- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Gurucul Next-Gen SIEM
A 2025 Gartner Magic Quadrant Leader you can run on your own hardware — Gurucul Next-Gen SIEM is available as SaaS, cloud or self-hosted, per Gartner's own report text. Of the six 2025 Leaders, it is the only one an Indian buyer under an on-premises mandate can actually deploy.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Where data lives
Yours, if you self-host
Gartner’s own 2025 MQ text confirms the platform runs SaaS, cloud OR self-hosted. Self-hosted puts collection scope and physical storage under your control — on-premises or your own cloud account, in India if you choose — which is how you hold 180 days of logs in Indian jurisdiction and evidence it.
Two things we could NOT verify
Air-gap, and any India region
A genuine air gap is marketed but we could not confirm it independently, and self-hosted is not the same thing — air-gap affects licence activation, threat-intel updates and support access. We also found no evidence of a vendor-run India data region. Get both in writing before you commit.
Pin down exactly which rule applies to you: the strict version gets oversold all the time — vendors of on-premises platforms among them, so factor in our own incentive as well. The April 2022 CERT-In Directions call for ICT logs to be kept on a rolling 180-day basis “within the Indian jurisdiction”; yet CERT-In’s May 2022 FAQ (Q35) allows them to be held abroad so long as CERT-In can still obtain them in reasonable time — the firm in-India requirement falls on financial-transaction records. The sectoral case is where ambiguity ends: in IRDAI’s 2023 audit annexure an insurer must tick yes to the question of whether its ICT infrastructure logs are kept in India. If that is you, self-hosting stops being a preference. And keep staff in India separate from data in India — Gurucul’s Pune engineering centre exists, but that does not make it a data region.
Quick answer
The Gurucul platform family
This page covers Gurucul Next-Gen SIEM — the SIEM. The other pillars:
Quick facts
30-second orientation- Product
- Gurucul Next-Gen SIEM (on the REVEAL platform)
- Vendor
- Gurucul — founder-CEO Saryu Nayyar, still in post
- Gartner MQ 2025
- LEADER — first year, after three as a Visionary
- Deployment
- SaaS, cloud OR SELF-HOSTED — confirmed in Gartner's text
- Why that matters
- The only MQ Leader we sell that runs on your own infrastructure
- Converged
- SIEM + UEBA + identity analytics + NTA + SOAR, one data model
- Behavioural analytics
- The founding capability since 2010, not an acquisition
- Priced on
- Per asset, per user, per module, by data volume or by EPS
- Negotiate this
- Which axis your order form actually specifies
- Published price
- None — quote-only
- Data residency
- YOURS if self-hosted; no vendor India region found
- Data processing
- Self-hosted: on your infrastructure. SaaS: Gurucul's cloud
- Air-gap
- Marketed but UNVERIFIED — get it in writing before you commit
- Peer Insights
- 4.9 / 5 across 109 reviews
- Buy in India via
- TechBag — INR, GST, self-host scoping, axis negotiated
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
A next-generation SIEM on the REVEAL platform, converging log management with behavioural analytics, identity analytics, network traffic analysis and SOAR on one data model.
A rules-only, cloud-only SIEM vs Gurucul Next-Gen SIEM — the honest table
What a converged, self-hostable platform changes, dimension by dimension.
| Dimension | Typical ingest-priced cloud SIEM | Gurucul |
|---|---|---|
| Detection basis | Correlation rules written in advance | Rules plus behavioural baselines, one data model |
| Stolen credentials | Valid login, nothing to match | Deviation from that user’s baseline scores it |
| Pricing axis | Per GB ingested — grows on its own | Per asset or per user available — negotiate it |
| Deployment | Vendor cloud only | SaaS, cloud or self-hosted (Gartner 2025) |
| UEBA & identity | Separate licence, separate console | Same platform, same data |
| Response | SOAR bought as another product | Native SOAR on the same data model |
| Honest caveat | — | Air-gap unverified; boutique vendor scale |
| Best fit | — | On-prem mandates wanting a 2025 MQ Leader |
Self-hosting is the edge here — for the deepest out-of-the-box content library, Splunk still leads (TechBag sells both).
