# Best Security Information and Event Management (SIEM) Software Solutions - Page 2 *By [Brandon Summers-Miller](https://research.g2.com/insights/author/brandon-summers-miller)* Security information and event management (SIEM) software combines a variety of security software components into one platform. Companies use SIEM solutions to centralize security operations into a single location. IT and security operations teams can gain access to the same information and alerts for more effective communication and planning. These products provide capabilities to identify and alert IT operations teams of anomalies detected in their systems. The anomalies may be new malware, unapproved access, or newly discovered vulnerabilities. SIEM tools provide live analysis of functionality and security, storing logs and records for retrospective reporting. They also have products for identity and access management to ensure only approved parties have access to sensitive systems. Forensic analysis tools help teams navigate historical logs, identify trends, and better fortify their networks. SIEM systems may be confused with [incident response](https://www.g2.com/categories/incident-response) software, but SIEM products provide a larger scope of security and IT management features. Most also do not have the ability to automate security remediation practices. To qualify for inclusion in the SIEM category, a product must: - Aggregate and store IT security data - Assist in user provisioning and governance - Identify vulnerabilities in systems and endpoints - Monitor for anomalies within an IT system ## Top Security Information and Event Management (SIEM) Software at a Glance | # | Product | Rating | Best For | What Users Say | |---|---------|--------|----------|----------------| | 1 | [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) | 4.6/5.0 (417 reviews) | Behavioral threat detection with real-time endpoint response | "[Crowdstrike Falcon: Proactive Security, Steep Learning Curve](https://www.g2.com/survey_responses/crowdstrike-falcon-endpoint-protection-platform-review-12958852)" | | 2 | [ManageEngine ADAudit Plus](https://www.g2.com/products/manageengine-adaudit-plus/reviews) | 4.6/5.0 (59 reviews) | — | "[Easy Setup, Powerful Reporting, and Great Value](https://www.g2.com/survey_responses/manageengine-adaudit-plus-review-12999020)" | | 3 | [Sumo Logic](https://www.g2.com/products/sumo-logic/reviews) | 4.3/5.0 (391 reviews) | Cloud-native SIEM with unified observability | "[Centralized Logging with Intuitive Dashboards](https://www.g2.com/survey_responses/sumo-logic-review-12948839)" | | 4 | [Microsoft Sentinel](https://www.g2.com/products/microsoft-sentinel/reviews) | 4.4/5.0 (273 reviews) | Cloud-native SIEM with Microsoft ecosystem integration | "[Easy Log Ingestion Across Formats with Seamless Sentinel Integrations](https://www.g2.com/survey_responses/microsoft-sentinel-review-13073395)" | | 5 | [Todyl Security Platform](https://www.g2.com/products/todyl-security-platform/reviews) | 4.7/5.0 (106 reviews) | Unified SIEM with embedded MXDR for MSPs | "[Valuable Visibility with Room for Improvement](https://www.g2.com/survey_responses/todyl-security-platform-review-9155307)" | | 6 | [Check Point Infinity Platform](https://www.g2.com/products/check-point-infinity-platform/reviews) | 4.6/5.0 (109 reviews) | Unified threat prevention across hybrid security infrastructure | "[Excellent option Harmony Platform for security central](https://www.g2.com/survey_responses/check-point-infinity-platform-review-11868343)" | | 7 | [Splunk Enterprise](https://www.g2.com/products/splunk-enterprise/reviews) | 4.3/5.0 (415 reviews) | Real-time log correlation with SPL query power | "[Excellent Enterprise Observability and Log Management Solution for Hybrid Cloud Infrastructure](https://www.g2.com/survey_responses/splunk-enterprise-review-12045230)" | | 8 | [Panther](https://www.g2.com/products/panther/reviews) | 4.7/5.0 (49 reviews) | Detection-as-code SIEM with Python-based alerting | "[Panther’s SIEM + AI Makes Triage and Threat Hunting Fast and Seamless](https://www.g2.com/survey_responses/panther-review-12919421)" | | 9 | [IBM QRadar SIEM](https://www.g2.com/products/ibm-ibm-qradar-siem/reviews) | 4.4/5.0 (282 reviews) | Vendor-agnostic log correlation with custom rule creation | "[QRADAR Integrates Easily and Makes Logs & Alerts Report-Ready](https://www.g2.com/survey_responses/ibm-qradar-siem-review-13061810)" | | 10 | [Elastic Security](https://www.g2.com/products/elastic-elastic-security/reviews) | 4.5/5.0 (23 reviews) | Unified SIEM and EDR with ECS normalization | "[Powerful, Customisable