Best Security Information and Event Management (SIEM) Software

Security information and event management (SIEM) software combines a variety of security software components into one platform. Companies use SIEM products to centralize security operations into a single location. IT and security operations teams can gain access to the same information and alerts for more effective communication and planning. These products provide capabilities to identify and alert IT operations teams of anomalies detected in their systems. The anomalies may be new malware, unapproved access, or newly discovered vulnerabilities. They provide live analysis of functionality and security, storing logs and records for retrospective reporting. They also have tools for identity and access management to ensure only approved parties have access to sensitive systems. Forensic analysis tools help teams navigate historical logs, identify trends, and better fortify their networks.

SIEM tools may be confused with incident response software, but SIEM products provide a larger scope of security and IT management features. Most also do not have the ability to automate security remediation practices.

To qualify for inclusion in the SIEM category, a product must:

  • Aggregate and store IT security data
  • Assist in user provisioning and governance
  • Identify vulnerabilities in systems and endpoints
  • Monitor for anomalies within an IT system
G2 Grid® for Security Information and Event Management (SIEM)
Leaders
High Performers
Contenders
Niche
Market Presence
Satisfaction
Star Rating

Security Information and Event Management (SIEM) reviews by real, verified users. Find unbiased ratings on user satisfaction, features, and price based on the most reviews available anywhere.

Compare Security Information and Event Management (SIEM) Software

G2 takes pride in showing unbiased ratings on user satisfaction. G2 does not allow for paid placement in any of our ratings.
Results: 85
Filter Results
Filter by:
Sort by
Star Rating
Sort By:
Results: 85

    Splunk Enterprise Security (ES) is a SIEM software that provides insight into machine data generated from security technologies such as network, endpoint, access, malware, vulnerability and identity information to enables security teams to quickly detect and respond to internal and external attacks to simplify threat management while minimizing risk and safeguarding business

    Build, run and secure your AWS, Azure, Google Cloud Platform or Hybrid applications with Sumo Logic, a cloud-native, machine data analytics service for log management and time series metrics.

    AlienVault USM Anywhere is a cloud-based security management solution that accelerates and centralizes threat detection, incident response, and compliance management for your cloud, hybrid cloud, and on-premises environments. USM Anywhere includes purpose-built cloud sensors that natively monitor your Amazon Web Services (AWS) and Microsoft Azure cloud environments. On premises, lightweight virtual sensors run on Microsoft Hyper-V and VMware ESXi to monitor your virtual private cloud and physica

    Trustwave is a global leader in cloud-based compliance and information security.

    The complexity of managing network and security operations is resulting in increases in breaches worldwide. Discovery, isolation, and remediation of these incidents are measured in hundreds of days. And with a dwindling pool of skilled cyber security personnel able to manage the wide array of devices and data sources to protect their network assets, success requires a new approach. FortiSIEM provides organizations of all sizes with a comprehensive, holistic, and scalable solution for security,

    Logz.io provides an intelligent and scalable machine data analytics platform built on ELK and Grafana. Designed for monitoring modern applications, Logz.io combines cloud-native simplicity and scalability with crowdsourced artificial intelligence to help engineers identify critical issues before they occur and empower them to monitor, troubleshoot and secure mission-critical applications using one unified platform.

    Advanced Security Manager is a computer security software that secures information from unwanted intruders in a computer.

    EventTracker is the only cybersecurity solution that delivers SIEM, EDR and a global Security Operations Center (SOC) to deliver optimal threat management and compliance results with a focus on streamlined deployment and reasonable pricing for mid-size organizations. EventTracker Security Center A SIEM platform that unifies machine learning, behavior analytics, and security orchestration to make security analysts more efficient and effective. A mainstay in the cybersecurity space, EventTracker

    Juniper Secure Analytics monitors security information and events in near real time.

    Log & Event Manager (LEM) is an ACTIVE monitoring SIEM solution that automatically detects, alerts and responds to suspicious behavior on multi-vendor network devices, servers, workstations and applications. LEM comes as a downloadable virtual appliance for quick deployment, and enables threat intelligence and real-time event correlations right out-of-the-box enabling faster response to cyber-attacks.

