# Best Security Information and Event Management (SIEM) Software Solutions - Page 7 ## How Many Security Information and Event Management (SIEM) Software Products Does G2 Track? **Total Products under this Category:** 122 ### Category Stats (Jul 2026) - **Average Rating:** 4.45/5 (↑0.01 vs Jun 2026) The average rating of products in this category, based on all submitted ratings - **Top Trending Product:** Singularity AI SIEM (+23.8%) - Among all products in this category, Singularity AI SIEM recorded the largest rating increase compared to last month _Last updated: July 29, 2026_ ## How Does G2 Rank Security Information and Event Management (SIEM) Software Products? **Why You Can Trust G2's Software Rankings:** - 30 Analysts and Data Experts - 5,900+ Authentic Reviews - 122+ Products - Unbiased Rankings G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category. ## G2 Grid® for Security Information and Event Management (SIEM) Software ![G2 Grid® for Security Information and Event Management (SIEM) Software plotting products by satisfaction and market presence](https://www.g2.com/categories/security-information-and-event-management-siem/grids.png?focus%5B%5D=68606&focus%5B%5D=1430041&focus%5B%5D=30500&focus%5B%5D=5691&focus%5B%5D=10436&focus%5B%5D=53174&focus%5B%5D=122123&focus%5B%5D=58203) Highlighted products: CrowdStrike Falcon Endpoint Protection Platform, Palo Alto Cortex XSIAM, Google Security Operations, ManageEngine ADAudit Plus, Sumo Logic, Todyl Security Platform, Microsoft Sentinel, and Check Point Infinity Platform. Underlying data: [Grid® JSON](https://www.g2.com/categories/security-information-and-event-management-siem/grids.json?focus%5B%5D=crowdstrike-falcon-endpoint-protection-platform&focus%5B%5D=palo-alto-cortex-xsiam&focus%5B%5D=google-security-operations&focus%5B%5D=manageengine-adaudit-plus&focus%5B%5D=sumo-logic&focus%5B%5D=todyl-security-platform&focus%5B%5D=microsoft-sentinel&focus%5B%5D=check-point-infinity-platform) **Sponsored** ### Datadog Datadog is the monitoring, security and analytics platform for developers, IT operations teams, security engineers and business users in the cloud age. The SaaS platform integrates and automates infrastructure monitoring, application performance monitoring and log management to provide unified, real-time observability of our customers' entire technology stack. Datadog is used by organizations of all sizes and across a wide range of industries to enable digital transformation and cloud migration, drive collaboration among development, operations, security and business teams, accelerate time to market for applications, reduce time to problem resolution, secure applications and infrastructure, understand user behavior and track key business metrics. [Visit website](https://www.g2.com/external_clickthroughs/record?secure%5Bad_program%5D=ppc&secure%5Bad_slot%5D=category_product_list&secure%5Bcategory_id%5D=1081&secure%5Bchosen_at%5D=2026-07-30T13%3A55%3A47Z&secure%5Bdisplayable_resource_id%5D=1081&secure%5Bdisplayable_resource_type%5D=Category&secure%5Bmedium%5D=sponsored&secure%5Bplacement_reason%5D=page_category&secure%5Bplacement_resource_ids%5D%5B%5D=1081&secure%5Bprioritized%5D=false&secure%5Bproduct_id%5D=3824&secure%5Bresource_id%5D=1081&secure%5Bresource_type%5D=Category&secure%5Bsource_type%5D=category_page&secure%5Bsource_url%5D=https%3A%2F%2Fwww.g2.com%2Fcategories%2Fsecurity-information-and-event-management-siem%3Fpage%3D7&secure%5Btoken%5D=e0ef92fa41567aea2acd42d152566451acb7e3a7d6fe7433dd89eeaf38c89292&secure%5Burl%5D=https%3A%2F%2Fwww.datadoghq.com%2Fdg%2Fmonitor%2Ffree-trial-g2%2F%3Futm_source%3Dg2crowd%26utm_medium%3Dreview-site%26utm_campaign%3Ddg-coreplatform-multi-ww-en-g2&secure%5Burl_type%5D=custom_url) ### [DarkSense](https://www.g2.com/products/darksense/reviews) Arancia is a cybersecurity and technology managed security service provider (MSSP) trusted by Fortune 500 brands to manage their cybersecurity and technology needs. The company operates on a partner-led model, offering expertise in consulting, managed security services, incident response forensics, and managed cloud technology. With a focus on various industries such as higher education, healthcare, and financial services, Arancia emphasizes the importance of a skilled team and innovative solutions to combat cyber threats. Their AI-driven Cyber Threat Hunting Platform and a commitment to client support allow them to safeguard environments globally. #### Who Is the Company Behind DarkSense? - **Seller:** [Arancia](https://www.g2.com/sellers/arancia) - **HQ Location:** N/A - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=47d9773d4fc06072f4d8a43035dc2ac6e8163f1c7078f0cb4647ece4c83eedd8&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Faranciasec%2F&secure%5Burl_type%5D=linkedin_company_website) 59 employees on LinkedIn® ### [Defense.com](https://www.g2.com/products/defense-com/reviews) Defense.com is an XDR platform that contains everything your organisation needs to detect and respond to cyber threats across all areas of your network, without the enterprise price tag or complexity. Without a solution like Defense.com, you can spend a lot of time and resources manually correlating data from multiple, disparate security tools in order to identify and remediate cyber threats. Defense.com ingests and correlates native and third-party security data from all areas of your environment into a single detection and response platform, helping you to quickly identify threats and prevent breaches. In addition to threat detection and response, the Defense.com platform also helps your organisation strengthen its security posture with built-in vulnerability scanning, endpoint protection, external attack surface monitoring and security awareness training. Managed services Small and medium sized organisations often lack the time or resources to properly monitor their environment, forcing them to settle for just business hours coverage. Defense.com solves this challenge with a 24/7 Managed SIEM service, backed by our in-house SOC analysts and our advanced log monitoring technology. We can take the pressure off your team by monitoring your organisation's environment on your behalf, alerting you to genuine threats and providing detailed remediation advice to help fix issues fast. Why choose Defense.com? Unlike many other providers on the market that operate as