Annex VIII · BYO-SIEM

BYO-SIEM MDR pricing.

MDR vendors that monitor the customer's existing SIEM rather than insisting on their own data lake. The price difference is the ingest line: BYO-SIEM removes it.

Direct answer

BYO-SIEM-friendly MDR vendors in 2026 include Expel, ReliaQuest GreyMatter, UnderDefense, and Red Canary. Service-only pricing typically lands at $ 5 to $ 18 per endpoint / month. The buyer keeps their SIEM licence, retains data residency control, and avoids paying twice for ingest, but takes on the operational responsibility of SIEM tuning.

BYO-SIEM-friendly vendors

ExpelEDR, SIEM, cloud, identity integrationsPer-integration; service-only[V]

ReliaQuest GreyMatterSplunk, Sentinel, Chronicle, QRadar overlayPlatform + service[V]

UnderDefense MAXISentinel, Splunk, Elastic$ 5 to $ 15 / endpoint / month (service-only)[I]

Red CanaryCrowdStrike, SentinelOne, MDE feedsPer-endpoint; service-only[V]

When BYO beats the proprietary data lake

The buyer already owns a SIEM licence and is past contract breakeven.
Data-residency or sovereignty requirements rule out vendor-hosted ingest.
Existing SOAR and ticketing integrations are tied to the in-house SIEM.
The buyer wants to avoid dual-cost on ingest (paying both the SIEM vendor and the MDR vendor per GB).

When the proprietary data lake wins

The buyer does not have a SIEM, or is replacing an out-of-contract one.
Tuning capacity is the constraint; vendor data lake comes with vendor-curated detection content.
The customer wants a single throat to choke for both data and detection.

Cross-reference /annex/log-source-vs-endpoint-pricing for the metering model that pairs with BYO-SIEM.

Annex cross-references

AnnexExpelThe BYO-SIEM-friendly per-integration vendor.AnnexReliaQuestGreyMatter overlay on Splunk / Sentinel / Chronicle.AnnexUnderDefenseService-only delivery on customer SIEM.