    IBM QRadar
    (23)4.2 out of 5
    Optimized for quick response
    Optimized for quick response

    IBM QRadar helps security teams accurately detect, understand and prioritize threats that matter most to the business. The solution ingests asset, cloud, network, endpoint, and user data, correlates it against vulnerability information and threat intelligence, and applies advanced analytics to identify and track the most serious threats as they progress through the kill chain. Once a credible threat is identified, AI-powered investigations provide rapid, intelligent insights into the root caus

    LogRhythm, a leader in NextGen SIEM, empowers organizations on six continents to measurably reduce risk by rapidly detecting, responding to, and neutralizing cyberthreats. LogRhythm’s Threat Lifecycle Management (TLM) workflow is the foundation for security operations centers, helping customers secure their cloud, physical, and virtual infrastructures for IT and OT environments.

    Alienvault OSSIM is an open source SIEM tool that contribute and receive real-time information about malicious hosts to help user increase security visibility and control in network.

    SolarWinds SIEM is a Log & Event Manager software that Eliminate threats faster with instantaneous detection of suspicious activity and automated responses for mitigation and compliance.

    Award-winning, comprehensive and economical monitoring suite which ensures that all aspects of your IT infrastructure are secure and performing optimally.

    Graylog
    (17)4.4 out of 5
    Optimized for quick response
    Optimized for quick response

    Graylog is a leading centralized log management solution built to open standards for capturing, storing, and enabling real-time analysis of terabytes of machine data. Tens-of-thousands of IT professionals rely on Graylog’s scalability, comprehensive access to complete data, and exceptional user experience to solve security, compliance, operational, and DevOps issues every day. Purpose-built for modern log analytics, Graylog removes complexity from data exploration, compliance audits, and threa

    DICE Central Station is built to reduce central station activity and data entry, providing a seamless interface for operators.

    Unomaly provides a new way of analyzing streaming data. Unomaly analyzes data upfront and remembers everything it has seen. - A new way of highlighting and revealing must-see data Unomaly universally detects and reveals non-normal data without prior knowledge of incidents. - A new way of reducing, storing, and scaling data. Unomaly efficiently reduces the amount of data to analyze, store, and transmit. OUR DIFFERENCE What is algorithmic monitoring? Universal data tokenization - All softwar

    Rapid7 InsightIDR is a fully integrated detection and investigation solution that gives you the confidence to identify a compromise as soon as it occurs. InsightIDR leverages attacker analytics to detect intruder activity earlier in the attack chain, cutting down false positives and unnecessary work for security professionals. Hunt for actions indicative of compromised credentials, spot lateral movement across assets, detect malware, and set intruder traps. Make investigations 20x faster by unco

    Cloud Security Command Center helps security teams gather data, identify threats, and act on them before they result in business damage or loss. It offers deep insight into application and data risk so that you can quickly mitigate threats to your cloud resources and evaluate overall health.

    Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables control over changes, configurations and access in hybrid IT environments to protect data regardless of its location. The platform provides security intelligence to identify security holes, detect anomalies in user behavior and investigate threat patterns in time to prevent real damage. Netwrix Auditor includes applications for Active Directory, Azure AD, Exchange, Office 365, Windows file serve

    Loom Systems delivers an advanced AI-powered log analysis platform that helps IT and DevOps teams predict and troubleshoot problems before they affect production. Loom predicts problems, provides their root cause and crowd-sources expert knowledge to recommend resolutions in real time. Loom is a Stevie® American Business Awards 2016 winner. Our platform mathematically models the analytical prowess of the human mind and infuses it with computational speed, accuracy and tirelessness. Our technolo

    ManageEngine - Log360 ois a one-stop solution to all Log Management and Active Directory Auditing.

    ArcSight Enterprise Security Manager (ESM) is a comprehensive threat detection, analysis, triage, and compliance management SIEM platform that dramatically reduces the time to mitigate cyber-security threats.

    ServiceNow Security Operations is an Enterprise Security Response engine offering security incident response, vulnerability response, configuration compliance, and threat intelligence. It’s built on the intelligent workflows, automation, orchestration, and deep connection with IT of the ServiceNow platform.

    CA Compliance Event Manager helps you increase your data privacy and simplify regulatory compliance

    FireEye Helix is a intelligence-led platform designed to simplify, integrate and automate security operations.