MSSPs with third party technology, Defense.com has developed a proprietary SIEM platform that delivers advanced threat detection capabilities and can ingest logs from any system or vendor. This enables organisations to make the most out of their existing security investments, break free from vendor lock-in, and monitor everything in their environment for security threats. We also operate our own in-house SOC team, who provide 24/7 proactive threat detection and log monitoring. Our managed services alleviate the pressure on IT teams by proactively looking for malicious activity in their networks and raising security alerts to their attention, saving them time and ensuring that they only focus on genuine risks. Existing vendors on the market provide complex and expensive solutions that are usually tailored to enterprise organisations with in-house SecOps teams. Defense.com stands out as a more accessible alternative for SMEs in comparison to the current MDR and XDR category leaders. #### Who Is the Company Behind Defense.com? - **Seller:** [Defense.com](https://www.g2.com/sellers/defense-com) - **Year Founded:** 2016 - **HQ Location:** Stevenage, GB - **Twitter:** @defensedotcom 178 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=e57b666a04c532ce80f2a1c44c575d24030130ee8d3bc18115065af60cfba7b9&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fdefense-com%2F&secure%5Burl_type%5D=linkedin_company_website) 40 employees on LinkedIn® ### [eBPF Server security, uptime monitoring, on-call alerting](https://www.g2.com/products/ebpf-server-security-uptime-monitoring-on-call-alerting/reviews) AlertKick combines server security and uptime monitoring in one product. A lightweight eBPF agent for Linux detects intrusions, file changes, rootkits, and SSH activity (login alerts, failed-attempt auto-blocking, maintenance lock), with detections mapped to MITRE ATT&CK and AI triage that attaches a written verdict to each alert. External monitors check HTTP, TCP, and DNS from outside the network, with response-time thresholds, SSL certificate expiry, and domain expiry from live registry RDAP data. Heartbeat monitors catch silent cron and backup failures, and public status pages keep users informed. Alerts flow through escalation policies and on-call rosters to email, Slack, Telegram, WhatsApp, SMS, and phone calls. Server changes are recorded and attributed for compliance evidence, with PCI DSS and SOX reports on Business plans. Setup is a one-line install per server. The free plan includes 10 uptime monitors and heartbeats - no card, commercial use allowed. #### Who Is the Company Behind eBPF Server security, uptime monitoring, on-call alerting? - **Seller:** [AlertKick](https://www.g2.com/sellers/alertkick) - **Year Founded:** 2026 - **HQ Location:** London, GB - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=4c48068fbcaca5767f22f0cbf4d9e7b47b8f7cf2898e275488c90108d755703d&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Falertkick-ltd&secure%5Burl_type%5D=linkedin_company_website) 1 employees on LinkedIn® ### [empow](https://www.g2.com/products/empow/reviews) empow's security platform radically upends traditional approaches by integrating with your existing network infrastructure and breaking down your security tools into their individual components. #### Who Is the Company Behind empow? - **Seller:** [empow](https://www.g2.com/sellers/empow) - **Year Founded:** 2012 - **HQ Location:** San Diego, US - **Twitter:** @empowcyber 182 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=03149c252fb4c6ebe7983f842da7d6e8d1c855b9c94863a94d7cd0700856b800&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fcybereason&secure%5Burl_type%5D=linkedin_company_website) 624 employees on LinkedIn® ### [Event Manager](https://www.g2.com/products/helpsystems-event-manager/reviews) A Key Part of FoA Key Part of Fortra (the new face of HelpSystems) PowertechX is proud to be part of Fortra’s comprehensive cybersecurity portfolio. Fortra simplifies today’s complex cybersecurity landscape by bringing complementary products together to solve problems in innovative ways. These integrated, scalable solutions address the fast-changing challenges you face in safeguarding your organization. With the help of the powerful protection from Event Manager and others, Fortra is your relentless ally, here for you every step of the way throughout your cybersecurity journey. #### Who Is the Company Behind Event Manager? - **Seller:** [Fortra](https://www.g2.com/sellers/fortra) - **Year Founded:** 1982 - **HQ Location:** Eden Prairie, Minnesota - **Twitter:** @fortraofficial 2,773 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=dc35b82a1c8dc3d25f0baa190554ddab56d530c99dfc134038201f775fd252f8&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Ffortra&secure%5Burl_type%5D=linkedin_company_website) 1,755 employees on LinkedIn® ### [eVigilPro](https://www.g2.com/products/evigilpro/reviews) eVigilPro offers direct analysis of security events generated by computer hardware, network, and applications. It detects anomalies and policy violations through real-time monitoring and stops them by reconfiguring other enterprise security controls. eVigilPro comes with Advanced correlation engine to help analyze large amount of event data for a deeper insight on threats against sensitive data and assets. It provides infrastructure-wide visibility to identify critical threats, respond intelligently, and to provide continuous compliance monitoring. Thus the SIEM application helps in strengthening your overall security posture and leveraging organization’s security technology investment. #### Who Is the Company Behind eVigilPro? - **Seller:** [Moonshott](https://www.g2.com/sellers/moonshott) - **Year Founded:** 2017 - **HQ Location:** Mumbai, IN - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=eda852bd577039fae9c22be77704f101e046f4771156b8656fa99d6e4530ded4&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fmoonshott%2F&secure%5Burl_type%5D=linkedin_company_website) 2 employees on LinkedIn® ### [GoSecure Titan Managed Security Platform](https://www.g2.com/products/gosecure-titan-managed-security-platform/reviews) While GoSecure Professional Security Services focuses on finding the problems, GoSecure Titan® Managed Security Services make sure to solve them – making GoSecure your ally to consolidate, evolve & thrive. Our service offering