Pricing
Mainline is never priced by the gigabyte. Your bill doesn't grow when your log volume does, which is the point of putting a pipeline in front of your SIEM.
| Editions | CoreCollect, route and deliver | EnterpriseFor larger security teams | Managed providerFor MSSPs and shared services |
|---|---|---|---|
| Pipeline | |||
| Every collector, source and destination | Included | Included | Included |
| Agents for Windows, Linux and macOS | Included | Included | Included |
| Recognition and the recognition assistant | Included | Included | Included |
| Search, alerts and the audit trail | Included | Included | Included |
| Sigma rules, threat intelligence and enrichment | Included | Included | Included |
| Scale and control | |||
| Relay groups and a standby console | Not included | Included | Included |
| Migration Center, replay and backfill | Not included | Included | Included |
| Volume reduction and savings reports | Not included | Included | Included |
| Audit trail forwarding | Not included | Included | Included |
| Customer separation and per-customer reporting | Not included | Not included | Included |
| Where it runs | |||
| Your infrastructure, containers or Kubernetes | Included | Included | Included |
| Mainline Cloud: we run all of it, or just the console | Available: ask us | ||
| Price | |||
| Based on | The size of your deployment | The size of your deployment | Your customers' deployments |
| Ask for a quote | Ask for a quote | Talk to us | |
Try every feature for 30 days
The evaluation includes everything in Managed provider, on your own servers, with no data leaving your network. Licences are offline keys, so air-gapped sites can evaluate too.
Questions
Why not charge by data volume?
Because the reason to have a pipeline is to control volume. If our price rose with yours, we'd be paid to keep your SIEM bill high. Pricing follows the size of the deployment you run instead.
Does Mainline replace our SIEM?
No. Mainline collects, shapes, stores and delivers your logs; your SIEM still does the analysis and investigation. Mainline makes it cheaper to feed, easier to change, and lets you run more than one.
Where does it run?
On your own servers or cloud account, in containers and Kubernetes, or as Mainline Cloud, where we run all of it for you, or just the console. You choose where your events live. Compare the ways to run it.
Can we keep data long enough to switch tools?
Yes. Relays keep events for as long as you configure, and can archive to your object storage, so you can replay a month or two of history into a new tool when you switch.
What does a pilot look like?
One source that matters, one destination you use, and a definition of success agreed up front. It runs on your servers with an evaluation licence, and we help you set it up.
Start with one source and one destination.
A pilot runs on your own servers: pick a source that matters, a destination you use, and what success looks like. We'll help you set it up.