What you runRunning CrowdStrike Falcon Next-Gen SIEM?
The first 10 GB a day is free. Every GB after it is the bill.
Falcon is the endpoint platform many SOCs trust most, and Next-Gen SIEM puts third-party data beside Falcon’s own telemetry on one console. The pressure is the meter on everything that is not Falcon: every MB of third-party data is billed as it enters.
Free. No system access. No obligation. You keep the drawing.
Step oneA pipeline in front of your SIEM, designed and built by Logmetry. Your SIEM stays. A full raw copy stays in your own account.
At least 20% less into your SIEM, every alert kept, proved on your data.
CrowdStrike Falcon Next-Gen SIEM SIEM
$179 per GB/day a month
To ingest 1 GB every day for a month, at list price.
Falcon Insight XDR customers get the first 10 GB a day free.
AWS Marketplace, CrowdStrike Falcon Next-Gen SIEM (pay-as-you-go), checked 2026-09-24
01The four problems
Which of these hits your CrowdStrike estate?
Budget, renewals, the order to bring in AI, and collection that runs on someone else’s agents. Each one is about where the data lives, and with CrowdStrike it lives in CrowdStrike’s ecosystem. Pick yours.
“Our firewall and cloud logs would push us far past the free tier.”
Stay within the free tier, or close to it. Keep every source in your own Lake.
- Why it happens
Next-Gen SIEM meters every MB of non-Falcon data on entry. Firewall, cloud and identity logs are the volume, and most of it is never read.
- What changes
Third-party data is cleaned, deduplicated and reduced before it reaches Falcon. The SIEM gets what detection needs, and the full copy lands in a Lake you own.
- How sure you can be
Nothing is lost. The full copy stays in your Lake and replays on demand, and every routing rule is readable code. The reduction is measured on your own noisiest sources, before and after, in writing.
- How soon
With the first source. We start where the most volume sits, prove it, then continue.
- What it takes from you
Your diagrams and one call to start. We build it as code in your repositories and teach your team to run it.
What shrinks
- GB indexed by your SIEMOnly what detection reads is indexed. Duplicates, debug output and unread fields stay out.
- Tokens per AI investigationEvery query to the Lake returns only the fields the agent needs.
- Hosts on per-node licensesOrdinary hosts move to monitoring you own. The APM keeps the apps that earn it.
- Vendor licenses and modulesYou keep the features that earn their price, not the whole platform.
Shapes, not figures. Yours are measured on your own sources in the review.
“Falcon keeps adding modules, and every one makes leaving harder.”
Keep Falcon for the endpoint. Keep your data portable.
- Why it happens
Sensor, SIEM, pipeline, storage and AI are all sold as Falcon modules. Each one is another reason to stay, and the price follows.
- What changes
Third-party collection, routing and history live in your account. Falcon keeps the endpoint and the detections, and any other SIEM can be fed from the same layer.
- How sure you can be
The detections, dashboards and alerts your team relies on keep firing where they do today. A move becomes a parallel run on the same routed feed, proven before anything is retired.
- How soon
Before your next renewal, if we start with the sources that drive it.
- What it takes from you
Your diagrams, your renewal date, and one call.
Your way out
- MigrationToday: Quarters of overlapping licensesWith you in control: Weeks: a parallel run, then a routing change
- Your dataToday: Their format, in their storeWith you in control: Open schemas, OCSF and OpenTelemetry, in your Lake
- HistoryToday: Stays behind when you leaveWith you in control: Replays into any tool you choose
- Collection and fleetToday: Their agents, their consoleWith you in control: A control layer and fleet plane you own
“We want AI triage, and the platform’s AI reads only what we paid to send it.”
Your agents, on your data, following your runbooks. Not one more module on their price list.
- Why it happens
The platform’s AI reads its copy of your data, on its terms, sold as one more module. It is their AI, on their rules and their runbooks, never yours.
- What changes
We trim every event in flight to only the fields an agent needs and land it in your Lake. Your agent runs in your account on models you choose, reads every source there, including what never went to the SIEM, and picks up every Falcon detection.
