ManageEngine Log360
Log360 is ManageEngine’s unified SIEM flagship — log management, correlation, UEBA, threat intelligence, incident management, SOAR and compliance, available on-premises OR cloud, with Vigil IQ ML detection. Priced by log source with UNLIMITED users — predictable cost vs Splunk’s data-volume pricing. From an India-champion (Zoho).
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The ManageEngine platform family
This page covers Log360 — the SIEM flagship. The rest of the ManageEngine estate:
Quick facts
30-second orientation- Product
- Log360 — unified SIEM
- Vendor
- ManageEngine (a division of Zoho Corp)
- The category
- SIEM (log mgmt + threat detection & response)
- What it does
- Collect, correlate, detect (UEBA), respond (SOAR), comply
- The edge
- Log-source pricing, unlimited users (vs Splunk ingest)
- Pricing
- By log sources / devices — predictable, not by data volume
- Deployment
- On-premises AND cloud (data-localisation ready)
- AI
- Zia + UEBA analytics; Vigil IQ TDIR (cloud)
- Vs
- Splunk, Microsoft Sentinel, IBM QRadar, Wazuh
- In India via
- TechBag — scoping, licensing, GST (India-HQ'd vendor)
Understand SIEM before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is Log360?
ManageEngine’s unified SIEM flagship — log management, correlation, UEBA, threat intelligence, incident management, SOAR and compliance — available on-premises OR cloud (Log360 Cloud, Vigil IQ). The predictable-cost Splunk alternative.
Expensive/volume-priced SIEM vs Log360 — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Unprotected / signature email | Log360 (ManageEngine) |
|---|---|---|
| Pricing model | Splunk: data VOLUME (ingest) | Log SOURCES / devices — predictable |
| Users | Often per-seat | UNLIMITED users |
| Deployment | Cloud-only (Sentinel) | On-prem OR cloud (localisation) |
| UEBA | Costly add-on | Built in |
| SOAR | Separate tool | Built in (automated response) |
| Compliance | Build reports yourself | 1000s of templates out of the box |
| AI | None / add-on | Zia + Vigil IQ (ML TDIR) |
| Vendor | Foreign, VC/PE | India-HQ'd, bootstrapped (Zoho) |
ManageEngine Log360 is a full, real SIEM — log management, correlation, UEBA, threat intelligence, incident management, SOAR and compliance — available on-premises OR cloud, with Vigil IQ ML detection, priced by log source with UNLIMITED users (predictable vs Splunk’s volume pricing). From an India-champion (Zoho, Chennai). Hyperscale data? Splunk. Azure-native? Sentinel. Open-source DIY? Wazuh. TechBag scopes log sources + deployment and handles GST.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Log Collection & Correlation
Collects and normalises logs from servers, network devices, endpoints, cloud, applications and Active Directory, then correlates events in real time.
Threat Detection (UEBA + TI)
Built-in UEBA baselines normal behaviour and flags anomalies, while threat intelligence feeds catch known-bad indicators, surfacing insider threats fast.
Investigate & Respond (SOAR)
Incident management plus SOAR (security orchestration, automation & response) lets you investigate alerts and run automated response workflows.
Compliance & Auditing
Thousands of compliance report templates (PCI DSS, HIPAA, GDPR, SOX and India’s requirements), plus Active Directory auditing and file integrity monitoring.
Predictable + On-Prem/Cloud
Priced per log source with unlimited users, not by volume like Splunk, and deployed on-premises or as Log360 Cloud with Vigil IQ TDIR.
One SIEM collecting logs across the estate — UEBA, threat intel and SOAR in the box, compliance reports ready.
Twelve capabilities. Collect, detect, respond.
Log360 gives you a full, real SIEM at a predictable log-source cost — on-premises or cloud — the security flagship of the ManageEngine portfolio.
Log Management & Collection
Collects, indexes and stores logs from servers, network, endpoints, cloud and apps, with fast search and long retention.
