MSSP resale / hosted managed service Constrained. LME's own code is permissive, but Elastic/Kibana under Elastic License 2.0 blocks providing a substantial set of Elastic features to third parties as a hosted or managed service. Customer-owned deployments and advisory/tuning services are a different, reviewable model. Commercially available through approved licensing and partner/MSP arrangements. Commercially available through Microsoft/customer tenant and partner arrangements. Commercially available through Palo Alto/partner arrangements. Licence cost exposure No LME licence fee; costs are infrastructure, storage, engineering, support, and optional AI. Medium to high. Cost commonly tied to ingest/workload/platform entitlements and premium security features; strong discounting and self-managed options can change the shape. Medium to high. Consumption model tied to ingestion, analytics, retention, and Azure services. High. Enterprise commercial model tied to endpoint/XDR/SOC platform adoption. Vendor lock-in Low to moderate. Open stack, but Elastic/Wazuh component choices still matter. Medium to high. Data can be exported and self-managed deployments reduce some dependency, but SPL, apps, CIM/data models, dashboards, and skills create real gravity. High if the organisation standardises on Azure, KQL, Defender, Logic Apps, and Microsoft incident workflows. High if the SOC standardises on Cortex workflows, endpoint telemetry, automation, and case handling.

The Licensing Difference

The licensing model is one of LME's strongest economic arguments, but it needs to be described carefully.

It is also the biggest structural problem with the model.

Not because LME is free. That part is good. The problem is that a stack can be free for internal use and still awkward to commercialise. Many organisations do not want to become SIEM engineers. They want a managed security provider to bring a working platform, tune it, operate it, and take accountability for the outcome. That is exactly where the Elastic licensing constraint becomes material.

LME itself uses a permissive structure:

US government-developed portions are distributed under Creative Commons Zero (CC0).
Other/new submissions are generally under Apache License 2.0.
Wazuh is GPLv2.
ElastAlert2 is Apache License 2.0.
Elastic/Kibana components are under Elastic License 2.0, which allows broad use, copying, distribution, and modification, but restricts providing the software to third parties as a hosted or managed service that exposes a substantial set of Elastic features.

For internal use, this is dramatically more flexible than proprietary SIEM licensing. Organisations can deploy LME, modify it, operate it locally, build local workflows, and avoid per-GB SIEM licence growth.

For commercial managed-service use, the component licences matter far more. Anyone building an LME-based MSSP or hosted SIEM offer needs legal and architecture review, especially around Elastic License 2.0 and Wazuh GPL obligations. The safest reading is that you should not assume you can resell a hosted LME SIEM that exposes Elastic/Kibana functionality to customers. Selling implementation, tuning, detection engineering, and operational support around a customer-controlled deployment is a more plausible model, but still needs proper review rather than a blog-post blessing. Annoying, but law has rarely been improved by vibes.

This is the central frustration: the technical stack is compelling, but the licence shape makes it harder for service providers to pr

Security research, product updates, and field notes

Insider Threat Detection: Behavioral Analytics and UEBA Implementation