What is free, what is not, and what is deliberately absent
There is no ingest meter anywhere in this product, and no edition charges per seat. Three editions, one engine, and a published list of what no edition includes.
Bring your assessment questions; the repository answers most of them.
Why there is no number on this page
Growth and Enterprise are priced on the shape of the estate: how many cloud accounts, how many boundaries, whether the datastores run in your account or ours, and how quickly you need detection content after a campaign. A single figure printed here would be wrong for almost everyone who read it, and the alternative — a deliberately low anchor with an asterisk — is worse.
What is not negotiable and not variable is the shape of the bill: no seat count, no ingest meter, no per-host charge, no per-scan charge. Community is genuinely $0 in production, not $0 for fourteen days.
Item
Billed?
Seats and named users
No
Gigabytes ingested or indexed
No
Events per second
No
Hosts, containers or accounts covered
No
Number of correlation rules evaluated
No
API calls or scans
No
The things we will not bill you for, in any edition.
Deployment options, and who operates them
Option
Who runs it
Available in
Self-host, your account
You
Community, Growth, Enterprise
Managed instance, our account
Us, in a boundary you specify
Growth, Enterprise
Multi-tenant operator deployment
You, for several boundaries or customers
Enterprise
The engine is identical across deployment options. What changes is who carries the pager and who holds the backup rotation, which is why moving between them is a commercial change rather than a migration.
What no edition includes
Putting these next to the editions rather than in a footnote: a reader who assumes a paid tier unlocks something on this list would be buying a promise nobody can keep.
Oracle Cloud support — stub engines only.
SCIM provisioning.
Wiz, Jamf, Rapid7, Sumo Logic or Intune integrations.
A CIS compliance engine — CIS ships as behavioural rule packs instead.
A FedRAMP engine — FedRAMP exists in the tree as remediation text only.
SOC 2 Type II certification for the self-hosted product. A report exists for the managed edition.
Questions
Is the free edition really usable in production?
Yes. It is the same engine as the paid editions — 609 behavioural detections, 75 correlation rules, all 32 domains, all three clouds, the attack-path graph and the compliance evidence engines — under the Elastic License 2.0 with no time limit. The difference is detection content cadence and operational features, not detection capability.
What actually changes when we move to Growth?
The continuously-updated detection feed between releases, multi-cloud depth for cross-cloud joins, the runtime, agentic and application security suites, and the option of a managed instance if you would rather not operate the datastores.
Do you charge more if we grow our log volume?
No. Nothing in the pricing model is indexed on evidence volume. If you connect another account or another cloud that is an estate change and it is a conversation; the number of events flowing into the pipeline is not.
Is there a non-profit, education or open-source discount?
Community is free without a process, which covers most of that ground. If you need Growth or Enterprise capability and the estate is genuinely tiny, say so in the same email — the honest answer is that we would rather size the licence correctly than sell you a tier you will not use.
Can we evaluate the paid editions before buying?
Yes. Self-host Community first, because that is the real engine and it will tell you whether the signal-to-noise ratio works in your estate. Paid capability evaluation happens against your own data after that conversation, not against a demo tenant.
Start with the free edition
The paid tiers add detection content cadence and operational features. The detection engine is the same one, so an evaluation against your own estate is the only one worth running.