Security Platform for Complex Environments](https://www.g2.com/survey_responses/elastic-security-review-12341245)" | --- ## What Are the Most Common Questions About Security Information and Event Management (SIEM) Software? *AI-generated · Last updated: May 26, 2026* ### What Security Information And Event Management Siem tools with the fastest incident response capabilities and automation features for enterprise buyers assessing? Based on G2 reviews, buyers evaluating **Security Information and Event Management (SIEM) Software** consistently call out fast investigation, alert correlation, and automation as the biggest drivers of response speed. According to verified users, Microsoft Sentinel helps teams centralize monitoring and use playbook-based automation, while Todyl Security Platform is frequently praised for responsive MXDR support and automated actions that help teams move quickly. G2 reviewers mention Panther for speeding detection and response through detection-as-code and AI-assisted triage, and Sumo Logic for real-time search and alerting that shortens investigations. Across reviews, the fastest response experiences usually come from products that reduce manual triage, centralize visibility, and make alerts easier to act on. **Here are some of the top-rated products on G2:** - [Todyl Security Platform](https://www.g2.com/products/todyl-security-platform/reviews) – praised for MXDR support, automated response actions, and centralized security operations for MSPs and lean teams - [Sumo Logic](https://www.g2.com/products/sumo-logic/reviews) – valued for real-time search, alerting, and faster root-cause analysis during incidents - [Panther](https://www.g2.com/products/panther/reviews) – highlighted for AI triage and detection-as-code that helps small teams investigate and tune detections faster ### What security concerns and data privacy risks when implementing SIEM solutions before signing a long-term vendor contract? Based on G2 reviews, the most common concerns before committing to a SIEM vendor are data handling, deployment complexity, access controls, and cost-related surprises tied to log storage or ingestion. According to verified users, several cloud-native platforms raise questions about cloud dependency, outage exposure, or how much control teams have over data retention and access. G2 reviewers mention that some buyers also watch for gaps in RBAC, missing monitoring for log-source health, and the effort required to normalize or tune data once it is ingested. Reviews also suggest validating how well a product handles integrations, documentation, and reporting, since weak setup guidance or fragmented data can create operational risk after signing a long-term contract. ### What highest rated Security Information And Event Management Siem software SIEM platforms for real-time threat detection in financial services for enterprise teams with? Based on G2 reviews, enterprise teams looking for real-time threat detection typically favor SIEM platforms that combine centralized visibility, alert correlation, and fast investigation workflows. According to verified users, Microsoft Sentinel stands out for cloud-native monitoring across hybrid environments and strong integration with Microsoft security tools. G2 reviewers also describe Splunk Enterprise Security as a strong fit when teams need broad visibility, correlation across large data sets, and structured investigations, while Palo Alto Cortex XSIAM is noted for reducing alert noise and helping analysts focus on higher-priority threats. Across reviews, the strongest options for enterprise environments are the ones that unify logs from many sources, support faster triage, and reduce manual work during ongoing monitoring. ### What Security Information And Event Management Siem top SIEM platforms compared to traditional log management approaches for threat detection? Based on G2 reviews, users draw a clear line between traditional log management and SIEM platforms built for threat detection. Traditional log tools are often praised for centralizing and searching records, but reviewers say SIEM products go further by correlating events, prioritizing suspicious activity, and supporting faster response. According to verified users, products like Microsoft Sentinel, Sumo Logic, and Panther help teams move beyond raw log collection by adding analytics, alerting, automation, and investigation workflows. G2 reviewers mention that the biggest advantage of SIEM over basic log management is context: instead of manually piecing together events from multiple systems, teams get clearer visibility into real