includes: • GoSecure Titan® Managed Extended Detection & Response (MXDR) which offers the best-in-class 15-minute response time from threat detection to mitigate with a solution that identifies, blocks, & reports potential breaches. • GoSecure Titan® Vulnerability Management as a Service (VMaaS) helps defend against the constantly changing threat landscape by continuously identifying critical assets, threats and vulnerabilities and working quickly to remediating threats as they arise allowing businesses to get more value from their security and IT operations. • GoSecure Titan® Managed Security Information and Event Monitoring (SIEM) offers advanced security intelligence, comprehensive incident handling, simplified compliance, scalability, threat intelligence integration, and optimized security operations. • GoSecure Titan® Managed Perimeter Defense (MPD) helps organizations address the challenge of monitoring and managing their firewall infrastructure. Whether a single firewall, or hundreds, GoSecure has the skills and resources to manage any size environment. Operating 24x7x365, the GoSecure Security Operations Center (SOC) provides global coverage to keep your firewalls operating at peak efficiency. • GoSecure Titan® Inbox Detection & Response (IDR) gives every user the ability to test any suspicious email. They can finally stop worrying about missing threats, wasting time wondering what to do, or worrying about “crying wolf” too often. With a simple click, employees now become a united force against phishing. GoSecure Titan® IDR is the perfect solution to remediate the phishing problem. Enhance your organization’s cyber defense capabilities GoSecure Titan® Managed Security Services provides industry-leading response and mitigation speeds, essential in today’s rapidly evolving threat landscape. Our services are designed to keep your business safe and secure, ensuring peace of mind in the face of growing cyber threats. **Average Rating:** 3.0/5.0 **Total Reviews:** 1 #### How Do G2 Users Rate GoSecure Titan Managed Security Platform? - **Ease of Use:** 3.3/10 (Category avg: 8.7/10) #### Who Is the Company Behind GoSecure Titan Managed Security Platform? - **Seller:** [GoSecure Inc.](https://www.g2.com/sellers/gosecure-inc) - **Company Website:** gosecure.net - **Year Founded:** 2002 - **HQ Location:** La Jolla, US - **Twitter:** @GoSecure\_Inc 2,742 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=a62512f6987b26489553ad53bd8abab93478ced03d2e6cb41b70dbf8b516e868&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fgosecure&secure%5Burl_type%5D=linkedin_company_website) 161 employees on LinkedIn® #### Who Uses This Product? - **Company Size:** 100% Medium ### [Gravwell](https://www.g2.com/products/gravwell/reviews) Gravwell is a log analysis and monitoring platform built on the principle that you need to be able to ask any question of your data and get answers quickly.  To achieve this goal the platform has been built around four pillars - Scalability, Ingestion of any data source, Easy search, and predictable pricing. Scalability: Gravwell is built by supercomputing experts which means scalability and efficiency are where we shine. We easily scale to over 100TB of data ingest per day and have delivered a comparable performance to our competitors with 40% fewer indexers and dramatically less ancillary infrastructure. Ingest any data source: To ask questions of your data you need to ingest it in its raw form; that is why Gravwell is structure on read and will take binary data like netflow, ipfix, and packets natively. Our hybrid indexing system ensures that no matter the data source, you can find needles in the haystack quickly and intuitively. Predictable pricing: If you are ingesting all of your data then you need to know what it is going to cost you. At Gravwell we only charge by the number of indexers in the cluster and don't penalize customers for unexpected data bursts or data sources with less value. Easy search: Learning the query language is quick and easy. At Gravwell we have a structured query language with query writing hints and error identification if something doesn't look quite right. Users who are familiar with Powershell, Linux command line, or SPL are up and running quickly and can become experts in days not months. #### Who Is the Company Behind Gravwell? - **Seller:** [Gravwell](https://www.g2.com/sellers/gravwell) - **Year Founded:** 2017 - **HQ Location:** Coeur dAlene, US - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=2b20df249679a039cd930cfa7fbc723997d67143e0698405a899cb952febde6d&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fgravwell&secure%5Burl_type%5D=linkedin_company_website) 22 employees on LinkedIn® ### [Kaspersky SIEM](https://www.g2.com/products/kaspersky-siem/reviews) A high-performance next-generation SIEM solution designed for the centralized collection, analysis and correlation of information security events from various sources, in order to identify cyber incidents and neutralize them in a timely manner. This is a key technology for any organization engaged in building their own SOC . • Cut hardware and virtualization costs by up to 50% and lower TCO with a high-performance, modular SIEM that outperforms legacy solutions and handles hundreds of thousands of EPS per instance. • Access 900+ pre-configured detection rules, updated quarterly with MITRE mapping and response guidance - all developed by Kaspersky SOC, one of the industry’s most experienced threat hunting teams. • Leverage a broad range of Kaspersky and third-party integrations with built-in response options. Our seamless ecosystem offers a single interface for Threat Intelligence, uses endpoint sensors as SIEM agents and delivers integration capabilities unmatched by other vendors. • AI-enhanced components rapidly identify suspicious activity across your infrastructure. They improve detection accuracy, reduce false positives and minimize the impact of cyber incidents, helping to improve MTTD and MTTR for our customers. #### Who Is the Company Behind Kaspersky SIEM? - **Seller:** [Kaspersky](https://www.g2.com/sellers/kaspersky-bce2dc7f-2586-4e87-96da-114de2c40584) - **Year Founded:** 1997 - **HQ Location:** Moscow - **Twitter:** @kasperskylabind 1,291 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=9adfdb759bbc829267203f5e759faa112e92605273b67256b6ef318f8690bf64&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fkaspersky%2F&secure%5Burl_type%5D=linkedin_company_website) 