Active Directory Auditing
Deep Active Directory and Azure AD auditing tracks logons, permission and group changes, and account activity.
Cloud Security (CASB)
Monitors AWS, Azure, GCP and cloud apps, with built-in CASB, so cloud activity is in the SIEM too.
File Integrity Monitoring (FIM)
File integrity monitoring flags unauthorised changes to critical files and configurations, exposing tampering and ransomware.
Real-Time Event Correlation
Real-time correlation links events across sources into attack patterns, with built-in rules and a custom rule builder.
UEBA — Behaviour Analytics
Built-in UEBA flags anomalies against normal behaviour, catching insider threats, compromised accounts and lateral movement.
Threat Intelligence
Built-in threat intelligence feeds flag known-bad IPs, URLs and domains, so traffic to malicious infrastructure is caught.
Vigil IQ — ML Threat Detection
Vigil IQ in Log360 Cloud adds ML-driven threat detection, investigation and response, with lower noise and guided triage.
Incident Management
A built-in incident console assigns, tracks and prioritises alerts through to closure, with an audit trail.
SOAR — Automated Response
SOAR playbooks disable an account, block an IP or isolate a device on detection, so you respond in seconds, not hours.
Compliance Reporting
Thousands of report templates for PCI DSS, HIPAA, GDPR, SOX, ISO 27001 and India’s requirements, plus custom reports.
On-Premises OR Cloud
Deploy on-premises or as Log360 Cloud with Vigil IQ — a choice Indian government, BFSI and regulated organisations value.
Watch Log360 in action
The overview, getting started, and the core workflows.
ManageEngine Log360 product demo
The SIEM flagship, walked through.
Exploring IAM with AD360
The wider ManageEngine security estate.
ManageEngine — This is Our Story
The India-champion behind the product.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Managing devices is the floor. Automating them is the win.
Here’s what genuinely sets Log360 apart (and when Splunk/Sentinel fit).
Predictable log-source pricing — not Splunk's runaway ingest bill
Log360 is priced by the number of log sources you monitor, with unlimited users, not by data volume as Splunk is. Ingesting more logs does not spike the bill, so teams can turn on full logging, budget from device count and give every analyst access. The TCO gap is often dramatic.
On-premises OR cloud — the data-localisation choice for security data (a real India edge)
Log360 runs on-premises or as Log360 Cloud, with ManageEngine data centres in Chennai and Mumbai. Cloud-only SIEMs such as Microsoft Sentinel require security logs to leave your environment, so government, BFSI and defence buyers bound to keep data in-country can still run a full SIEM in-house.
Full SIEM — UEBA, SOAR and compliance built in, not bolted on
Log360 covers the whole loop on one platform: log management, file integrity monitoring and CASB; correlation, UEBA and threat intelligence; incident management and SOAR; and thousands of compliance templates for PCI DSS, HIPAA, GDPR, SOX and ISO 27001. UEBA and SOAR are built in, not paid add-ons.
Part of one IT-management estate — and now AI (Zia + Vigil IQ)
Log360 is part of ManageEngine’s 60+ product portfolio: AD360 and ADAudit Plus feed identity events, Endpoint Central adds endpoint context, ServiceDesk Plus tracks incidents as tickets, and OpManager adds infrastructure health. Log360 Cloud adds Vigil IQ for ML-driven detection and investigation.
From ManageEngine — an India-champion (Zoho), bootstrapped and trusted
ManageEngine is the IT-management division of Zoho Corp, bootstrapped and headquartered in Chennai. It has 10,000+ Indian customers, data centres in Chennai and Mumbai and full on-premises options, answering RBI, government and CERT-In needs for security data. ManageEngine says 280,000+ organisations use its software.
The honest scope
Log360 is a value challenger, not the hyperscale-data leader. Splunk leads on data scale but prices on ingest; Sentinel suits Azure shops but is cloud-only; QRadar is the legacy incumbent (its SaaS business sold to Palo Alto Networks in 2024); Wazuh is open-source DIY. Log360 wins on predictable cost.
