LOCAL BENCHMARK-ENDPOINT ACCEPTANCE
9,512 events/s
Accepted by the Data Plane
Mean achieved at a requested 10,000 events/s in the initial local matrix. This measures acceptance, not downstream delivery.
// SIEM cost reduction, measured on your traffic
Cut your SIEM ingestion bill.
Keep control of your security telemetry.
Route security events to Sentinel or Splunk according to your detection and investigation requirements. Send appropriate records to supported storage under your retention policy. Keep the pipeline in your infrastructure.
Free, guided 30-day evaluation · One agreed flow · No purchase obligation
Customer-hosted · Sentinel DCR / Splunk HEC · VM or Kubernetes
9,512 events/s measured local acceptance
Mean at 10,000 requested events/s; not downstream delivery or evidence of cost savings. Read the measurement limits →
01 / make the cost visible
What could you avoid spending on SIEM ingestion?
Model a routing scenario using the volume and marginal cost from your bill. Then test those assumptions against a representative workload.
CURRENT VARIABLE SIEM COST / YEAR
Daily volume × avoidable cost per GB × 365.POTENTIAL GROSS INGESTION SAVINGS / YEAR
Selected reduction, before license and added costs.POTENTIAL NET ANNUAL DIFFERENCE
Adjust the inputs to calculate a scenario.
Illustrative scenario. Actual reduction depends on telemetry, routing policies, SIEM configuration and retention requirements. Net difference deducts 12 months of license and added costs. Fixed commitments, taxes and costs you do not enter are excluded. Retaining fewer SIEM records is only appropriate when detection, investigation and compliance requirements allow it.
Validate this against your traffic →02 / the right workload
Logstrm may be a fit if…
- You send hundreds of GB or more of telemetry each day to Sentinel or Splunk.
- SIEM ingestion is becoming a meaningful part of your security budget.
- Some records must be retained, but do not need the same SIEM indexing path.
- You want reviewable routing and filtering before telemetry reaches the SIEM.
If your ingestion volume and avoidable cost are already small, Logstrm may not provide meaningful economic value.
For the teams who own the security pipeline.
- Security / SOC engineering
- Review which events and fields detection and investigation need in the SIEM, and keep routing decisions in explicit configuration.
- Platform engineering
- Operate the pipeline in your infrastructure and inspect throughput, delivery, retry and DLQ metrics.
- Security leadership / FinOps
- Compare avoidable ingestion cost with license, archive and operating costs using a measured baseline.
- Risk / compliance teams
- Use your retention and masking requirements to review changes before telemetry reaches the SIEM.
03 / how it works
A control point before your SIEM.
Your team decides what belongs in the SIEM and what can use another destination. Logstrm applies those decisions through configured pipelines and routes.
SOURCESSecurity telemetry
HTTP · Syslog · Cloud / Kafka inputs
LOGSTRMReceive → decide → deliver
Reviewable routing and filtering
SIEM / INVESTIGATIONSentinel / Splunk
Events your team needs indexed
OTHER DESTINATIONSS3 / GCS / JSONL
Records retained under your policies
- 01
Receive
Connect a supported listener or cloud input to receive a representative telemetry stream.
- 02
Decide
Apply routing, filtering and field transformations. Review changes against detection and retention requirements.
- 03
Deliver
Send selected events to the SIEM and route other records to configured destinations.
Keep / Reduce / Route / Replay
Make the decision per policy, rather than treating every log as disposable.
- Keep
- Send the events and fields required for agreed detection and investigation workflows to your SIEM.
- Reduce
- Remove approved fields or filter explicitly excluded events before ingestion. Validate the effect against your security requirements.
- Route
- Send appropriate retention records to S3, GCS or JSONL storage according to configured routes and retention policy.
- Replay
- After a destination recovers, replay failed records that were successfully persisted in the bounded local dead-letter queue.
These are operator-defined policies, not automatic classifications. Ingest acceptance alone is not durable. Check the recovery boundaries →
ILLUSTRATIVE PILOT / WAF LOGS
HTTP-fed WAF events → Logstrm → Sentinel and S3
Agree which events need SIEM indexing and which records can use storage under your retention policy. Configure the routes, then verify destination delivery and data availability before changing production traffic.
A supported routing pattern to evaluate, not a measured customer deployment or a savings result.
The quickstart uses a release package supplied for your organisation. Start a pilot to agree on the distribution and evaluation scope.
04 / technical evidence
Measured throughput. Explicit test boundaries.
Use the published results to evaluate the implementation. Size your deployment from measurements on your own workload.
CONTROLLED END-TO-END DELIVERY
2,455 events/s
Delivered through the tested pipeline
Mean achieved at a requested 2,500 events/s. Replay and full DLQ drain were verified in all nine runs across the initial end-to-end matrix.
Published matrices cover 15 local acceptance runs and 9 end-to-end runs, using the recorded workload, configured emitter and controlled sink. Results depend on configuration, hardware, destination and event shape. These are benchmark observations, not production capacity guarantees or customer savings.
View benchmark methodology →05 / why this exists
Your SIEM should not be your most expensive log archive.
Security analytics and investigation need the right telemetry. Retention requirements do not always mean every record needs the same real-time SIEM ingestion path.
Logstrm gives you a place to make that distinction before ingestion, with explicit rules your security team can review. Savings only make sense when the resulting data remains useful for detection, investigation and compliance.
Evaluate the operating model, delivery contract and cost on your own traffic. No comparative performance advantage over another telemetry platform is claimed.
06 / free guided 30-day evaluation
Prove it on your own telemetry.
Start with one representative source-to-destination flow in an agreed environment. Define the baseline, events to retain and success criteria before kickoff. A full SIEM migration is not required for this scoped evaluation.
Measure the opportunity
- Actual volume and routing opportunities
- Throughput, delivery and retry/replay behavior on the agreed path
- Potential cost impact using your rates and added costs
Decide from the results
Review the measurements together, assess operating fit and decide whether a production deployment offers meaningful value. The result can be a decision not to proceed.
Guided setup and review. No purchase obligation. Custom connectors or implementation work are quoted separately.
Production pricing: Team starts at $999/month, billed annually. Capacity and support are agreed from pilot results. Review pricing and scope →
07 / security and operational trust
Your telemetry. Your infrastructure. An explicit contract.
Assess the implemented controls and the deployment responsibilities before putting Logstrm in a production security pipeline.
- Customer-hosted data path
- Data Plane and optional Manager run in your environment. There is no Logstrm-operated telemetry-processing SaaS.
- Role-based configuration operations
- The optional Manager supports OIDC and Viewer, Operator and Admin roles. Configure authentication for your deployment.
- Deployment-managed credentials
- Azure Managed Identity and AKS Workload Identity are supported for Sentinel DCR. Other destinations use their configured credentials.
- Documented recovery boundaries
- Retry, bounded local DLQ and replay are implemented. Ingest acceptance is not durable acceptance; process failures can lose events before delivery or successful DLQ persistence.
NEXT STEP / test the economics
Find out what your SIEM pipeline could cost.
Run Logstrm against a representative flow. Measure whether routing before ingestion creates meaningful savings for your team.