Chronicle SOAR Pricing 2026
Pricing at a glance
Chronicle SOAR is Google's rebrand of Siemplify, acquired January 2022. It is now sold inside the Google Security Operations bundle. Standalone SOAR is rare; bundle pricing is the norm and is quote-only.
Source: cloud.google.com/security/products/security-operations · Verified 2026-06-19.
Chronicle SOAR keeps every commercial rate behind a sales call. We do not infer numbers from third-party leaks. The only honest path is to contact the vendor for a quote.
Tier breakdown
The full published-and-known tier list for Chronicle SOAR. Tiers marked "Quote only" require contact with sales.
| Tier | Published price | Notes |
|---|---|---|
Google Security Operations Standard | Quote only | Bundle includes SIEM and SOAR. Quote only. |
Google Security Operations Enterprise / Enterprise Plus | Quote only | Adds Mandiant intel and Gemini AI. Quote only. |
Cost scenarios
Three labelled scenarios. Where vendor data is insufficient to give a defensible figure we say so rather than guess. Worked numbers are flagged as illustrative.
Bundle covers Chronicle SIEM plus the SOAR layer. Quote-only. Google's go-to-market emphasises analyst-seat pricing for the SOAR component.
Adds Mandiant intelligence. Higher per-seat rate. Six-figure floor per PeerSpot and Reddit references; quote-only.
Top tier adds Gemini AI features for triage and investigation. Premium pricing; quote-only.
(Illustrative example, not a real company.) All scenarios apply a uniform $4,500/yr per integration engineering line and $1,800/yr per analyst training line on top of the licence; real quotes vary.
Hidden costs beyond the licence
What gets added to the Chronicle SOAR sticker number before you reach true TCO.
- Bundle entanglement: SOAR pricing is increasingly indistinguishable from Chronicle SIEM seat fees.
- Mandiant intelligence: included only at Enterprise tier and above; a meaningful uplift.
- Gemini AI features: separate consumption-style metering inside the bundle.
- Migration from legacy Siemplify on-prem: the standalone on-prem deployment is end-of-life. Cloud migration is mandatory.
Add-ons and bundles
Modules and bundle behaviour to factor into the total quote.
Mandiant intelligence
Bundled at Enterprise tier and above. Provides front-line threat intelligence in the SOAR workflow.
Gemini AI features
LLM-assisted triage and investigation. Available at Enterprise Plus; metered separately.
What Chronicle SOAR is best for
Google Cloud customers already committed to Chronicle SIEM, security teams comfortable with bundle pricing, and buyers who value Mandiant intelligence integrated into response.
Independent benchmarks and references
- Acquired from Siemplify (Israeli SOAR vendor) January 2022.
- Named in Gartner SOAR research as a Leader-tier offering within Google SecOps.
- PeerSpot reviews note positive analyst experience post-migration.
Frequently asked questions
Can I buy Chronicle SOAR standalone?+
Officially yes, in practice rarely. Google sells the SOAR as part of the Security Operations bundle alongside Chronicle SIEM.
Is the legacy Siemplify on-prem product still sold?+
No. Existing on-prem customers are being migrated to the cloud bundle.
Is Chronicle SOAR priced per seat or per ingest?+
Customer references cite a per-analyst-seat model for the SOAR layer, with Chronicle SIEM priced on data volume. Bundles smooth the boundary.
The two vendors most similar by pricing model and fit that publish at least one rate.