threats, less switching between tools, and more structured triage. **Here are some of the top-rated products on G2:** - [Microsoft Sentinel](https://www.g2.com/products/microsoft-sentinel/reviews) – used to centralize logs, detections, and automated response across cloud, on-prem, and hybrid environments - [Sumo Logic](https://www.g2.com/products/sumo-logic/reviews) – combines centralized log management with security monitoring, dashboards, and anomaly detection - [Panther](https://www.g2.com/products/panther/reviews) – supports detection-as-code, AI triage, and flexible investigations beyond basic log search ### What Security Information And Event Management Siem implementation challenges and common deployment failures to avoid for organizations in highly regulated software? Based on G2 reviews, the most common SIEM implementation challenges are setup complexity, integration gaps, alert noise, and underestimating the tuning work required after launch. According to verified users, many platforms work well once deployed, but teams run into trouble when they expect out-of-the-box value without planning for normalization, rule tuning, and onboarding of many log sources. G2 reviewers mention that confusing dashboards, weak documentation, and complicated connector setup can slow adoption, especially for regulated organizations that need dependable reporting and audit readiness. Reviews also show that poor cost planning around data ingestion or retention can become a deployment failure of its own. Teams tend to succeed when they validate integrations early and assign time for alert refinement. ### How Which organizations detect advanced threats and security breaches in real time management? Based on G2 reviews, organizations that detect advanced threats in real time usually rely on platforms that unify endpoint, cloud, identity, and network data rather than monitoring each area in isolation. According to verified users, Todyl Security Platform is frequently described as helping MSPs and lean security teams gain proactive visibility through SIEM, MXDR, and centralized monitoring. G2 reviewers also mention Microsoft Sentinel for hybrid visibility and automated response workflows, while Panther and Palo Alto Cortex XSIAM are noted for reducing alert fatigue and surfacing higher-priority incidents faster. Across reviews, the teams getting the best real-time results are the ones using platforms that correlate activity automatically, support investigation speed, and reduce the manual work of sorting through raw alerts. ### What most trusted SIEM tools by Security Operations Center managers based on user reviews? Based on G2 reviews, SOC managers tend to trust SIEM platforms that consistently improve analyst efficiency, reduce alert noise, and provide clear investigation context. According to verified users, Todyl Security Platform earns trust for its responsive MXDR team, centralized management, and support for MSP and SOC workflows. G2 reviewers also frequently praise Sumo Logic for fast search, observability across environments, and quicker incident troubleshooting, while Panther is trusted for detection-as-code, AI-assisted triage, and strong support for modern security teams. Across reviews, trust is usually tied less to breadth of features alone and more to how reliably a platform helps teams investigate, prioritize, and respond without creating excessive operational overhead. **Here are some of the top-rated products on G2:** - [Todyl Security Platform](https://www.g2.com/products/todyl-security-platform/reviews) – trusted for centralized security workflows, responsive support, and MXDR collaboration - [Sumo Logic](https://www.g2.com/products/sumo-logic/reviews) – trusted for fast search, alerting, and cross-team visibility for operations and security - [Panther](https://www.g2.com/products/panther/reviews) – trusted for modern SecOps workflows, strong support, and AI-powered investigations ### What compliance requirements drive security event monitoring and alerting strategies for organizations evaluating solutions? Based on G2 reviews, compliance needs often shape how organizations evaluate event monitoring, log retention, reporting, and alerting. According to verified users, teams frequently mention audit readiness, security reporting, and visibility into user activity as major reasons for adopting SIEM platforms. G2 reviewers point to use cases tied to compliance reviews, internal audits, and controls tracking, especially where organizations need searchable historical logs, centralized dashboards, and easier evidence collection. Reviews of tools like Sumo