Managed SIEM for HIPAA and cyber-insurance evidence

For a small healthcare or professional practice, the useful SIEM comparison starts with which records you can retrieve and who investigates them. Retention, incident support and a fully operated SOC are separate buying questions.

Obsidian Ridge's Ridge Log managed SIEM add-on costs $8 per data source per month, with no minimum. The add-on contract term is not published; confirm it, source coverage and retention in the quote. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States. Obsidian Ridge publishes this comparison and includes our own service. It is not an independent ranking. Vendor pages were fetched October 2, 2026; a quote is still needed wherever a term or limit is not published.

How do the five options compare?

Rapid7's current Incident Command package table separates log retention from alert/audit retention. Its older InsightIDR storage FAQ describes 13 months of searchable logs; do not transfer that period to a new Incident Command quote. Confirm the exact product and purchased retention. Current packages; InsightIDR storage FAQ.

These are different purchasing models. Blumira counts employees; Huntress and Ridge Log use data sources. Do not multiply all rows by the same headcount. Blumira's employee definition covers knowledge workers with corporate email and a workstation. Its pricing page also lists onboarding fees: $500 for Detect, $250 for Respond and included for Automate. Blumira pricing.

What evidence should a practice request before buying?

Ask for a redacted sample export and a demonstration of how to find a specific event. The report should identify the source and time period. Confirm whether the service provides raw records, a summary, an incident report or a framework mapping; those are different artifacts.

For an insurance application, compare the evidence with the carrier's exact question. A screenshot of a dashboard does not establish that every required device was monitored for the whole period. Use free application help and the questionnaire worksheet to identify the records you need.

How should HIPAA affect retention decisions?

HHS distinguishes documentation requirements from technical safeguards such as audit controls and activity review. Its six-year documentation rule is not a universal six-year requirement for every raw log. Set the retention policy using the type of record, risk analysis and other applicable requirements. HHS Security Rule summary.

Ask separately about searchable storage, archives, restore charges, export formats and access after cancellation. A vendor advertising a maximum period does not establish that the maximum is included in your base fee. Record the purchased period in the proposal.

Who acts after the SIEM finds something?

Write a handoff that identifies alert review, containment authority, escalation and recovery. A support phone number alone does not prove that someone continuously reviews your events. Conversely, a managed service may act within its platform but still need the practice or IT provider to repair an application or restore files.

Our managed SIEM scope explains the log add-on. The dental programme and law-firm programme connect it to broader responsibilities. Obsidian Ridge's Ridge Core includes endpoint MDR and Microsoft 365 or Google Workspace ITDR at $25 per person per month, month-to-month with no minimum and business onboarding separate. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States. The base tier and the log add-on are separate charges.

What should the final quote say?

Require named sources, billed units, retention, who operates the service, after-hours actions, onboarding and cancellation/export terms. Put unsupported sources and out-of-scope response work on the same page. Compare the total cost of that scope instead of ranking a per-user price against a per-source price.

The Readiness Sprint costs $1,500 to $3,500 once for a 7-business-day engagement. The deliverable is the same at each scope: a signed evidence pack and a record of controls and gaps. The Sprint is evidence work, not a bundled SIEM subscription. Pricing separates the offers; talk with us when your source inventory is ready.

Sources

• Huntress SIEM and pricing.
• Blumira pricing and SIEM.
• Rapid7 packages and data storage FAQ.
• Arctic Wolf compliance and MDR supplemental terms.
• HHS Security Rule summary.
• Obsidian Ridge pricing and managed SIEM.