- How sure you can be
Agents reason well on clean, trimmed data and badly on noise. Knowing which fields matter takes understanding machine data, source by source, and that is the work we do.
- How soon
As soon as the first sources land clean in your Lake, your agent has something worth reading.
- What it takes from you
Your runbooks, or we write them with you. The agents, prompts and runbooks are code you own.
What you get running
- Agents you control, in your accountThey run where your data is, under your access rules.
- Models you choose, and swapSmall or open-weight models for routine alerts, larger ones for investigations. Changing one is a config change, not a renewal.
- Your runbooks, as codeVersioned in your repositories. The agent follows them step by step.
- Token controlFields trimmed in flight to what the agent needs, so every query reads less and costs less.
- Fixes as pull requestsThe agent writes the fix, a person approves it, and remediation moves at the speed of a review.
- A Lake anyone can queryDevelopers and stakeholders ask the clean Lake directly, at object-storage prices.
“CrowdStrike has its own pipeline now. Do we want our SIEM vendor routing our logs?”
LaterA later step, sold only after step one is proved on your data.
A pipeline that works for you, not for one destination.
- Why it happens
CrowdStrike bought Onum, a telemetry pipeline, and sells it as Falcon Onum. Its job is to feed Falcon.
- What changes
Your control layer stays vendor neutral. It routes to Falcon, to your Lake and to any other SIEM, and it lives as code in your repositories.
- How sure you can be
OpenTelemetry is the open standard the major APM vendors already accept. Nothing about your destinations has to change on day one.
- How soon
Later. We start with the logs in front of your SIEM, because that is where the money is. Open collection follows once that is proved, host group by host group.
- What it takes from you
Your diagrams and one call. We plan the order with you.
Your control plane
- OpenTelemetry collectorsOpenOne open collector on every host, built for your estate.
- A fleet plane you ownYoursConfiguration and rollout from a console in your account, under OpAMP.
- Changes as pull requestsAs codeAI native: an assistant drafts the change, your team reviews and merges it.
- No vendor agentsRemovedNothing on a host reports to someone else’s console.
- Monitoring, only what earns itYour callStep away from a vendor’s full architecture and keep only the features you value.
02Today, and after
Today, and with the Blueprint
A Falcon estate sends Falcon data on its own path and meters every MB of third-party data on entry, so sources that would push it past the free tier are often never sent.
Scroll the drawing sideways to see all of it.
What CrowdStrike Falcon does best
Falcon is a single lightweight sensor that many SOCs trust more than anything else on the endpoint, and Next-Gen SIEM brings third-party data onto the same console, so an investigation moves from a firewall log to the process that caused it without changing tools. For a team that already lives in Falcon, that is real value.
The pressure is the meter on everything that is not Falcon. CrowdStrike licenses Next-Gen SIEM by ingest volume and retention length, and on its pay-as-you-go listing every MB of non-Falcon data is billed as it enters. Falcon Insight XDR customers get the first 10 GB a day free, so every GB above it is the bill, and firewall, cloud and identity logs are where the volume sits.
How it works, and where we sit
CrowdStrike Falcon Next-Gen SIEM is the SIEM built into the Falcon platform: Falcon sensors send endpoint telemetry straight to Falcon, data connectors bring in firewalls, cloud, identity and SaaS, and detections correlate across both on one console. It is licensed by ingest volume and retention length, with non-Falcon data metered as it enters and the first 10 GB a day free for Falcon Insight XDR customers. We leave Falcon’s own path untouched, put a control layer in front of the third-party data, and keep the full-fidelity copy in a Lake you own.
03The five verbs
What we keep, and what changes
Keep it and govern what flows in, shrink its footprint, cut what it costs, extend it with an agent, and replace only where replacement is honest.
- Keep
Falcon on every endpoint, Falcon’s own data path, and the detections your SOC runs in Next-Gen SIEM. Nothing about how your team works in Falcon changes.
- Shrink
Firewall, cloud, identity and SaaS logs are cleaned, deduplicated and reduced before they reach the per-MB meter, and the full copy stays replayable in your Lake.
