaaS assets — QRadar on Cloud, QRadar SaaS, and the related IP — for roughly $500 million, a deal that closed September 4, 2024, and offered those customers a migration path onto its own Cortex XSIAM platform. Under Palo Alto's end-of-life notice, QRadar on Cloud (QROC), the SaaS edition of QRadar SOAR, and QRadar Log Insights reached end-of-life on April 14, 2026; QRadar EDR and XDR followed on August 31, 2026. What IBM kept for itself is on-premises QRadar SIEM, which wasn't part of the sale and has no announced EOL date.
The clearest, most checkable fallout is QRadar's standing in the Gartner Magic Quadrant. IBM was a Leader in SIEM for 14 straight years through May 2024 — but in the October 2025 Gartner Magic Quadrant for SIEM, IBM/QRadar failed to meet the functional requirements and dropped off the chart entirely. That's a fairly dramatic reversal after a 14-year streak. On pricing, QRadar uses an EPS (events per second) / FPM (flows per minute) model under its Usage Model, or MVS (Managed Virtual Servers) under its Enterprise Model — still quote-only, with no public list price.
Where QRadar still genuinely has an edge is its footprint in Thailand — IBM has an office in Chonburi and a Thailand-localized QRadar product page (served in English, not Thai), a clearer localization signal than either Splunk or Sentinel show in this comparison. On AI, it has real, working features built on IBM watsonx — Investigation Assistant and automated alert prioritization among them — though it's fair to say IBM's investment focus increasingly looks like it's shifting to other parts of its portfolio rather than doubling down on QRadar.
So how does zcrSIEM actually differ from all three
Where zcrSIEM stakes out different ground from the three vendors above is pricing clarity and deployment flexibility — the two things that tend to give Thai procurement and compliance teams the most headaches when comparing enterprise SIEM quotes.
Every price published, not a range — the SaaS tiers run ฿6,000/month for 1 GB/day up to ฿45,000/month for 10 GB/day, all at 90-day retention with unlimited tenants and users, billed monthly on a 12-month term, VAT included. The on-premises build — software you run on your own hardware, no appliance — runs ฿31,500/month at 10 GB/day up to ฿158,900/month at 100 GB/day, and there retention is bounded only by the storage you provide. In-between volumes are published too, so you are never quoted a number you cannot check. These numbers sit on our own public pricing page — no quote request needed just to get a ballpark. That's different from Splunk and QRadar, which are both quote-only, and different from Sentinel too — Sentinel is transparent about its per-GB rate, and it does offer Commitment Tiers that fix a daily ingestion volume for a predictable, discounted flat fee (up to ~52% off pay-as-you-go), but that's still a rate-and-volume calculation you have to run yourself rather than a published flat number you can point to.
On licensing we'll be straight with you: zcrSIEM meters what you ingest, in GB per day. That's the same basis Splunk and Sentinel use, and it is not a differentiator against them. What it does buy you is no EPS cap — a burst in events per second never breaches your licence, and spike days are absorbed up to 3x your daily allowance, twice a month, at no extra charge. QRadar is the outlier here: its EPS/FPM model is the one that inflates unpredictably when traffic jumps — exactly the moment you're mid-incident and log volume is surging.
Deployment flexibility is another area where zcrSIEM covers more ground — On-Premises, Virtual Appliance, Private Cloud, Hosted Cloud, and Hybrid, with Collector and Processing Node placement architected around where your log sources actually live, your data-residency requirements, and your network constraints. Critically, data residency is configurable — for organizations that choose On-Premises, Virtual Appliance, or a Thailand-based Private Cloud deployment, log data, metadata, and security-analytics output stay in-country as configured. That matters a lot for Thai organizations under PDPA or sector-specific regulator requirements, since Sentinel is locked to Azure regions (and it's unconfirmed whether a Thailand Azure region is even live yet), and Splunk likewise has no confirmed data-center presence in Thailand.
On published uptime SLAs, Splunk states 100% quarterly, with service credits on a miss. zcrSIEM does not publish a fixed uptime percentage — Hosted/Cloud availability targets and SLA terms are set in the service agreement for the deployment. If a guaranteed uptime figure is a deciding factor, confirm it with the channel partner you would buy through before you commit.
On AI, zcrSIEM has natural-language-to-query — type a plain-English question and the AI generates the query for you — but the important part is that the AI never runs anything automatically. The analyst always reviews and can edit the query before it executes, by design, so the human stays in control rather than the AI making the call. There's also AI incident/timeline summarization, which condenses an incident's alerts, events, and entities into a readable narrative, plus AI-assisted threat context pulling from threat intel, MITRE ATT&CK, and CVE/CVSS data. If you want to go deeper, we've written separately about how AI-assisted threat hunting actually works and how MITRE ATT&CK feeds into incident risk-ranking.
zcrSIEM's core detection capabilities cover out-of-the-box use cases like brute force, privilege escalation, lateral movement, malware, ransomware, data exfiltration, DoS, and web attacks, plus Sigma rule import and UEBA (User and Entity Behavior Analytics) that risk-scores anomalous user/host/asset behavior. If ransomware detection specifically is on your mind, we've got a dedicated piece on how to detect ransomware with a SIEM. All of this is what zcrSIEM is built around: giving Thai organizations enterprise-grade capability without sacrificing budget predictability.