The numbers behind the platform
What your Log360 journey looks like
SIEM scoping (& deployment)
Map security needs, log sources and on-prem vs cloud. TechBag sizes sources, advises the edition and compares Splunk and Sentinel.
Deploy & onboard sources
Deploy on-prem or cloud, onboard servers, network, endpoints, cloud and AD, and turn on correlation, UEBA and threat intel.
Respond & comply
Set up incident management and SOAR playbooks, enable file integrity monitoring and CASB, and switch on compliance packs.
Tune & modernise
Tune correlation rules, adopt Vigil IQ, connect AD360, Endpoint Central and ServiceDesk Plus, and optimise licensing.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Splunk’s ingest pricing would have ballooned as our logs grew. Log360’s per-source pricing let us turn on full logging.”
“As a regulated organisation we can’t send security logs to a foreign cloud. Log360 runs entirely in our own environment.”
“Built-in UEBA caught a compromised account our old rule-based tool missed, and SOAR disabled it in seconds.”
“Thousands of templates, including PCI DSS and our Indian requirements, turned quarterly compliance into a report we run.”
“It ties into AD360 and ADAudit Plus, so identity threats and endpoint context feed straight into the SIEM.”
“For the largest data-analytics programmes Splunk goes deeper, but we lack that scale. Log360 gave us SIEM at a predictable cost.”
“Log360 Cloud’s Vigil IQ cut our alert noise: ML-driven detection surfaces the real threats and guides investigation.”
“Trusting an India-HQ’d, bootstrapped vendor (Zoho/ManageEngine) with our security logs felt right; TechBag handled GST.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the SIEM & security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Predictable-cost value SIEM, on-prem OR cloud. This page's product.
SIEM Depth × On-Prem Value
The grid nobody publishes — SIEM depth vs on-prem fit & value.
Full SIEM + on-prem + predictable value.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Log360 vs the SIEM field
Splunk, Microsoft Sentinel, IBM QRadar, Wazuh and Securonix — honest lanes; the edge is PREDICTABLE VALUE (log-source pricing, unlimited users) + the on-prem-OR-cloud choice + UEBA/SOAR/compliance built in. Hyperscale data? Splunk. Azure-native? Sentinel. We say so.
| Dimension | Log360 | Splunk (Ent. Security) | Microsoft Sentinel | IBM QRadar | Wazuh | Securonix |
|---|---|---|---|---|---|---|
| Position | Predictable-cost value SIEM, on-prem OR cloud | Hyperscale data & analytics leader | Azure/M365-native cloud SIEM | Enterprise legacy (sold to Palo Alto) | Open-source DIY SIEM | UEBA/analytics-led |
| Pricing model | Log source / device — predictable | Data VOLUME (ingest) — costly | Consumption (per GB) | Enterprise-priced | Open-source (self-run) | Enterprise-priced |
| Users | UNLIMITED users | Varies | Varies | Varies | Unlimited (self-run) | Varies |
| On-premises option | Yes (on-prem OR cloud) | On-prem or cloud | Cloud-only (Azure) | On-prem | Self-hosted | SaaS-led |
| UEBA + SOAR built in | Both built in | Add-ons (UBA, SOAR) | SOAR built in; UEBA add | Add-ons | Basic / DIY | UEBA leader |
| Compliance reporting | 1000s of templates | Strong (add-ons) | Via Azure | Strong | DIY | Solid |
| Hyperscale data / analytics depth | Solid (value tier) | Deepest | Cloud-scale | Deep | Basic | Analytics-strong |
| Best fit | Predictable-cost SIEM, on-prem/localisation | Hyperscale data & analytics (budget) | Azure/M365-native cloud SIEM | Existing QRadar estate | Open-source DIY | UEBA/analytics-led |
Which IT & device management approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Log360 if…
- You want a full, real SIEM (log mgmt, correlation, UEBA, SOAR, compliance) at a PREDICTABLE, affordable cost — priced by log source, with UNLIMITED users (vs Splunk's expensive volume pricing)