The six pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
REVEAL platform
SIEM, UEBA, identity analytics, network traffic analysis and SOAR run against the same data rather than as separately licensed products stitched together. Most of this market was assembled by acquisition, which is why the seams show as duplicated storage and separate consoles. Gurucul built the analytics first in 2010 and grew the SIEM around it, so the behavioural layer is not an add-on you reconcile later.
Deployment model
Gartner's own Magic Quadrant text confirms all three. Self-hosted is the one that matters for a regulated Indian buyer, because it puts both the collection scope and the physical storage location under your control — which is how you answer CERT-In's requirement to hold 180 days of logs within Indian jurisdiction and evidence it to an auditor.
Behavioural analytics
Baselines each user and entity, correlates identity, access and activity, and scores deviation. This catches the attacker who signs in correctly with stolen credentials and does permitted things — every step allowed, so no rule fires. It is the gap rule-based detection structurally cannot close, and closing it is what the company was founded to do.
Identity analytics
Entitlements and access patterns scored for risk rather than catalogued: excess privilege, dormant high-risk access, and the permissions that accumulate around people over a decade of role changes. Because it shares the platform's identity model, access risk and detection reason over the same picture of who your users are.
Network traffic analysis
Traffic analysis on the same platform, so network evidence lands in the same timeline as endpoint and identity events. Useful precisely when an endpoint is compromised and its own telemetry can no longer be trusted.
SOAR
Playbooks and automated response run natively on the same platform and data as detection, so a response step can use the same risk context the analyst sees. Confirm at quote time whether SOAR is in your entitlement or a module line, and stage it before it acts on production.
One data model under SIEM, UEBA, identity analytics, NTA and SOAR — run as SaaS, in your cloud, or on your own hardware.
Ten capabilities. Collect, detect, respond.
Gurucul Next-Gen SIEM collects telemetry, scores it against behavioural and identity context, and responds from the same platform. Here is what sits in each layer — and whether you run it or Gurucul does is your choice.
Broad source collection
Collects logs and telemetry from endpoint, network, identity, cloud and SaaS sources into one platform.
Self-hosted, cloud or SaaS
Runs on infrastructure you control if a mandate requires it — confirmed by Gartner rather than only by the vendor.
Identity and access context
Correlates entitlements and access data with activity, so detections carry who-can-do-what context rather than just what happened.
Network traffic analysis
Adds wire-level evidence to the same timeline, which matters when a compromised endpoint's own telemetry cannot be trusted.
Behavioural baselines
Models normal behaviour per user and entity and scores deviation, catching credential abuse and insider misuse that break no rule.
Risk scoring across signals
Accumulates risk across identity, endpoint and network signals rather than treating each alert as an isolated event.
Maintained detection content
Ships and updates detection logic so the platform produces useful alerts without a dedicated detection-engineering function.
Investigation and search
Analysts move from a risk score to the underlying raw events on the same platform, without exporting to a second tool.
Playbooks and automation
Automated response workflows native to the platform, running on the same data and risk scores as detection.
Compliance evidence
Reporting for the frameworks Indian regulated buyers report against, including material mapped to SEBI's CSCRF.
Watch Gurucul Next-Gen SIEM in action
The SIEM Gartner evaluated in 2025, and the REVEAL platform beneath it.
Next-Gen SIEM Overview
The SIEM the 2025 MQ evaluated.
Gurucul REVEAL — Platform Overview
The converged platform underneath.
Want a live, India-context walkthrough for your environment?
Book a guided demo →The Leader you can run on your own hardware.
Here’s what genuinely sets Gurucul Next-Gen SIEM apart (and where Sentinel or Securonix may fit better).
It is the only MQ Leader you can run on your own infrastructure
This is the entire reason the page exists, so we will be direct. There are six Leaders in the 2025 Gartner Magic Quadrant for SIEM and TechBag sells all six. Microsoft Sentinel is cloud-only on Azure. Google Security Operations is cloud-only. Securonix is cloud-native — our own Securonix pages state plainly that no configuration of it answers an air-gap mandate. Exabeam is cloud-led, with LogRhythm providing its self-hosted path. Splunk does self-host, and prices accordingly. Gartner's report text says Gurucul Next-Gen SIEM is available as SaaS, cloud or self-hosted. So for the buyer whose mandate requires the platform on infrastructure they control, this is the one Leader that qualifies. Until now our honest answer to that buyer was Elastic Security or Wazuh — both genuinely capable, both requiring you to operate the platform yourself, one a Visionary and the other carrying no analyst standing at all. That is a fine answer for a team with platform engineers and a poor one for a bank that wants a commercial product with a vendor behind it.