4,576 employees on LinkedIn® - **Phone:** 1-866-328-5700 ### [Lognostic](https://www.g2.com/products/lognostic/reviews) Companion provides Sales Force Automation and e-Detailing solutions for pharmaceutical companies. It solution empowers the systems not only in Technology but also produce insights to the businesses. Companion encompasses functional modules include the complete life-cycle of field force. #### Who Is the Company Behind Lognostic? - **Seller:** [Mavens-I Softech Solutions](https://www.g2.com/sellers/mavens-i-softech-solutions) - **Year Founded:** 2011 - **HQ Location:** Chennai, IN - **Twitter:** @Mavensi\_Mi 19 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=d23edefa90f5a34b713fa7ab4d3bffb390092eec197822677f8dc356a649867b&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fmavens-i-softech-solutions-pvt-ltd&secure%5Burl_type%5D=linkedin_company_website) 172 employees on LinkedIn® ### [LTS Secure SIEM](https://www.g2.com/products/lts-secure-siem/reviews) Detect and Prevent Fraud, Data Leaks and Advanced Internal as well as External Attack for Cyber Infrastructure with Security Orchestration, Automation and Response #### Who Is the Company Behind LTS Secure SIEM? - **Seller:** [LTS Secure](https://www.g2.com/sellers/lts-secure) - **Year Founded:** 2012 - **HQ Location:** Pune, IN - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=9d97cba5b994241dee19a963817bd02dd5458cb88eff4776ee33666fb09691dd&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fltssecure-adaptive-soc-platform-for-cyber-security&secure%5Burl_type%5D=linkedin_company_website) 10 employees on LinkedIn® ### [Moat 360](https://www.g2.com/products/moat-360/reviews) Welcome to MOAT360, the cutting-edge cloud solution designed to evaluate and boost your cybersecurity resilience and compatibility. In our world where cyber threats are always changing, MOAT360 is your pillar of strength. It provides a clear path to improve your organization's defenses from the bottom to the top. #### Who Is the Company Behind Moat 360? - **Seller:** [Coolumba](https://www.g2.com/sellers/coolumba) - **Year Founded:** 2022 - **HQ Location:** 602 12 Ave SW #500, T2R 1J3, Calgary, Canada. - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=7d7b78119955f147b66b602a0e25a2d64b0137acc0ed7765e260b4577c2403b4&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fcoolumba%2F&secure%5Burl_type%5D=linkedin_company_website) 2 employees on LinkedIn® ### [Monikal](https://www.g2.com/products/monikal/reviews) Monikal, the SIEM solution for SMEs, delivers visibility of and insight into ever-changing and fragmented networks, in a way that has never been possible for most organisations before. Not only can it provide logging and monitoring of everything that happens both inside and outside the office, but it can also be used for threat detection and response, alerting you to (potential) issues in real-time. Monikal is like having CCTV for everything digital in your organisation, with the option of including our managed threat detection and response service, which is like having a team of security guards watching over your environment in real-time, and responding to issues as they arise. This service is provided by Securious, a team of cyber security experts based in Exeter, committed to pairing this world-leading technology with a friendly, local service. #### Who Is the Company Behind Monikal? - **Seller:** [Securious](https://www.g2.com/sellers/securious) - **Year Founded:** 2007 - **HQ Location:** Exeter, GB - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=4988fbe810c1a9486472054e7b0b3be481e66cd38cddc1f42dc3cd4936a24dc9&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fsecurious-network-services-limited%2F&secure%5Burl_type%5D=linkedin_company_website) 11 employees on LinkedIn® ### [NightShift SIEM](https://www.g2.com/products/nightshift-siem/reviews) NightShift is an AI-native software platform that helps CTOs, CIOs, and technical founders understand and manage cybersecurity risk across the technology environment their organization depends on. Built for organizations where security matters but team capacity is limited, NightShift flags emerging risks, ranks them by business impact and technical severity, and provides evidence-backed reports for leadership, customers, partners, investors, and compliance reviews. #### Who Is the Company Behind NightShift SIEM? - **Seller:** [Digital Trust AS](https://www.g2.com/sellers/digital-trust-as) - **Year Founded:** 2023 - **HQ Location:** Oslo, NO - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=f141a021b67cb870c83aacad0b7d42c30d2b2863470b17027084401fd3b2647b&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fnightshift-technology%2F&secure%5Burl_type%5D=linkedin_company_website) 1 employees on LinkedIn® ### [nPro AI](https://www.g2.com/products/npro-ai/reviews) Npro AI is a converged security platform that unifies Extended Detection and Response (XDR) with Security Information and Event Management (SIEM). It provides a single point of truth for threat detection, incident response, and regulatory compliance across on-premises, cloud, and containerized environments. By combining Log Data Analysis with File Integrity Monitoring (FIM) and Vulnerability Detection, Npro AI offers deep visibility into system changes and security posture. The platform is designed for active defense, utilizing an Active Response engine to automatically block malicious connections or terminate processes in real-time. #### Who Is the Company Behind nPro AI? - **Seller:** [NPRO TECH](https://www.g2.com/sellers/npro-tech) - **Year Founded:** 2025 - **HQ Location:** Sunnyvale, US - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=b7b7b74ca0b09976736d30a146a0d7e9fec8ac1201a4bb3a23aa1056e7132511&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fnpro-ai%2F&secure%5Burl_type%5D=linkedin_company_website) 4 employees on LinkedIn® - [‹ Prev‹ Prev](/categories/security-information-and-event-management-siem?order=g2_score&page=6#product-list) - [1](/categories/security-information-and-event-management-siem?order=g2_score#product-list) - [2](/categories/security-information-and-event-management-siem?order=g2_score&page=2#product-list) - [3](/categories/security-information-and-event-management-siem?order=g2_score&page=3#product-list) - [4](/categories/security-information-and-event-management-siem?order=g2_score&page=4#product-list) - [5](/categories/security-information-and-event-management-siem?order=g2_score&page=5#product-list) - [6](/categories/security-information-and-event-management-siem?order=g2_score&page=6#product-list) - 