Logic, EventSentry, and ManageEngine products show that buyers want alerting that supports both active threat response and proof of oversight. In practice, compliance-driven strategies focus on retaining the right logs, monitoring critical changes, and making reports easier to produce during reviews. ### What SIEM solutions that integrate seamlessly with existing security infrastructure and tools to identify the best? Based on G2 reviews, the best-integrating SIEM solutions are usually the ones that connect quickly to existing cloud services, endpoint tools, and identity or firewall data sources without extensive custom work. According to verified users, Microsoft Sentinel is often chosen for smooth integration across Azure, Microsoft 365, Defender, and Entra environments. G2 reviewers also describe Todyl Security Platform as effective for consolidating multiple security functions and integrating Microsoft, firewall, and remote-access use cases, while Sumo Logic is praised for broad cloud integrations and centralized monitoring. Across reviews, strong integration usually means faster onboarding, better visibility across the environment, and less time spent stitching together separate dashboards during investigations. ### How what are the main challenges with managing security logs across multiple systems? Based on G2 reviews, the biggest challenge with managing security logs across multiple systems is fragmentation. According to verified users, teams lose time when logs live in separate tools, use different schemas, or require manual correlation during investigations. G2 reviewers mention that alert noise, missed context, and inconsistent normalization also make it harder to spot meaningful issues quickly. Cost management is another recurring issue, especially when ingestion and retention grow faster than expected. Reviews repeatedly show that teams want one place to search, correlate, and retain logs without babysitting many connectors or switching dashboards. In practice, the hardest part is not collecting logs alone, but making them searchable, consistent, and actionable enough to support faster threat detection and response. ## G2 Grid® for Security Information and Event Management (SIEM) Software ![G2 Grid® for Security Information and Event Management (SIEM) Software plotting products by satisfaction and market presence](https://www.g2.com/categories/security-information-and-event-management-siem/grids.png?focus%5B%5D=68606&focus%5B%5D=5691&focus%5B%5D=10436&focus%5B%5D=122123&focus%5B%5D=58203&focus%5B%5D=53174&focus%5B%5D=112657&focus%5B%5D=2965) Highlighted products: CrowdStrike Falcon Endpoint Protection Platform, ManageEngine ADAudit Plus, Sumo Logic, Microsoft Sentinel, Check Point Infinity Platform, Todyl Security Platform, Panther, and Splunk Enterprise. Underlying data: [Grid® JSON](https://www.g2.com/categories/security-information-and-event-management-siem/grids.json?focus%5B%5D=crowdstrike-falcon-endpoint-protection-platform&focus%5B%5D=manageengine-adaudit-plus&focus%5B%5D=sumo-logic&focus%5B%5D=microsoft-sentinel&focus%5B%5D=check-point-infinity-platform&focus%5B%5D=todyl-security-platform&focus%5B%5D=panther&focus%5B%5D=splunk-enterprise) ## How Many Security Information and Event Management (SIEM) Software Products Does G2 Track? **Total Products under this Category:** 119 ### Category Stats (Jul 2026) - **Average Rating**: 4.43/5 (↓0.01 vs Jun 2026) The average rating of products in this category, based on all submitted ratings - **Top Trending Product**: ManageEngine ADAudit Plus (+3.84%) - Among all products in this category, ManageEngine ADAudit Plus recorded the largest rating increase compared to last month *Last updated: July 12, 2026* ## How Does G2 Rank Security Information and Event Management (SIEM) Software Products? **Why You Can Trust G2's Software Rankings:** - 30 Analysts and Data Experts - 5,800+ Authentic Reviews - 119+ Products - Unbiased Rankings G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category. ## Which Security Information and Event Management (SIEM) Software Is Best for Your Use Case? - **Leader:** [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) - **Highest Performer:** [aiSIEM](https://www.g2.com/products/aisiem/reviews) - **Easiest to Use:** [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) - **Top Trending:** [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews) - **Best Free Software:** [IBM QRadar SIEM](https://www.g2.com/products/ibm-ibm-qradar-siem/reviews) --- **Sponsored** ### Graylog Graylog is a log management and security information and event management (SIEM) solution