CrowdStrike Next-Gen SIEM (LogScale): Pricing and the Splunk Comparison

CrowdStrike's SIEM is Falcon Next-Gen SIEM, the search and detection engine it bought with Humio in 2021 and sells today as a module on the Falcon platform, with the first 10 GB a day of third-party logs included for Insight XDR customers. This guide covers what the module is and how it relates to LogScale, what the free allowance does and does not include, what ingest costs above it, how the pricing model compares with Splunk and Microsoft Sentinel, and the 250-endpoint ingest maths for an MSP or IT team deciding whether it needs a SIEM at all. Every figure is dated November 2026 and comes from CrowdStrike's published pages, the AWS Marketplace listing, the UK G-Cloud price list, or a named community thread.

TL;DR

• What it is. CrowdStrike's log search, correlation and SOAR module, built on the LogScale engine from the Humio deal.
• Free tier. Insight XDR customers get 10 GB a day of third-party ingest at 7-day retention; more needs the paid module.
• Price. No rate card. AWS pay-as-you-go is $0.00595 per MB with 13-month retention; UK G-Cloud lists £1,900 per GB/day a year.
• Fit. Falcon shops under 10 GB a day start free; Splunk and Sentinel shops compare on model.

What Falcon Next-Gen SIEM Is, and Where LogScale Fits

Falcon Next-Gen SIEM is the module that lets a CrowdStrike customer ingest logs from tools other than the Falcon sensor, search across them, write correlation rules and trigger automated responses from one console. CrowdStrike's own data sheet, read in November 2026, describes it as "the AI-native engine of the modern SOC" and lists no ingest fees for Falcon data as the first benefit, which is the detail that shapes everything else in the pricing: the endpoint telemetry you already pay for in Falcon Insight XDR is in the SIEM at no extra charge, and only third-party data is metered. Our SIEM guide covers what a SIEM does in general; this post is about CrowdStrike's version.

The history explains the two names. CrowdStrike completed its acquisition of Humio, a Danish log management company, in March 2021, renamed the product Falcon LogScale in 2022, and then built Falcon Next-Gen SIEM on top of the same index-free search engine, launching the 10 GB free tier for Insight XDR customers at Fal.Con in September 2024. LogScale still exists as a product for high-volume log management and long-term retention, and CrowdStrike's own FAQ says the CrowdStrike Query Language, CQL, is based on the LogScale query language. In practice a Falcon admin sees one console where the Next-Gen SIEM menu, the data connectors and the Fusion SOAR workflows live, and the LogScale name mostly survives in the collector binary and in community threads.

The product has moved quickly through 2026. In March, CrowdStrike announced that Next-Gen SIEM could ingest Microsoft Defender for Endpoint telemetry without a Falcon sensor on the host, added federated search into LogScale and S3, and shipped a Query Translation Agent that converts Splunk searches into CQL. At Fal.Con on 2 September 2026 it added certified data pipelines built on Falcon Onum, which filter noise at ingestion and, in CrowdStrike's wording, reduce data storage costs by up to 50 percent. On 4 November 2026 at Fal.Con Europe it made coordinated multi-agent investigations generally available and announced federated search connectors for Splunk, Elastic and Cribl Lake for the fourth quarter, with no re-ingestion. The direction is the same in each release: pull more third-party data into Falcon, or search it where it sits.

Is CrowdStrike a SIEM?

Yes, since 2024. Before Next-Gen SIEM, the question had a more complicated answer: Falcon Insight XDR correlated endpoint, identity and cloud telemetry from CrowdStrike's own modules, and Falcon Data Replicator pushed raw sensor events to your own S3 bucket for whatever SIEM you ran. Both still exist. Data Replicator is the export path for teams that keep Splunk, Sentinel or Elastic as the system of record and want Falcon events in it. Next-Gen SIEM is the opposite flow: other tools' logs come into Falcon. Our EDR vs XDR guide covers the boundary between detection on the endpoint and correlation across sources, which is where the SIEM label starts to apply.

What Insight XDR Customers Get for Free

The free tier is the reason this product reaches MSPs and IT teams that never budgeted for a SIEM. Every Falcon Insight XDR customer with a dedicated customer ID can ingest up to 10 GB of third-party data per day at no additional cost, according to CrowdStrike's free ingest page, read in November 2026, which also lists more than 100 integrations for the data that counts against it. Falcon telemetry does not count. Data over the daily limit is not ingested unless you hold an extended subscription, so the ceiling is a hard stop rather than an overage bill.

The limits are specific and CrowdStrike states them itself. Its Next-Gen SIEM FAQ, published in October 2024 and still the reference it links from the free-tier page, names three: retention is 7 days by default, correlation rule templates are a premium feature, and Falcon Fusion SOAR actions against third-party tools need the paid module, while first-party automation on Falcon data is included for every platform customer. Retention can be extended to 36 months with the appropriate licence. The table below is the entitlement split as CrowdStrike describes it, with the same source.