7 - [8](/categories/security-information-and-event-management-siem?order=g2_score&page=8#product-list) - [9](/categories/security-information-and-event-management-siem?order=g2_score&page=9#product-list) - [Next ›Next ›](/categories/security-information-and-event-management-siem?order=g2_score&page=8#product-list) Spotlight Categories [Revenue Operations & Intelligence (RO&I) Software](https://www.g2.com/categories/revenue-operations-intelligence-ro-i) [Accounts Payable Automation Software](https://www.g2.com/categories/ap-automation) [Knowledge Base Software](https://www.g2.com/categories/knowledge-base-software) [CRM Software](https://www.g2.com/categories/crm) [Digital Experience Platforms (DXP)](https://www.g2.com/categories/digital-experience-platforms-dxp) Similar Categories - [Incident Response](/categories/incident-response) - [Threat Intelligence](/categories/threat-intelligence) - [AI SOC Agents](/categories/ai-soc-agents) - [Breach and Attack Simulation (BAS)](/categories/breach-and-attack-simulation-bas) - [Deception Technology](/categories/deception-technology) - [Digital Forensics](/categories/digital-forensics) - [Digital Risk Protection (DRP) Platforms](/categories/digital-risk-protection-drp-platforms) - [IoT Security Solutions](/categories/iot-security-solutions) - [Malware Analysis Tools](/categories/malware-analysis-tools) - [Managed Detection and Response (MDR)](/categories/managed-detection-and-response-mdr) - [OT Secure Remote Access](/categories/ot-secure-remote-access) - [OT Security Tools](/categories/ot-security-tools) - [Red Teaming Tools](/categories/red-teaming-tools) - [Security Orchestration, Automation, and Response (SOAR)](/categories/security-orchestration-automation-and-response-soar) [Browse Security Information and Event Management (SIEM) Themes](/categories/security-information-and-event-management-siem/themes) ![Brandon Summers-Miller](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Brandon Summers-Miller") BS Researched and written by [Brandon Summers-Miller](https://research.g2.com/insights/author/brandon-summers-miller) Updated October 31, 2024 Security information and event management (SIEM) software combines a variety of security software components into one platform. Companies use SIEM solutions to centralize security operations into a single location. IT and security operations teams can gain access to the same information and alerts for more effective communication and planning. These products provide capabilities to identify and alert IT operations teams of anomalies detected in their systems. The anomalies may be new malware, unapproved access, or newly discovered vulnerabilities. SIEM tools provide live analysis of functionality and security, storing logs and records for retrospective reporting. They also have products for identity and access management to ensure only approved parties have access to sensitive systems. Forensic analysis tools help teams navigate historical logs, identify trends, and better fortify their networks. SIEM systems may be confused with [incident response](https://www.g2.com/categories/incident-response) software, but SIEM products provide a larger scope of security and IT management features. Most also do not have the ability to automate security remediation practices. To qualify for inclusion in the SIEM category, a product must: - Aggregate and store IT security data - Assist in user provisioning and governance - Identify vulnerabilities in systems and endpoints - Monitor for anomalies within an IT system Show More * * * ## How Do You Choose the Right Security Information and Event Management (SIEM) Software? ### What You Should Know About SIEM Software ### What is security information and event management (SIEM) software? Security Information and Event Management (SIEM) is a centralized system for threat detection that aggregates security alerts from multiple sources, simplifying threat response and compliance reporting. SIEM software is one of the most commonly used tools for security administrators and security incident response professionals. They provide a single platform capable of facilitating event and threat protection, log analysis and investigation, and threat remediation. Some cutting-edge tools provide additional functionality for creating response workflows, data normalization, and advanced threat protection. SIEM platforms help security programs operate by collecting security data for future analysis, storing these data points, correlating them to security events, and facilitating analysis of those events. Security teams can define rules for typical and suspicious activities with SIEM tools. Advanced Next-Gen SIEM solutions leverage [machine learning](https://www.g2.com/articles/what-is-machine-learning) and [AI](https://www.g2.com/articles/what-is-artificial-intelligence) to refine behavior models continuously, enhancing [User and Entity Behavior Analytics (UEBA)](https://www.g2.com/categories/user-and-entity-behavior-analytics-ueba) and reducing false positives. These systems analyze data against set rules and behavioral patterns, flagging notable events when anomalies are detected. Companies using SIEM solutions deploy sensors across digital assets to automate data collection. Sensors relay information back to the SIEM’s log and event database. When additional security incidents arise, the SIEM platform detects anomalies. It correlates similar logs to provide context and threat information for security teams as they attempt to remediate any existing threats or vulnerabilities. #### **What does SIEM stand for?