Comparison table: zcrSIEM vs Splunk vs Microsoft Sentinel vs IBM QRadar
| Category | zcrSIEM | Splunk Enterprise Security (Cisco) | Microsoft Sentinel | IBM QRadar SIEM |
|---|
| Pricing model | Published and monthly — SaaS ฿6,000–45,000/mo (1–10 GB/day), on-prem ฿31,500–158,900/mo (10–100 GB/day) | Quote-only, negotiated (ingest-based or workload-based/SVC) | Public pay-as-you-go, ~$4.30/GB, commitment tiers save up to 52% | Quote-only, based on EPS/FPM (Usage Model) or MVS (Enterprise Model) |
| EPS cap | None — metered on GB/day, not events per second (same as Splunk and Sentinel) | None — tied to purchased ingest volume | None — tied to purchased ingest volume | Capped by licensed EPS/FPM |
| Deployment | On-Prem, Virtual Appliance, Private Cloud, Hosted Cloud, Hybrid | Cloud + On-Prem + Hybrid | Azure cloud only — no on-prem | On-Prem only (SaaS side sold to Palo Alto, EOL 2026) |
| Thailand data residency | Configurable, including fully in-country (On-Prem/VA/Private Cloud) | No confirmed Thailand data center | Tied to Azure region — Thailand region availability unconfirmed | No Thailand data center; nearest is Singapore |
| Published uptime SLA | No public figure — set in the service agreement | Yes — 100% quarterly (Splunk Cloud Platform, with service credits on a miss) | No public figure found | No public figure found |
| Gartner MQ for SIEM standing (Oct 2025) | Not yet rated (regional vendor) | Leader (11 years running) | Leader | Not rated — dropped off after 14 consecutive years as Leader |
| Integrations/connectors | Pre-built connectors (named below; more on the roadmap) + CEF/LEEF/Syslog/JSON/HTTP JSON support and a custom parser builder | 2,000+ apps/add-ons on Splunkbase | Microsoft Security Store, expanding fast, several hundred listings | Separately licensed add-on modules (UBA, threat intel, SOAR) |
| Standout AI feature | Natural-language-to-query (review-before-run), AI incident summarization, AI threat context | AI Assistant for SPL (GA) + agentic "Agent Mode" | Security Copilot + Sentinel data lake/graph + MCP server (all GA now) | watsonx Investigation Assistant, AI alert prioritization |
| Local presence in Thailand | Thai team, full Thai-language support | Limited — events/partners only | Thailand localization unconfirmed | Chonburi office + Thailand-region product page (English-language) |
💰 See all 4 zcrSIEM pricing tiers — no quote request needed →
Where we have to admit zcrSIEM still can't compete
Honesty matters more than the sales pitch. Here's where we think all three competitors genuinely still beat zcrSIEM.
Ecosystem and integration marketplace — Splunkbase has 2,000+ apps and add-ons built up over more than 20 years, and Microsoft Security Store is expanding fast because it's tied to the entire Azure platform. zcrSIEM currently has these live, working connectors (AWS CloudTrail, Google Cloud, Microsoft Entra ID, Microsoft 365, CrowdStrike Falcon, SentinelOne Singularity, Zscaler Internet Access, Fortinet FortiGate, Palo Alto PAN-OS, Cisco ASA/Firepower, Sangfor NGAF, Sangfor IAG, Sangfor Endpoint Secure, Sophos Intercept X, Windows Active Directory, Mail Security Gateway) and more on the roadmap. But we want to be clear: the connectors named here work today; the roadmap entries are future plans, not current capability. (The roadmap list includes Splunk Enterprise, IBM QRadar, Microsoft Sentinel, Elastic Security, Wazuh, and more, positioned as future migration/coexistence connectors for organizations moving off those platforms.) Beyond the named connectors, zcrSIEM accepts standard log formats — CEF, LEEF, Syslog, JSON, and HTTP JSON — from any third-party tool, plus a custom parser builder for sources with no pre-built connector, so integration isn't strictly limited to those named connectors in practice. But we'll admit that a custom-parser setup takes more effort than a pre-built connector you just click and go.
Industry analyst validation — Splunk and Sentinel are both Leaders in the latest Gartner Magic Quadrant for SIEM (October 2025). zcrSIEM, as a regional vendor, isn't yet rated in that global MQ at all — worth knowing upfront if your procurement process leans on third-party validation.
Long enterprise track record — Splunk has been in this market since 2003; QRadar, even after dropping off the Gartner MQ, still has decades of enterprise SOC deployment history behind it. zcrSIEM is a much newer product and doesn't have that same accumulated deployment history yet.
These are real trade-offs to weigh against the pricing and data-residency advantages covered above — no SIEM vendor wins on every dimension.