    GFI EventsManager offers mechanisms and applications for monitoring security activity.

    Trend Micro Hosted Email Security is a no-maintenance-required solution that delivers continuously updated protection to stop phishing, ransomware, BEC, advanced threats, spam, and malware before they reach your network. It protects Microsoft Exchange, Microsoft Office 365, Google Gmail, and other hosted and on-premises email solutions.

    Apply artificial intelligence to accelerate incident analysis and rapidly respond to threats.

    Lancope provides flow-based network security, performance and application monitoring solutions for enterprises.

    McAfee Enterprise Security Manager is a security information and event management (SIEM) solution that delivers actionable intelligence and integrations to prioritize, investigate, and respond to threats.

    Micro Focus ArcSight Data Platform is designed to enhance data collection with security context to lay the foundation for intelligent security operations.

    Micro Focus ArcSight Express is a SIEM appliance designed to give users the insight and tools to identify and prioritize current and potential threats so they can optimize their response and improve the security of their systems.

    The TippingPoint Security Management System provides global vision and security policy control for threat intelligence and enables comprehensive analysis and correlation.

    Trend Micro ServerProtect for Linux 3.0 offers comprehensive real-time protection for enterprise web-servers and file-servers, preventing them from spreading viruses, spyware, and other Web threats to internal or external endpoints. Managed through an intuitive portable Web-based console, ServerProtect provides centralized virus/malware scanning, pattern updates, event reporting, and configuration.

    SOCVue Security Monitoring is a service that includes 24/7/365 threat detection, remediation guidance, compliance, and SIEM and log management.

    The Respond Analyst is security decision automation software that performs just like an expert cyber security analyst but at machine speed -- making escalations decisions by analyzing streaming security data. The Respond Analyst processes millions of alerts, in real-time, and escalates detailed, vetted security situations for security teams to respond to and defend against.

    SIEM software management provides network monitoring solutions through a single view.

    ActiveSOC automatically validates that low-scoring events (e.g.User logged in from an unusual location) are attacks. It helps triage alerts as well as generate new intelligence from low-scoring events.

    AD|Assess continuously works in the background and leverages unique algorithms to gather in-depth information about configurations of the directory, privileged accounts, security settings, GPO, endpoints connected to the domain, domain controller configurations and even inappropriate use of privileged accounts. Then, it autonomously analyzes every component for misconfigurations and backdoors attackers left behind. Once identified, an alert is sent to the central console with recommendations for

    Cofense Triage is the first phishing-specific incident response platform that allows security operation (SOC) and incident responders to automate the prioritization, analysis and response to phishing threats that bypass your email security technologies.

    CorreLog is a ISV for cross-platform IT security log management and event log correlation.

    CRYPTOSIM is a SIEM software with exceptional correlation and analysis features, serving as a detection and controlling platform that can be integrated with CRYPTOLOG log manager, to provide organizations with threat detection and security risk evaluation on network behavior and performance.

    Cyber Architecture and Engineering empowers its clients to achieve their business goals with network and system integration projects that are efficient in design and operation, are delivered on time and to budget, and provide added value to the business operations as part of the assessment and design process.

    Abacode’s product-agnostic solution, Cyber Lorica™, is a subscription-based managed Security Information and Event Management (SIEM) / Artificial Intelligence (AI) service. We work with industry-leading products to determine the best solutions to meet the specific security needs of your business. We identify vulnerabilities and detect high-risk behavior to mitigate breaches. We offer multiple deployment options, including cloud-based, physical appliance, and virtual appliance to accommodate all

    CyberReveal, a suite of products for enhancing cyber security operations and protecting your business in the connected world.

    empow's security platform radically upends traditional approaches by integrating with your existing network infrastructure and breaking down your security tools into their individual components.

    eVigilPro offers direct analysis of security events generated by computer hardware, network, and applications. It detects anomalies and policy violations through real-time monitoring and stops them by reconfiguring other enterprise security controls. eVigilPro comes with Advanced correlation engine to help analyze large amount of event data for a deeper insight on threats against sensitive data and assets. It provides infrastructure-wide visibility to identify critical threats, respond intellig

    Latest Security Information and Event Management (SIEM) Articles