Behavioural detection is the foundation, not a module
A rule only catches what somebody thought to write down in advance. A stolen credential signs in correctly, from a plausible location, and accesses exactly what that account is entitled to access — every individual step permitted, so nothing fires. The only way to catch it is to know what normal looks like for that specific user and score the deviation. Gurucul was founded in 2010 to do precisely that and grew a SIEM around the analytics, which is the reverse of how most of this market was assembled. The practical consequence is that UEBA is not a separately licensed layer you reconcile with your SIEM later — the risk score and the raw events live on the same platform, so an analyst moves between them without switching tools or waiting on an export.
Per-asset pricing can break the logging-costs-more trap
Most SIEM platforms meter on data ingested, which creates a genuinely damaging dynamic: every improvement in logging coverage raises the invoice, so teams quietly stop collecting the sources that would have caught the intrusion. Gartner records that Gurucul offers all-inclusive per-asset and per-user pricing among its options, and that axis removes the pressure entirely — asset and user counts change slowly and forecast cleanly, which is a far easier conversation with a finance function than a variable data bill. Now the precision, because this is where enthusiasm outruns the evidence: Gurucul offers per-asset pricing as an ALTERNATIVE to per-GB, not instead of it. Data-volume and EPS-based options sit on the same list, and at least one public reviewer references a 10 GB/day tier. Which axis you land on is negotiated, so settle it in the order form.
A founder still running the company, and a real Pune presence
Saryu Nayyar founded Gurucul in 2010 and is still its CEO — confirmed as recently as its Black Hat USA 2026 materials. For a platform you are betting detection on, a founder-led company with no investor pressure toward a licence change or a forced exit is worth something concrete, and buyers who lived through other vendors being acquired and repriced will recognise why. The India dimension is real rather than decorative: Gurucul Solutions Private Limited has been incorporated in Pune since June 2013, Pune is the principal engineering base, and the company publishes India-specific material mapped to SEBI's CSCRF — which is unusual for a vendor this size and suggests the India go-to-market is deliberate.
The honest caveat: this is a boutique competing with hyperscalers
Gurucul is privately held and bootstrapped, having taken no institutional funding in fifteen years. That is genuinely unusual and Gurucul markets it as stability. The other half of the same fact is that it has no war chest, and it is competing directly against Microsoft, Google and Cisco, all of whom can bundle a SIEM into estates you already own. Its analyst standing is also Gartner-specific rather than universal: it is absent from the June 2025 Forrester Wave for Security Analytics Platforms, where the other five Leaders all appear, and its KuppingerCole Overall Leader award is from the 2024 report. None of this makes it a poor product — the Gartner placement is real and hard-won. It means vendor scale is a question your risk function should answer deliberately rather than discover at renewal.
The honest positioning
Buy Gurucul Next-Gen SIEM when the deployment constraint is doing the deciding: a regulator, a contract or your own posture requires the platform on infrastructure you control, and you want an analyst-recognised commercial product rather than an open-source stack you operate alone. In that specific situation it is close to unique on our shelf. Buy something else in three cases. If your estate is standardised on Microsoft 365 with E5 licences, Sentinel's bundled economics are very hard to beat and we will tell you so. If cloud is acceptable and you want the largest possible vendor behind you, Securonix or Sentinel are the safer institutional choices. And if you need a genuine air gap with no internet path at all, get that confirmed in writing first — self-hosted is verified, air-gapped is not, and we would rather you establish it now than at your audit.
The numbers behind the platform
What your Gurucul Next-Gen SIEM rollout looks like
Establish the deployment mandate in writing
Does a regulator, a contract or your own posture require the platform on infrastructure you control? That single answer eliminates most of the Leaders quadrant before any feature comparison, and it is the reason Gurucul is on your list at all. If SaaS is acceptable to you, price Sentinel and Securonix too — they are larger companies and the case for a boutique weakens considerably.