** SIEM stands for security information and event management (SIEM), which is a combination of two different acronyms for security technology: security information monitoring (SIM) and security event management (SEM). SIM is the practice of collecting, aggregating, and analyzing security data, typically in the form of logs. SIM tools automate this process and document security information for other sources, such as [intrusion detection systems](https://www.g2.com/categories/intrusion-detection-and-prevention-systems-idps), [firewalls](https://www.g2.com/categories/firewall-software), or [routers](https://www.g2.com/categories/routers). Event logs and their associated informational components are recorded and stored for long periods for either retrospective analysis or compliance requirements. SEM is a family of security software for discovering, analyzing, visualizing, and responding to threats as they arise. SEM is a core component of a security operations system. While SIM tools are designed for log collection and storage, SEM tools typically rely on SQL databases to store specific logs and other event data as they are generated in real time by security devices and IT systems. They usually also provide the functionality to correlate and analyze event data, monitor systems in real time, and alert security teams of abnormal activity. SIEM combines the functionality of SIM and SEM to centralize control over log storage, event management, and real-time analysis. SIM and SEM have become defunct technologies, as SIEM’s rise has provided dual-purpose functionality. SIEM vendors offer a single tool capable of performing data aggregation, information correlation, and event management. ### Types of SIEM solutions #### **Traditional SIEM** Traditional SIEM tools are deployed on-premises with sensors placed on IT assets to analyze events and collect system logs. The data is used to develop baseline references and identify indicators of compromise. The SIEM product alerts security teams for intervention when a system becomes compromised.  #### **Cloud or virtual SIEM** Cloud-based and virtualized SIEM software are tools typically used to secure cloud infrastructure and services a cloud provider delivers. These tools are often less expensive than on-premises solutions and more accessible to implement, as no physical labor is required. They are ideal for companies without local IT infrastructure. #### [**Managed SIEM services**](https://www.g2.com/categories/managed-siem-services) Companies that do not have a full-fledged security program may choose managed SIEM services to aid in management and reduce work for internal employees. These SIEM services are delivered by managed service providers who provide the customer data and dashboards with security information and activity, but the provider handles implementation and remediation.  ### What are the common features of SIEM systems? The following are some core features within SIEM software that can help users collect security data, analyze logs, and detect threats: **Activity monitoring:** SIEM systems document the actions from endpoints within a network. The system alerts users of incidents and abnormal activities and documents the access point. Real-time tracking will document these for analysis as an event takes place. **Asset management:** These SIEM features keep records of each network asset and its activity. The feature may also refer to the discovery of new assets accessing the network. **Log management:** This functionality documents and stores event logs in a secure repository for reference, analysis, or compliance reasons. **Event management:** As events occur in real time, the SIEM software alerts users of incidents. This allows security teams to intervene manually or trigger an automated response to resolve the issue. [**Automated response**](https://www.g2.com/categories/security-information-and-event-management-siem/f/automated-response) **:** Response automation reduces the time spent diagnosing and resolving issues manually. The features are typically capable of quickly resolving common network security incidents. **Incident reporting:** Incident reports document cases of abnormal activity and compromised systems. These can be used for forensic analysis or as a reference point for future incidents. **Threat intelligence:** Threat intelligence feeds integrate information to train SIEM systems to detect emerging and existing threats. These threat feeds store information related to potential threats and vulnerabilities to ensure issues are discovered and teams are provided with the information necessary to resolve the problems as they occur. [**Vulnerability assessment**](https://www.g2.com/categories/security-information-and-event-management-siem/f/vulnerability-assessment) **:** Vulnerability assessment tools may scan networks for potential vulnerabilities or audit data to discover non-compliant practices. Mainly, they’re used to analyze an existing network and IT infrastructure to outline access points that can be easily compromised. [**Advanced analytics**](https://www.g2.com/categories/security-information-and-event-management-siem/f/advanced-analytics) **:** Advanced analytics features allow users to customize analysis with granular or individually specific metrics pertinent to the business’ resources. [**Data examination**](https://www.g2.com/categories/security-information-and-event-management-siem/f/data-examination) **:** Data examination features typically facilitate the forensic analysis of incident data and event logs. These features allow users to search databases and incident logs to gain insights into vulnerabilities and incidents. ### What are the benefits of using SIEM products? Below are a few of the main reasons SIEM software is commonly used to protect businesses of all sizes: **Data aggregation and correlation:** SIEM systems and companies collect vast amounts of information from an entire network environment. This information is gathered from virtually anything interacting with a network, from endpoints and servers to firewalls and antivirus tools. It is either given directly to the SIEM or using agents (decision-making programs designed to identify irregular information). The platform is set up to deploy agents and collect and store similar information together according to security policies set in place by administrators. **Incident alerting:** As information comes in from a network’s various connected components, the SIEM system correlates it using rule-based policies. These policies inform agents of normal behavior and threats. If any action violates these policies or malware or intrusion is discovered. At the same time, the SIEM platform monitors network activity; it is labeled as suspicious, security controls restrict access, and administrators are alerted. **Security