Read the rows together and the free tier describes a specific job: a seven-day search window across your firewall, identity provider and server logs, correlated with Falcon detections, with automation limited to Falcon itself. That is enough for incident investigation and for the "where did this user log in from" questions that take hours when the logs live in five consoles. It is not a compliance archive, and it is not a SOAR platform for your ticketing tool, which is the gap the paid module fills. The screenshot of the console that CrowdStrike publishes shows the same data onboarding page where ingest against the 10 GB cap is tracked.

Licensing Above 10 GB a Day

CrowdStrike does not publish a rate card for Next-Gen SIEM. Its FAQ says licensing is based on data ingestion volume and the length of retention, and that you can purchase additional capacity as needed. Two public documents put numbers on that model. The first is the AWS Marketplace listing for CrowdStrike Falcon Next-Gen SIEM for AWS, which as of November 2026 charges a flat $0.00595 per MB of non-Falcon data ingested, with 13-month retention included, billed monthly through the AWS invoice with no end date and cancellation at any time, plus a 30-day trial with up to $500 in usage credits. CrowdStrike's own pay-as-you-go FAQ works the same figure as $5.95 per GB and gives an example of 100 GB in a month costing $595.

The second is the UK government's G-Cloud 15 price list filed by CrowdStrike in January 2026, which lists "NG-SIEM GB/Day for 3rd Party Data" at £1,900 per unit per year, alongside Falcon Complete Next-Gen MDR at £240 per endpoint per year. The notes matter as much as the figure: the pricing is based on a 7-day retention period, represents the lowest commit and highest retention combination, and is list price subject to further discounts through resellers. So a committed 20 GB a day at seven days of retention lists at £38,000 a year in the UK, before the discount every reseller is expected to apply, and before any retention extension.

The two models are not the same product shape. The AWS plan is pay-as-you-go with 13 months of retention bundled, aimed at AWS-centric teams and at anyone who wants to start without a quote. The G-Cloud figure is the committed-capacity model that the enterprise sales team sells, where the daily commit and the retention tier are the two levers. For a buyer the useful move is to ask for both: the per-GB-per-day commit price at your retention tier, and what the overage policy is once you cross it, because the free tier's hard stop does not apply to a paid commit in the same way and the quote should say what does.

Connectors, the Falcon Log Collector and SOAR Actions

Getting data in is the operational half of the SIEM decision. CrowdStrike offers three routes: data connectors for cloud services and SaaS tools (AWS CloudTrail, Google Workspace, Microsoft 365, Okta, Palo Alto Networks and the rest of the Marketplace list), the Falcon Log Collector for syslog, Windows event logs and files on Windows, Mac and Linux, and the Falcon Onum pipelines added in 2026 for filtering and routing at scale. The Log Collector is the LogScale Collector under a new name, and it is the part MSPs and IT teams spend time on, because it runs on your servers and listens on your ports. Our log management guide covers the general collection problem; the thread below is what it looks like inside Falcon.

In January 2026 an r/crowdstrike user asked how to install the LogScale Collector on Windows servers through Real Time Response, because the script ran but returned nothing. A CrowdStrike employee replied that the company had just announced a LogScale Collector policy that deploys the collector automatically through the Falcon sensor, referenced in the 7.33 sensor release notes, so the manual install was on its way out; another user listed what did and did not work for them, with the sensor-side deployment, SCCM and local installs succeeding and RTR described as hopeless. That is the practical state of collector deployment in 2026: the sensor-driven policy is the supported path and the older methods are inconsistent.

The SOAR half connects to the Marketplace. Falcon Fusion SOAR is the workflow engine, and its content library holds integrations and playbooks: the data sheet counts more than 10,000 workflow actions and 275 out-of-the-box playbooks as of 2026. CrowdStrike-built actions for ServiceNow ticketing and Zscaler user isolation, and the Zendesk and similar listings, carry a Requirements field that names Falcon Next-Gen SIEM or Insight XDR, which is how the paid module turns up in a purchase that started as a ticketing integration. If you are mapping the CrowdStrike Marketplace for a client, the requirement column decides the licence before the integration does.

CrowdStrike's six-minute walkthrough of the console, published in December 2024, shows the sequence an analyst runs: a third-party detection lands, the incident graph correlates it with endpoint and identity events, CQL search widens the scope, and a Fusion workflow carries the response. It is the clearest short view of how the pieces fit before you read a quote.

The Splunk Comparison

CrowdStrike runs a dedicated comparison page against Splunk, and the claims on it are the ones a buyer will hear in a sales call. The CrowdStrike vs Splunk page, read in November 2026, cites search up to 60 times faster, 80 percent savings over three years versus a legacy SIEM, and 10 or more tools consolidated, each footnoted to a single customer assessment. The 2026 Splunk migration data sheet adds three anonymised case studies: a packaged-foods manufacturer reporting 50 percent lower logging costs, an energy spin-off with a projected $6 million in benefits over the contract term, and a pharmaceutical company that cut logging costs 20 percent while modernising 60 percent of its correlation rules. Every one of those numbers carries a footnote saying results are customer-reported or projected and will vary, which is the right way to read them: directional evidence that migrations happen and save money for some customers, not a price list.

Splunk's side is a different pricing philosophy rather than a competing number. Splunk Enterprise Security, owned by Cisco since the acquisition closed in March 2024, comes in Essentials and Premier editions, and its pricing page as of November 2026 offers activity-based, workload, ingest and entity pricing models, all quote-only, with a 0.5x weighted ingest rate for eligible Cisco telemetry and a Cloud Flex programme for moving spend between Splunk products. There is no public per-GB figure to set against CrowdStrike's AWS rate, and the workload model deliberately decouples price from ingest volume, so a like-for-like per-GB comparison is not something either vendor's public pages support.

What the table hides is the data gravity question. CrowdStrike's advantage is that the endpoint, identity and cloud telemetry a SIEM would otherwise meter is already in Falcon for free, so a Falcon shop's incremental SIEM cost is only its firewalls, SaaS logs and servers. Splunk's advantage is breadth of sources and a decade of content, dashboards and staff who write SPL. CrowdStrike's query translation agent and the federated search into Splunk announced for late 2026 are both aimed at that second point: letting a team keep Splunk as an archive while detection moves to Falcon. If your organisation is a Splunk shop, that hybrid is the realistic first step, and the migration data sheet's own best-practice list starts with inventorying which detections, dashboards and playbooks are in use before anything moves.

The Microsoft Sentinel Comparison

Microsoft Sentinel is the other comparison that comes up, because any team on Microsoft 365 already has part of a Sentinel bill in its licence. Microsoft's Sentinel pricing page, read in November 2026, describes two data tiers: an analytics tier priced either pay-as-you-go or through commitment tiers from 100 GB to 50,000 GB a day with savings of up to 52 percent, and a lower-cost data lake tier for long-term storage. A 50 GB commitment tier has been in public preview with promotional pricing from 1 October 2025 to 31 December 2026, locked until 31 March 2027 for those who sign up. Microsoft 365 E5 customers get up to 5 MB per user per day of free ingestion for specified security logs. Pay-as-you-go per-GB rates vary by Azure region and are shown in the page's regional table rather than as one list price.

The structural difference from CrowdStrike mirrors the one with Splunk. Sentinel's free ingest is tied to Microsoft's own first-party logs and to the E5 licence; CrowdStrike's is tied to the Falcon sensor and to Insight XDR. Each vendor makes its own telemetry cheap and meters the other's. CrowdStrike's March 2026 move to ingest Defender for Endpoint telemetry without a Falcon sensor is a direct play for Sentinel's installed base, and Microsoft's data lake tier is its answer to the retention cost that pushes teams toward 7-day windows. Our Microsoft Defender XDR review covers the endpoint side of that stack.

The 250-Endpoint Ingest Maths

Here is the calculation for a 250-endpoint organisation, 230 workstations and 20 servers, already running Falcon Insight XDR, with the assumptions stated so you can swap in your own. The Falcon telemetry is free, so the question is the daily volume of everything else. A perimeter firewall and VPN at that size typically produce 2 to 4 GB of syslog a day; call it 3 GB. Twenty Windows servers forwarding Security and System logs through the Falcon Log Collector at roughly 60 MB each add 1.2 GB. Microsoft 365 audit and Entra sign-in logs through the connector add about 0.5 GB, and DNS and DHCP another 0.3 GB. That is about 5 GB a day, half the free allowance, and this scenario costs nothing in ingest as long as a seven-day window and first-party automation are enough.

The second scenario adds workstation event logs and a web proxy, which is what a compliance framework or a cyber insurer's questionnaire tends to ask for. Collecting Windows Security logs from 230 workstations at about 25 MB each adds 5.75 GB, and a proxy or secure web gateway adds about 2 GB, for a total near 13 GB a day. That crosses the free tier, and because the cap is a hard stop the overflow simply does not arrive, so the paid module becomes the decision. At the AWS pay-as-you-go rate of $0.00595 per MB, 13 GB a day is roughly 390 GB a month and about $2,320 a month, or about $27,800 a year, with 13 months of retention included.

The committed model prices the same volume differently. At the G-Cloud list rate of £1,900 per GB/day per year, a 13 GB commit is £24,700 a year, about £2,060 a month, but at 7-day retention and before reseller discounts, so it is not a cheaper version of the AWS plan; it is a shorter one. Extending retention to a year on the committed model is a separate line that CrowdStrike asks you to request, and that line is where the two models converge or diverge for your organisation. Ask for the retention tier you need in the quote rather than the default.