- You need (or prefer) an ON-PREMISES option for your security data — for data-localisation, sovereignty or regulatory reasons (a real India/regulated edge)
- You want UEBA and SOAR built in (not paid add-ons), thousands of compliance reports, and an integrated ManageEngine security estate
- You value an India-HQ'd, bootstrapped vendor (Zoho) with India data centres and Zia/Vigil IQ AI
Splunk (Enterprise Security) if…
- You're a very large, data-heavy security-analytics programme needing the deepest data platform and ecosystem (and can budget for volume-based pricing)
Microsoft Sentinel if…
- You're Azure/M365-native and want a cloud-native SIEM deeply integrated with Microsoft (and don't need on-prem)
Wazuh if…
- You want an open-source, DIY SIEM and have the team to run and maintain it yourself
ManageEngine Log360 is one of 36 siem & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (count log sources / devices; security-hour cost as loaded rate). Estimates contrast an expensive/volume-priced or basic SIEM (high, unpredictable ingest cost, or missing UEBA/SOAR/compliance) vs Log360 (full SIEM, predictable log-source pricing, unlimited users, on-prem/cloud choice, Vigil IQ) — the wins are predictable cost vs Splunk, built-in UEBA/SOAR/compliance, and deployment choice. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models actual device counts and modules.
Three ways to consume it
Log360 is priced by the number of LOG SOURCES (devices) you monitor, with UNLIMITED users — a predictable model and a major TCO advantage over Splunk’s data-VOLUME (ingest) pricing (famously expensive and unpredictable). Editions add capability, and you can deploy on-premises OR in the cloud (Log360 Cloud, Vigil IQ). Exact figures vary by edition/log sources/deployment/region and move over time — TechBag scopes your log sources and edition and quotes current figures (ManageEngine publishes live pricing). India-HQ’d vendor; TechBag handles GST.
Log360 (per log source)
Best for predictable-cost SIEM
- Priced by log source / device — NOT data volume; UNLIMITED users
- Predictable TCO vs Splunk’s ingest pricing; editions add depth
- On-premises OR cloud (Vigil IQ) — data-localisation ready
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ On-prem / the ManageEngine estate
Best value with TechBag
- On-premises option for security-data localisation/sovereignty (vs cloud-only Sentinel)
- Integrate AD360, Endpoint Central, ServiceDesk Plus — one stack
- India-HQ’d vendor (Zoho); TechBag scopes log sources + handles GST
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Worried about Splunk’s ingest-based bill? Would Log360’s per-log-source pricing with unlimited users lower your TCO?
Must security data stay on-premises for localisation or regulation? Log360 runs on-prem or cloud, unlike Sentinel.
Need real SIEM — UEBA, SOAR and compliance, not just log storage? Log360 has them built in (not paid add-ons).
Want behaviour-based detection? Built-in UEBA, threat intelligence and (cloud) Vigil IQ ML catch what static rules miss.
Facing PCI DSS, HIPAA, GDPR, SOX or India’s requirements? Do the out-of-the-box report templates cover your audits?
Want to respond automatically? SOAR playbooks disable accounts, block IPs and isolate devices at machine speed.
Standardising on ManageEngine? Log360 integrates with AD360, Endpoint Central and ServiceDesk Plus — one IT-security stack.
Do you want an India-HQ’d, bootstrapped vendor with India data centres for your security logs? ManageEngine fits.
Questions buyers ask
Ready for real SIEM — predictable cost, on-prem or cloud?
Scope Log360 (full SIEM — UEBA, SOAR, compliance — priced by log source with unlimited users, on-prem OR cloud, Vigil IQ AI) — and let a TechBag advisor size the log sources, choose the edition and deployment (on-prem for data-localisation), and license it. Or compare vs Splunk/Sentinel for hyperscale data or Azure-native needs.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.