Get air-gap and India-region answers on paper
Self-hosted is confirmed by Gartner. A genuine air-gapped deployment is marketed but we could not independently verify it, and we found no evidence of a vendor-run India data region. If either matters to you, make them written pre-conditions rather than assumptions. TechBag obtains both as part of the quote.
Settle the pricing axis before anything else
Gurucul can meter per asset, per user, per module, by data volume or by EPS. The per-asset and per-user axes are the ones that break the logging-costs-more dynamic, but they are a negotiation outcome rather than a default. Confirm which axis your order form specifies — this is the single highest-value clause in the contract.
Prepare the identity data before the analytics land
Behavioural analytics is bounded by directory quality. Peer groups built on a stale directory produce confident nonsense, and unowned service accounts generate alerts nobody can adjudicate. Do this work first — it improves your posture regardless of which vendor ultimately wins.
Baseline, then judge
Behavioural models need time observing normal before their output should be acted on. Teams that evaluate alert quality in week two are deciding on bad evidence. Agree the baselining period up front so nobody mistakes an immature model for a poor product.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Self-hosting was not a preference for us, it was the mandate. This was the only Gartner Leader that could meet it.”
“The behavioural side caught an account takeover our previous SIEM had logged and ignored. Same data, better question.”
“Get the pricing axis written into the order form. We assumed per-asset and had to negotiate our way back to it.”
“Smaller vendor, and you feel it in the ecosystem. You also feel it in how quickly someone senior picks up the phone.”
“Budget the identity data work before deployment. Peer groups built on our old directory were not worth acting on.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the SIEM and security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid — Standing × Deployment Freedom
Analyst standing against where the platform is allowed to run — the pair that decides a regulated Indian shortlist.
2025 MQ Leader — and the only Leader we sell that self-hosts.
The Convergence × Effort Map
How much of SIEM, UEBA and response share one data model, against how much of the platform you must run yourself.
One data model — SIEM, UEBA, identity and NTA.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Gurucul Next-Gen SIEM vs the field
The SIEM field — honest lanes. Gurucul’s edge is a Leader-grade platform you can self-host; Sentinel and Splunk bring bigger ecosystems. We say so (and sell them).
| Dimension | Gurucul | Securonix | Exabeam | Microsoft Sentinel | Splunk ES |
|---|---|---|---|---|---|
| 2025 Gartner MQ | Leader — first year, after 3 as Visionary | Leader, 6 consecutive years | Leader, 6th time | Leader | Leader, 11th consecutive |
| Self-hosted / on-premises | YES — SaaS, cloud or self-hosted per Gartner | No — control plane is always their cloud | Via LogRhythm, a second platform | Cloud-only on Azure | Yes, and priced accordingly |
| Pricing axis | Per asset / per user, OR data volume / EPS | GB/day in tiered bands | GB ingested per day (2023 list) | Per GB ingested per day | Ingest or workload — the priciest here |
| Behavioural analytics | The founding capability, built 2010 | The founding capability | The founding capability | UEBA included | Available, add-on heritage |
| India data residency | Self-hosted: yours. No vendor India region found | BYO-AWS/Snowflake can hold data in India | Self-hosted via LogRhythm | Azure India regions available | Self-hosted: yours to place |
| Vendor scale | Bootstrapped boutique — no war chest | VC-backed, ~450 engineers in India | Post-merger with LogRhythm | Microsoft | Cisco-owned |
| Analyst breadth | Gartner-specific — absent from 2025 Forrester Wave | In both Gartner and Forrester | In both | In both | In both |
| The thing to plan around | Air-gap unverified; confirm the pricing axis | No air-gap at all; 120% default overage | Two platforms post-merger | Azure portal retires 31 Mar 2027 | Untuned, it is the costliest log archive there is |
| Best fit | On-premises mandates needing an analyst-recognised product | Cloud-accepting estates wanting retention solved | UEBA-led SOC, or on-prem via LogRhythm | Microsoft estates with E5 | Engineers who will build with it |
Does Gurucul Next-Gen SIEM fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Gurucul Next-Gen SIEM if…
- ✓A regulator, a contract or your posture requires the platform on infrastructure YOU control
- ✓You want an analyst-recognised commercial product rather than an open-source stack you operate alone
- ✓Behavioural detection is central to your threat model — insiders and stolen credentials
- ✓You can negotiate the pricing axis onto per-asset or per-user rather than per-GB
Choose Securonix if…
- ✓Cloud is acceptable and you want the larger vendor with a six-year Leader run
- ✓365 days of hot searchable data as standard matters to your investigations
- ✓You accept there is no air-gapped or on-premises option in any configuration
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 with E5 — first-party logs ingest free
- ✓Azure India regions answer your residency question directly
- ✓You accept cloud-only on Azure, and the portal migration by 31 Mar 2027
Choose Elastic or Wazuh if…
- ✓You need a genuine air gap and have platform engineers to operate it
- ✓You would rather trade analyst standing for deployment freedom and cost control
- ✓Wazuh’s core is free under GPLv2; Elastic self-manages at the Basic tier
Gurucul Next-Gen SIEM is one of 35 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
Assets or gigabytes — which meter suits you?