For the Sentinel column, Microsoft's rates vary by region, so treat the figure as an assumption: at $4 to $6 per GB pay-as-you-go, which brackets the US regional rates shown on Microsoft's pricing page in November 2026, the same 390 GB a month costs $1,560 to $2,340 before any E5 allowance, which at 5 MB per user per day across 250 users would remove about 1.25 GB a day of eligible Microsoft logs. Splunk has no public rate to plug in. The conclusion the figures support is narrower than any vendor page: for a Falcon shop at this size, the free tier covers the first scenario entirely and the paid module costs in the low tens of thousands a year for the second, which is the range a 250-seat Sentinel or Splunk deployment also lands in once retention is included.

SIEM, Log Management or RMM: Which Tool You Need

The question underneath the pricing is whether an MSP or an IT team of this size needs a SIEM at all, or a log management tool, or just the alerting it already has in its RMM. The three do different jobs. A SIEM correlates security events across sources and drives response; Next-Gen SIEM's free tier is a cheap way to get that if you already run Falcon. A log management tool stores everything for operations and compliance, where retention and volume are the point and per-GB SIEM pricing is the wrong shape; this is the job LogScale was built for and the one Microsoft's data lake tier targets. An RMM monitors device health and runs automation on endpoints, and its alerting is not security correlation, however many alerts it produces; our guide to alert fatigue covers why routing RMM noise into a SIEM makes both worse.

For an MSP the practical split is to keep the RMM, the patching and the client reporting on infrastructure you own, and to treat the SIEM as a per-client security decision that the free tier makes easy to start. An open, AI-native platform such as OpenFrame, at $1 per device a month including 10 million AI tokens, covers the device management and automation layer with its own RMM, and Falcon detections and Next-Gen SIEM incidents arrive as tickets through the API rather than as a second console for technicians to watch. Flamingo builds OpenFrame, which competes with some of the tools covered here.

What goes wrong in practice is usually collection, not licensing. An August 2026 r/crowdstrike thread from an admin whose ESXi syslog never appeared in Next-Gen SIEM, while Cisco syslog to the same collector worked, drew the field notes that save a day: the collector accepts only the first source that hits UDP 514 if more than one is pointed at the default port, the collector's monitor command shows what is arriving, and timestamps far from the present are dropped or flagged because retention is calculated from the event's own timestamp. None of that is in the data sheet, and all of it is the difference between the free tier working on day one and a ticket to support.

Who It Fits, and Who Should Look Elsewhere

For an in-house IT team on Falcon. Turn the free tier on. Ten gigabytes a day covers the firewall, the identity provider and the servers for an organisation of a few hundred people, and a seven-day correlated search window is a large step up from no SIEM. Buy the paid module when an auditor or insurer asks for retention measured in months, or when you want Fusion workflows to open ServiceNow tickets and isolate users in Zscaler. If you are a Sentinel shop with E5, run the maths above with your region's rate before switching; the answer depends on which vendor's telemetry dominates your volume. G2 lists Falcon Next-Gen SIEM at 4.5 out of 5 across 45 reviews as of November 2026, with reviewers pointing to search speed and the Falcon integration as the reasons.

For an MSP. The free tier is a per-client security upgrade with no line on the invoice, provided the client holds Insight XDR with its own customer ID, which is the multi-tenant detail to confirm with your account team. Managed coverage of third-party logs exists through Falcon Complete as an add-on, and MSPs reselling Complete can price that in; our MDR guide covers where the managed layer begins. A client on Splunk or Sentinel with a working archive is a hybrid conversation, not a rip-and-replace, and CrowdStrike's own federated search roadmap now assumes the same.

For anyone with a lot of logs. If your volume is in the hundreds of gigabytes a day and most of it is operational rather than security data, price LogScale or a log management platform for the bulk and route only the security-relevant subset into Next-Gen SIEM through Onum or an equivalent pipeline. The per-GB SIEM model is built for the data a detection needs, not for everything a server emits, and CrowdStrike's September 2026 pipeline announcement is a tacit acknowledgement of the same.

The Free Tier Decides Who Starts; Retention Decides Who Pays

The short answer: Falcon Next-Gen SIEM is a SIEM that is free for the first 10 GB a day of third-party logs if you already pay for Insight XDR, priced per committed gigabyte-day plus a retention tier above that, and sold on AWS at $0.00595 per MB with 13-month retention for teams who want a number without a quote. Against Splunk and Sentinel the comparison is one of models rather than list prices, and the deciding variable is whose telemetry you already pay for. Start with the free tier, measure what you ingest, and let the retention requirement, not the vendor's comparison page, tell you when the paid module is worth it.