- Cut
The metered volume drops to what detection needs, so the estate stays within or near the free tier, measured source by source in writing on your own top talkers.
- Extend
An agent you own picks up each Falcon detection and reads the full history in your Lake, including the sources that never went to the SIEM.
- Replace
Never. Falcon is your endpoint platform and your SIEM, and we sit in front of it for third-party data, not in place of it. The same layer can feed any other SIEM, and that choice stays yours.
The letters mark where each verb acts in the drawing with the Blueprint.
In front of Next-Gen SIEM, vendor neutral
A control layer in front of Next-Gen SIEM cleans and reduces third-party data before the per-MB meter, keeps the full copy in a Lake you own, and routes to Falcon and any other destination.
We start with the third-party sources that carry the most volume, usually firewalls, cloud audit logs and identity. Each one is parsed, deduplicated and enriched once, upstream, and only the events your detections read are forwarded. The reduction is measured on your data before the rollout continues.
Because the layer is yours and neutral, it does not care which SIEM sits behind it. Falcon receives what it needs today, the Lake keeps everything, and a second destination is a routing change whenever you want one.
04The free architecture review
We draw your CrowdStrike estate, free.
Telemetry engineers look at your whole environment and show you exactly where the cost, the waste and the hurdles are, and what your architecture could look like. No strings attached.
What you get
- Your CrowdStrike architecture today, drawnEvery source, pipeline and destination, as it actually flows.
- The waste mapWhere you pay for data nobody reads, and what it costs you each year.
- Costs before and after, with estimatesWhat you spend now, and what the same coverage would cost.
- Your target architectureWhat your CrowdStrike estate could look like, drawn on your own sources.
- Options for your business problemNot one product. The choices, with what each one costs and changes.
Who does it
A lead architect with 26 years in monitoring and observability, leading a team of senior engineers in telemetry engineering and pipeline design. The team that reviews it is the team that would build it.
What it takes from you
Your diagrams and one call. No system access.
What comes next
If it pays, a two-week proof of value on your noisiest source, free unless you go ahead. At least 20% less into your SIEM, every alert kept, proved on your data.
What it costs
Nothing
No strings attached. You keep the drawing, whatever you decide.
05Questions
What CrowdStrike teams ask before they book
CrowdStrike has its own pipeline now, Onum. Why not use it?
Onum is CrowdStrike’s pipeline, and its job is to feed Falcon. We stay vendor neutral: the control layer is yours, it routes to Falcon, to your Lake and to any other SIEM, and it lives as code in your repositories. If you ever change SIEMs, the pipeline does not change with it.
Do you replace Falcon or Next-Gen SIEM?
No. Falcon stays on your endpoints and your detections stay in Next-Gen SIEM. We sit in front of it for third-party data, never in place of it, and Falcon’s own data path is not touched.
Does sending less to Next-Gen SIEM weaken our detections?
The routing split is designed against your detection set: the events your rules read keep flowing unchanged, and every change is validated with the rules firing on real data before it ships. What stops flowing is the volume nobody reads, and it stays in your Lake.
Why is the review free?
Because the drawing is how you judge us. You see your own architecture, your waste and your options before you spend anything, and you keep the drawing whatever you decide. No system access, no obligation.
Are you a reseller for a vendor?
Yes, for certain vendors’ software. We are also the delivery partner and integrator on custom projects, directly or alongside your systems integrator. The pipeline subscription is in your name, bought from the vendor, its channel or through Logmetry where we resell it, and priced on its own line. We recommend what fits your business problem, even when that means changing nothing, and no SIEM or APM vendor pays us to recommend it.
What if the savings don’t hold on our data?
You see it measured before you commit. The two-week proof of value runs on your noisiest source, with success criteria signed before it starts, measured in your SIEM’s own license usage view. At least 20% less into your SIEM, every alert kept, proved on your data.
See your CrowdStrike estate drawn, with the costs, before you spend anything
Run by a lead architect with 26 years in monitoring and observability. No system access, no charge, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing