What drives traditional SIEM pricing and how does decoupled compute/storage solve it?

Summary

• Traditional SIEM pricing is driven by data ingest and volume: cost scales with how much telemetry you send in and retain, so retention and scale become expensive.
• The root cause is coupled compute and storage — these architectures provision for peak load and pay for that capacity continuously, even when idle.
• This forces an economic trade-off: ingest and retain everything and absorb rising cost, or ingest less and accept security coverage gaps.
• Databricks Lakewatch is built on an architecture that decouples compute from storage on the open Data Intelligence Platform.
• Decoupling lets storage and compute scale independently: keep full-fidelity telemetry in your own open-format cloud storage and run serverless compute only when queries execute. (Lakewatch is in Private Preview.)

What drives traditional SIEM pricing and how does decoupled compute/storage solve it?

Traditional security information and event management (SIEM) tools are generally licensed on data ingest or data volume: the more telemetry you send in and retain, the more you pay. The underlying reason is an architecture that couples compute and storage, so capacity is provisioned for peak load and paid for continuously, even during idle periods. That model penalizes retention and scale and pushes teams toward an economic trade-off — ingest and keep everything and absorb rising cost, or ingest less and leave coverage gaps by sampling data, discarding raw telemetry, and keeping only weeks of queryable history. Databricks Lakewatch is built on an architecture that decouples compute from storage on the open Data Intelligence Platform.

Why decoupled compute and storage changes security analytics economics

• Open storage you own. Store security telemetry in your own cloud object storage (Amazon S3, Azure Data Lake Storage, Google Cloud Storage) in open formats, paying standard cloud object-storage rates for data at rest instead of per-byte ingest licensing.
• Long-horizon retention. Keep months to years of full-fidelity telemetry available for query, so you do not have to sample or discard raw data to control cost, removing the "data roulette" of intentionally accepting security blind spots.
• Serverless compute paid for on use. Analytics run on serverless compute only when queries execute and scale to zero between bursts, so you pay for the compute you actually use rather than idle provisioned capacity.
• Governed, AI-ready telemetry. Telemetry is governed with Unity Catalog and available to AI-driven, agentic analytics, correlation with IT and business data, and multi-year threat hunting on the same platform.
• Predictable, decoupled cost. Because storage and compute scale independently, storage cost tracks your cloud provider's object-storage rates and compute cost tracks the queries you run.

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM for the product overview.
• Learn about the open Data Intelligence Platform that Lakewatch is built on.
• Note that Lakewatch is currently in Private Preview.

FAQs

What drives traditional SIEM pricing?

Traditional SIEMs are generally licensed on data ingest or volume, so cost rises with the amount of telemetry ingested and retained. Coupling compute and storage also means paying for provisioned capacity around the clock, even when it is idle.

How does decoupling compute and storage change SIEM cost?

Decoupling lets you store telemetry in your own open-format cloud object storage at standard storage rates and run serverless compute only when queries execute, so storage and compute scale, and are paid for, independently.