designed to assist security and IT teams in detecting, investigating, and responding to potential threats with increased efficiency. By leveraging advanced technologies such as scalable log management, real-time data correlation, and explainable artificial intelligence (AI), Graylog transforms complex data sets into actionable insights, enabling organizations to make informed decisions swiftly. The platform caters to a diverse range of users, from small businesses to large enterprises, all of whom require enhanced visibility and control over their IT environments. Graylog is particularly beneficial for security analysts and IT professionals who need to sift through vast amounts of log data to identify anomalies, track incidents, and ensure compliance with various regulatory standards. Its user-friendly interface and powerful analytical tools streamline the process of threat detection and response, making it an essential asset for organizations aiming to bolster their cybersecurity posture. Key features of Graylog include automated workflows that simplify repetitive tasks, anomaly detection capabilities that flag unusual patterns in data, and guided investigations that assist users in navigating complex security incidents. The platform also offers AI-driven summaries that distill critical information, allowing analysts to focus on high-priority issues without getting bogged down by excessive data. These features collectively enhance the speed and accuracy of threat responses, ensuring that security teams remain in control of their environments. Graylog's versatility is evident in its range of products, which includes Graylog Security, Enterprise, API Security, and Open solutions. Each product is tailored to meet the specific needs of different organizations, providing clarity and context across various operational landscapes. With a user base of over 60,000 organizations globally, Graylog has established itself as a trusted partner in the realm of cybersecurity and log management, helping teams navigate the complexities of modern threats while maintaining a clear focus on their objectives. [Visit website](https://www.g2.com/external_clickthroughs/record?secure%5Bad_program%5D=paid_promo&secure%5Bad_slot%5D=category_product_list&secure%5Bcategory_id%5D=1081&secure%5Bchosen_at%5D=2026-07-12T21%3A31%3A22Z&secure%5Bmedium%5D=sponsored&secure%5Bprioritized%5D=false&secure%5Bproduct_id%5D=42017&secure%5Bresource_id%5D=1081&secure%5Bresource_type%5D=Category&secure%5Bsource_type%5D=category_page&secure%5Bsource_url%5D=https%3A%2F%2Fwww.g2.com%2Fcategories%2Fsecurity-information-and-event-management-siem&secure%5Btoken%5D=8251a5a30bcd2248ecf993b0d779af150a6a0ef16e2383adacb57551f9ef4113&secure%5Burl%5D=https%3A%2F%2Fwww.graylog.org%2Foverview&secure%5Burl_type%5D=paid_promos) --- ## What Are the Top-Rated Security Information and Event Management (SIEM) Software Products in 2026? ### 1. [RunReveal](https://www.g2.com/products/runreveal/reviews) RunReveal is a modern security data platform built for AI-forward security teams. RunReveal unifies logs, data pipelines, detections, AI-investigations, and analytics into one platform, so security teams are no longer stitching together tools to manage and use their security data. The platform ingests from 70+ sources, supports built-in and custom detections, and includes an AI agent for faster and automated investigations. RunReveal also support unlimited ingest, and prices based off of predictable data storage. If you're evaluating your first SIEM, escaping renewal sticker shock, or tired of paying enterprise prices for a SIEM that still require additional tooling, RunReveal gives you a unified platform for log management without the complexity or cost. **Average Rating:** 4.9/5.0 **Total Reviews:** 10 **How Do G2 Users Rate RunReveal?** - **Activity Monitoring:** 10.0/10 (Category avg: 9.1/10) - **Data Examination:** 10.0/10 (Category avg: 8.6/10) - **Ease of Use:** 9.7/10 (Category avg: 8.7/10) - **Log Management:** 9.2/10 (Category avg: 9.1/10) **Who Is the Company Behind RunReveal?