Chronicle SOAR Pricing 2026
Pricing at a glance
Chronicle SOAR is Google's rebrand of Siemplify, acquired January 2022. It is now sold inside the Google Security Operations bundle. Google publishes the package ladder but not the rates: Standard, Enterprise and Enterprise Plus are sized on ingestion volume and every one of them says contact sales.
Source: cloud.google.com/security/products/security-operations · Verified 2026-09-23.
Chronicle SOAR keeps every commercial rate behind a sales call. We do not infer numbers from third-party leaks. The only honest path is to contact the vendor for a quote.
Tier breakdown
The full published-and-known tier list for Chronicle SOAR. Tiers marked "Quote only" require contact with sales.
| Tier | Published price | Notes |
|---|---|---|
Google Security Operations Standard | Quote only | Base SIEM and SOAR, 12 months hot retention, 300+ SOAR integrations, 1 environment. Contact sales for pricing. |
Google Security Operations Enterprise / Enterprise Plus | Quote only | Adds unlimited environments, Mandiant intel and Gemini AI. Contact sales for pricing. |
Cost scenarios
Three labelled scenarios. Where vendor data is insufficient to give a defensible figure we say so rather than guess. Worked numbers are flagged as illustrative.
Bundle covers Chronicle SIEM plus the SOAR layer: 12 months hot retention, 700+ parsers, 300+ SOAR integrations, one environment, and a detection engine capped at 1,000 single-event and 75 multi-event rules. Quote-only, sized on ingestion.
Adds Mandiant intelligence, unlimited environments with remote agent, and a detection engine up to 2,000 single-event and 125 multi-event rules. Quote-only, and the meter is ingestion volume rather than headcount.
Top tier adds Gemini AI features for triage and investigation. Premium pricing; quote-only.
(Illustrative example, not a real company.) All scenarios apply a uniform $4,500/yr per integration engineering line and $1,800/yr per analyst training line on top of the licence; real quotes vary.
Hidden costs beyond the licence
What gets added to the Chronicle SOAR sticker number before you reach true TCO.
- Bundle entanglement: there is no separate SOAR line. The package price covers SIEM and SOAR together and is driven by how much telemetry you ingest.
- Mandiant intelligence: included only at Enterprise tier and above; a meaningful uplift.
- Gemini AI features: separate consumption-style metering inside the bundle.
- Migration from legacy Siemplify on-prem: the standalone on-prem deployment is end-of-life. Cloud migration is mandatory.
Add-ons and bundles
Modules and bundle behaviour to factor into the total quote.
Mandiant intelligence
Bundled at Enterprise tier and above. Provides front-line threat intelligence in the SOAR workflow.
Gemini AI features
LLM-assisted triage and investigation. Available at Enterprise Plus; metered separately.
What Chronicle SOAR is best for
Google Cloud customers already committed to Chronicle SIEM, security teams comfortable with bundle pricing, and buyers who value Mandiant intelligence integrated into response.
Independent benchmarks and references
- Acquired from Siemplify (Israeli SOAR vendor) January 2022.
- Named in Gartner SOAR research as a Leader-tier offering within Google SecOps.
- PeerSpot reviews note positive analyst experience post-migration.
Frequently asked questions
Can I buy Chronicle SOAR standalone?+
Officially yes, in practice rarely. Google sells the SOAR as part of the Security Operations bundle alongside Chronicle SIEM.
Is the legacy Siemplify on-prem product still sold?+
No. Existing on-prem customers are being migrated to the cloud bundle.
Is Chronicle SOAR priced per seat or per ingest?+
Per ingest. Google's own product page states that Security Operations is sold in packages priced on ingestion, with one year of telemetry retention included. There is no published per-analyst rate for the SOAR layer.
The two vendors most similar by pricing model and fit that publish at least one rate.