Gurucul can meter per asset or per user as an alternative to per-gigabyte ingest. That is the comparison worth modelling, because it is the one that changes behaviour: on an ingest-priced SIEM every improvement in logging coverage raises the invoice, so teams quietly stop collecting the sources that would have caught the intrusion. Set the two sliders: how many assets you would license, and how much daily ingest a SIEM priced by ingest would bill you for. The point is not the exact number, since Gurucul is quote-only. It is the shape: asset counts change slowly, log volume only ever goes up. Indicative Indian-market rates.
If the saving reads zero, the ingest-priced SIEM is genuinely cheaper at your ratio and you should say so internally rather than force the comparison. And remember the precision that matters here: Gurucul offers per-asset pricing as an alternative to per-GB, not instead of it — data-volume and EPS options exist on the same list. Which axis you land on is negotiated, so make it a clause rather than an assumption.
Three ways to consume it
Gurucul is quote-only — no published list price. What Gartner does record is the set of metering axes: all-inclusive per-asset and per-user pricing, enterprise agreements, module-based, data-volume and EPS-based, and platform-based. The per-asset and per-user axes are the valuable ones because they break the dynamic where logging more costs more — but be precise, they are offered as an alternative to per-GB, not instead of it. Which axis your order form specifies is a negotiation outcome and the single highest-value clause in the contract. TechBag quotes in INR with GST.
Per asset / per user
Breaks the logging-costs-more trap
- Asset and user counts change slowly and forecast cleanly
- No penalty for improving your logging coverage
- Ask for this axis explicitly — it is not the default
Data volume / EPS
What you may be offered instead
- Gartner records these options alongside per-asset
- A public reviewer references a 10 GB/day tier
- If you land here, model your growth before signing
Deployment
The reason to shortlist it
- SaaS, cloud or self-hosted — confirmed by Gartner
- Self-hosting is how you answer CERT-In in-India retention
- Air-gap is UNVERIFIED — get it in writing
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every SIEM vendor
Take this into your next vendor call — including ours.
Does a regulator, contract or posture require the platform on infrastructure we control?
If we need a genuine air gap, do we have Gurucul's written confirmation? Self-hosted is not the same thing.
Where will the platform run, and can we evidence that placement to an auditor?
If we want vendor-hosted SaaS inside India, have we asked directly? We found no evidence one exists.
Does our order form specify per-asset, per-user, per-module, data volume or EPS?
Is our directory clean enough for peer groups to mean anything, and do service accounts have owners?
How many weeks will we allow before judging alert quality?
Has our risk function accepted a bootstrapped boutique competing against Microsoft and Google?
Have we priced Sentinel and Securonix too, in case the deployment constraint does not actually bind us?
Are we citing the Gartner position specifically, rather than implying universal analyst consensus?
Questions buyers ask
Ready to evaluate Gurucul Next-Gen SIEM?
Confirm the deployment model, pin down the pricing axis, or get an honest Gurucul-vs-Sentinel comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.