What you should know before trying the demo
zcrSIEM has a live demo you can try at demo.siem.zcr.ai — but unlike most of our other product demos, which are open to anonymous access, this one requires logging in with demo/demo credentials and passing a Cloudflare human-verification step before you can get in. Worth flagging directly, since it's an extra step some people won't expect. If you'd like supporting documentation before diving into the demo, we also have the latest zcrSIEM Datasheet (v1.6.x, Thai-language) and the zcr Partner Presentation (English) available for download.
So which one should your organization actually pick
If your organization is a multinational already heavily invested in the Splunk or Microsoft ecosystem, has a team already fluent in SPL or KQL, or needs Gartner Leader status to get budget approved — Splunk or Sentinel are still reasonable choices, especially if budget isn't the primary constraint and your team can absorb costs that move with ingest volume.
If you were on QRadar's cloud/SaaS side, that service has ended: Palo Alto's notice honored existing subscriptions only through the earlier of the subscription term's end or the EOL date. The question that remains is where that workload goes — Cortex XSIAM as Palo Alto has laid out, or another platform. On-prem QRadar SIEM keeps running as normal, since it wasn't part of the sale.
If what you need is a predictable, stable annual budget number, clear Thailand-based data residency to satisfy legal or sector-regulator requirements, a support team that speaks Thai natively, or you're preparing for ICT Spec 2026 requirements for SIEM/Log Management — zcrSIEM was built with the budget and data-residency points in mind. The certification to มศอ. 4003.1-2560, the standard the ICT Spec references, belongs to zcrLog, a separate product, and the MDES price schedule has no SIEM category, so for that part look at zcrLog.
There's no single right answer for every organization. But if what you're solving for is pricing clarity and data-residency flexibility, it's worth running the real numbers in the table above one more time.
Want to talk through the details, or ask whether zcrSIEM fits your organization's use case?
Sources
- Cisco Newsroom — Cisco completes acquisition of Splunk, accessed 2026-09-15.
- Cisco Blogs — Innovating the SOC (Splunk ES / Cisco XDR integration), accessed 2026-09-15.
- Splunk — named a Leader in the 2025 Gartner SIEM report, accessed 2026-09-15.
- Splunk — Celebrating 20 years of Splunkbase, accessed 2026-09-15.
- Splunk documentation — Agent Mode in Splunk AI Assistant, accessed 2026-09-15.
- Splunk Cloud Service Level Schedule (100% quarterly uptime SLA), accessed 2026-09-15.
- Microsoft — Microsoft Sentinel pricing, accessed 2026-09-15.
- Microsoft Learn — Microsoft Sentinel billing (commitment tiers, free ingest), accessed 2026-09-15.
- The Hacker News — Microsoft expands Sentinel into agentic security (data lake GA, Sentinel graph preview), accessed 2026-09-15.
- Microsoft Tech Community — What's new in Microsoft Sentinel, November 2025 (MCP server GA), accessed 2026-09-15.
- Microsoft Security Blog — Microsoft named a Leader in the 2025 Gartner Magic Quadrant for SIEM, accessed 2026-09-15.
- Palo Alto Networks — closes acquisition of IBM's QRadar SaaS assets, accessed 2026-09-15.
- Palo Alto Networks — End-of-life announcement, Threat Management (including QRadar) SaaS products, accessed 2026-09-25.
- Palo Alto Networks — EOS/EOL datasheet for acquired threat management SaaS products, accessed 2026-09-25.
- IBM Support — QRadar Suite SaaS/SOAR divestiture notification, accessed 2026-09-15.
- TechTarget — IBM sells QRadar SaaS assets to Palo Alto Networks, accessed 2026-09-15.
- IBM — IBM named a Leader in the Gartner Magic Quadrant for SIEM (14th consecutive time, 2024), accessed 2026-09-15.
- IBM — QRadar SIEM product page, Thailand region, accessed 2026-09-15.
Deep technical implementation
Reference architecture: endpoint, identity, firewall and cloud events enter through collectors or API connectors, are normalized into a common event model, enriched with asset and user context, then indexed for search and evaluated by correlation rules. The investigation layer links related events into a case; the response layer emits an approval-gated action and immutable evidence trail.
Example detection path: a Windows 4625 burst followed by a successful 4624 from the same source should be correlated by user, src_ip, host, and a bounded time window. A rule should preserve the raw events, suppression reason, rule version, and analyst disposition. Do not treat event count alone as proof of compromise; validate with MFA, VPN, EDR process, and geolocation context.
Open-source versus managed boundary: Wazuh/Elastic can provide collectors, parsers, rules, and storage, but the operator still owns patching, parser quality, retention sizing, alert tuning, and 24/7 response. A managed SIEM shifts those operating tasks into an agreed service boundary. Compare total operating hours and response coverage, not license price alone.
Validation metrics: ingestion completeness by source, event-to-index latency, rule precision/recall, mean time to triage, storage growth per day, query latency at retention limit, and percentage of cases with linked evidence. Test failure modes such as collector outage, clock skew, duplicate events, parser drift, and an unavailable enrichment API before production rollout.