analysis:** Retrospective analysis may be performed by searching log data during specific periods or based on specific criteria. Security teams may suspect a certain misconfiguration or kind of malware caused an event. They may also suspect an unapproved party went undetected at a specific time. Teams will analyze the logs and look for specific characteristics in the data to determine whether their suspicion was right. They may also discover vulnerabilities or misconfigurations that leave them susceptible to attack and remediate them. ### Software related to SIEM tools Many network and system security solutions involve collecting and analyzing event logs and security information. SIEM systems are typically the most all-encompassing solutions available, but many other security solutions may integrate with them for added functionality or complementary use. These are a few different technology categories related to SIEM software. [Threat intelligence software](https://www.g2.com/categories/threat-intelligence) **:** Threat intelligence software is an informational service that provides SIEM tools and other information security systems with up-to-date information on web-based threats. They can inform the system of zero-day threats, new forms of malware, potential exploits, and different kinds of vulnerabilities. [Incident response software](https://www.g2.com/categories/incident-response) **:** SIEM systems may facilitate incident response, but these tools are specifically designed to streamline the remediation process or add investigative capabilities during security workflow processes. Incident response solutions will not provide the same compliance maintenance or log storage capabilities. Still, they can be used to increase a team’s ability to tackle threats as they emerge. [Network security policy management (NSPM) software](https://www.g2.com/categories/network-security-policy-management-nspm) **:** NSPM software has some overlapping functionality to ensure security hardware and IT systems are correctly configured but cannot detect and resolve threats. They are typically used to ensure devices like firewalls or DNS filters are functioning correctly and in alignment with the security rules put in place by security teams. [Intrusion detection and prevention systems (IDPS)](https://www.g2.com/categories/intrusion-detection-and-prevention-systems-idps) **:** While SIEM systems specialize in log management, alerting, and correlation, IDPS provide additional detection and protection features to prevent unapproved parties from accessing sensitive systems and network breaches. However, they will not facilitate the analysis and forensic investigation of logs with the same level of detail as an SIEM system. [Managed security services providers](https://www.g2.com/categories/managed-security-services) **:** Various managed security services are available for businesses without the resources or staff necessary to operate a full-fledged security administration and operations team. Managed services are a viable option and will provide companies with skilled staff to protect their customers’ systems and keep their sensitive information protected. ### Challenges with SIEM software **Staffing:** There is an existing shortage of skilled security professionals. Managing SIEM products and maintaining a well-rounded security posture requires dedicated personnel with highly specialized skills. Some smaller or growing companies may not have the means to recruit, hire, and retain qualified security pros. In such cases, businesses can consider managed services to outsource the labor.  **Compliance:** Some industries have specific compliance requirements determined by various governing bodies, but SIEM software can be used across several industries to maintain compliance standards. Many industry-specific compliance requirements exist, but most require security teams to protect sensitive data, restrict access to unapproved parties, and monitor changes made to identities, information, or privileges. For example, SIEM systems can maintain GDPR compliance by verifying security controls and data access, facilitating long-term storage of log data, and notifying security staff of security incidents, as GDPR requires. ### Which companies should buy SIEM solutions? **Vertical industries:** Vertical industries, such as healthcare and financial services, often have additional compliance requirements related to data protection and privacy. SIEM is an ideal solution for outlining requirements, mapping threats, and remediating vulnerabilities.  **SaaS business:** SaaS businesses utilizing resources from a cloud service provider are still responsible for a significant portion of the security efforts required to protect a cloud-native business. These companies may jump for cloud-native SIEM tools but will benefit from any SIEM to prevent, detect, and respond to threats.  ### How to choose the best SIEM software #### Requirements Gathering (RFI/RFP) for Security Information and Event Management (SIEM) Software The first step to purchasing a SIEM solution is to outline the options. Companies should be sure whether they need a cloud-based or on-premises solution. They should also outline the number of interconnected devices they need and whether they want physical or virtual sensors to secure them. Additional and possibly obvious requirements should include budgetary considerations, staffing limitations, and required integrations_. _ #### **Compare Security Information and Event Management (SIEM) Software Products** ##### **Create a long list** Once the requirements are outlined, buyers should prioritize the tools and identify the ones with as many features as possible that fit the budget window. It is recommended to restrict the list to products with desired features, pricing, and deployment methods to identify a dozen or so options. For example, if the business needs a cloud-native SIEM for less than $10k a year, half of the SIEM options will be eliminated.  When choosing a SIEM provider, focus on the vendor’s experience, reputation, and specific functionality relevant to your security needs. Core capabilities ensure essential threat detection, while next-gen features add advanced intelligence and automation, allowing for a more proactive security posture. Here’s a breakdown to guide your selection: **Core SIEM capabilities** - Threat detection: Look for SIEMs with robust threat detection, which uses rules and behavioral analytics, along with threat feed integration, to accurately identify potential threats. - Threat intelligence and security alerting: Leading SIEMs incorporate threat intelligence feeds, aggregate security data, and alert you when suspicious activities are detected, ensuring real-time updates on evolving threats. - Compliance reporting: Compliance support is crucial, especially for meeting standards like HIPAA, PCI, and FFIEC. SIEMs streamline compliance assessment and reporting, helping prevent costly non-compliance. - Real-time notifications: Swift alerts are vital; SIEMs that notify you of breaches immediately enable faster responses to potential threats. - Data aggregation: A centralized view of all network activities ensures no area is left unmonitored, which is crucial for comprehensive threat visibility as your organization scales. - Data normalization: SIEMs that normalize incoming data make it easier to analyze security events and extract actionable insights from disparate sources. **Next-gen SIEM capabilities** - Data collection and management: Next-gen SIEMs pull data from the cloud, on-premises, and external devices, consolidating insights across the entire IT environment. - Cloud delivery: Cloud-based SIEMs use scalable storage, accommodating large data volumes without the limitations of on-premises hardware. - User and entity behavior analytics (UEBA): By establishing normal user behavior and identifying deviations, UEBA helps detect insider threats and new, unknown threats. - Security orchestration and automation response (SOAR): SOAR automates incident response, integrates with IT infrastructure, and enables coordinated responses across firewalls, email servers, and access controls. - Automated attack timelines: Next-gen SIEMs automatically create visual attack timelines, simplifying investigation and triage, even for less experienced analysts. Selecting an SIEM vendor with both core and next-gen capabilities offers your organization a comprehensive and agile approach to security, meeting both current and future requirements. ##### **Create a short list** Narrowing down a short list can be tricky, especially for the indecisive, but these decisions must be made. Once the long list is limited to affordable products with the desired features, it’s time to search for third-party validation. For each tool, the buyer must analyze end-user reviews, analyst reports, and empirical security evaluations. Combining these specified factors should help rank options and eliminate poorly performing products. _ _ ##### **Conduct demos** With the list narrowed down to three to five possible products, businesses can contact vendors and schedule demos. This will help them get first-hand experience with the product, ask targeted questions, and gauge the vendors' quality of service.  Here are some essential questions to guide your decision: - Will the tool enhance log collection and management?: Effective log collection is foundational. Look for compatible software across systems and devices, offering a user-friendly dashboard for streamlined monitoring. - Does the tool support compliance efforts? Even if compliance isn't a priority, choosing an SIEM that facilitates auditing and reporting can future-proof your operations. Look for tools that simplify compliance processes and reporting. - Can the tool leverage past security events in threat response? One of SIEM’s strengths is using historical data to inform future threat detection. Ensure the tool offers in-depth analytics and drill-down capabilities to analyze and act on past incidents. - Is the incident response fast and automated? Timely, effective responses are critical. The tool should provide customizable alerts that notify your team immediately when needed so you can confidently leave the dashboard.  #### Selection of Security Information and Event Management (SIEM) Software ##### **Choose a selection team** Decision-makers need to involve subject matter experts from all teams that will use the system in choosing a selection team. For backup software, this primarily involves product managers, developers, IT, and security staff. Any manager or department-level leader should also include individuals managing any solution the backup product will be integrating with.  ##### **Negotiation** The seniority of the negotiation team may vary depending on the maturity of the business. It is advisable to include relevant directors or managers from the security and IT departments as well as from any other cross-functional departments that may be impacted. ##### **Final decision** If the company has a chief information security officer (CISO), that individual will likely decide. If not, companies must trust their security professionals’ ability to use and understand the product.  ### How much does SIEM software cost? Potential growth should be considered if the buyer chooses a cloud-based SIEM tool that offers pricing on the SaaS pay-as-you-use model. Some solutions are inexpensive at the start and offer affordable, low-tier pricing. Alternatively, some may rapidly increase pricing and fees as the company and storage need to scale. Some vendors provide permanently free backup products for individuals or small teams. **Cloud SIEM_:_** SIEM as a service pricing may vary, but it traditionally scales as storage increases. Additional costs may come from increased features such as automated remediation, security orchestration, and integrated threat intelligence.  **On-premises SIEM:** On-premises solutions are typically more expensive and require more effort and resources. They will also be more costly to maintain and require dedicated staff. Still, companies with high compliance requirements should adopt on-premises security regardless.  #### Return on Investment (ROI) Cloud-based SIEM solutions will provide a quicker ROI, similar to their lower average cost. The situation is pretty cut and dry since there is much lower initial investment and lower demand for dedicated staffing.  However, for on-premises systems, the ROI will depend on the scale and scope of business IT systems. Hundreds of servers will require hundreds of sensors, potentially more, as time wears on computing equipment. Once implemented, they must be operated and maintained by (expensive) security professionals.