** - **Seller:** [RunReveal](https://www.g2.com/sellers/runreveal) - **Company Website:** https://runreveal.com - **Year Founded:** 2023 - **HQ Location:** Austin, US - **LinkedIn® Page:** https://www.linkedin.com/company/runreveal/ (20 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Computer Software - **Company Size:** 50% Mid-Market, 30% Small-Business #### What Are RunReveal's Pros and Cons? **Pros:** - Detection Speed (4 reviews) - Security (4 reviews) - Threat Detection (4 reviews) - Artificial Intelligence (3 reviews) - Features (3 reviews) **Cons:** - Expensive (1 reviews) - Feature Limitations (1 reviews) - Lack of Features (1 reviews) - Limited Features (1 reviews) ### What Do G2 Reviewers Say About RunReveal? *AI-generated summary from verified user reviews* **Pros:** - Users highlight the **rapid detection speed** of RunReveal, significantly enhancing their security investigation and response processes. - Users appreciate the **expertise in security analytics** with RunReveal, enabling efficient investigations and powerful detection capabilities. - Users highlight the **superior threat detection capabilities** of RunReveal, transforming security operations with powerful tools and features. - Users appreciate the **thoughtful AI implementation** in RunReveal, allowing them to focus on essential security tasks effectively. - Users value the **powerful MCP server** , transforming large-scale security investigations and enhancing detection capabilities effortlessly. **Cons:** - Users find RunReveal **expensive** due to vital features being locked behind a paywall, limiting usage in homelabs. - Users feel frustrated by the **feature limitations** in RunReveal's free version, hindering their optimal use in homelabs. - Users express frustration over the **limited features** in the free version of RunReveal, hindering their full usage. - Users express frustration over **limited features** in the free version, restricting their experience and capability in homelabs. #### What Are Recent G2 Reviews of RunReveal? **"[RunReveal Integrations and AI Triage Make Security Findings Easy to Act On](https://www.g2.com/survey_responses/runreveal-review-13022957)"** **Rating:** 5.0/5.0 stars *— Julio J.* [Read full review](https://www.g2.com/survey_responses/runreveal-review-13022957) --- **"[RunReveal is the only SIEM and Detection and Response Platform that is ready for the AI age](https://www.g2.com/survey_responses/runreveal-review-12350471)"** **Rating:** 5.0/5.0 stars *— Verified User in Logistics and Supply Chain* [Read full review](https://www.g2.com/survey_responses/runreveal-review-12350471) --- ### 2. [Graylog](https://www.g2.com/products/graylog/reviews) Graylog is a log management and security information and event management (SIEM) solution designed to assist security and IT teams in detecting, investigating, and responding to potential threats with increased efficiency. By leveraging advanced technologies such as scalable log management, real-time data correlation, and explainable artificial intelligence (AI), Graylog transforms complex data sets into actionable insights, enabling organizations to make informed decisions swiftly. The platform caters to a diverse range of users, from small businesses to large enterprises, all of whom require enhanced visibility and control over their IT environments. Graylog is particularly beneficial for security analysts and IT professionals who need to sift through vast amounts of log data to identify anomalies, track incidents, and ensure compliance with various regulatory standards. Its user-friendly interface and powerful analytical tools streamline the process of threat detection and response, making it an essential asset for organizations aiming to bolster their cybersecurity posture. Key features of Graylog include automated workflows that simplify repetitive tasks, anomaly detection capabilities that flag unusual patterns in data, and guided investigations that assist users in navigating complex security incidents. The platform also offers AI-driven summaries that distill critical information, allowing analysts to focus on high-priority issues without getting bogged down by excessive data. These features collectively enhance the speed and accuracy of threat responses, ensuring that security teams remain in control of their environments. Graylog's versatility is evident in its range of products, which includes Graylog Security, Enterprise, API Security, and Open solutions. Each product is tailored to meet the specific needs of different organizations, providing clarity and context across various operational landscapes. With a user base of over 60,000 organizations globally, Graylog has established itself as a trusted partner in the realm of cybersecurity and log management, helping teams navigate the complexities of modern threats while maintaining a clear focus on their objectives. **Average Rating:** 4.4/5.0 **Total Reviews:** 106 **How Do G2 Users Rate Graylog?** - **Activity Monitoring:** 8.7/10 (Category avg: 9.1/10) - **Data Examination:** 8.3/10 (Category avg: 8.6/10) - **Ease of Use:** 8.5/10 (Category avg: 8.7/10) - **Log Management:** 9.2/10 (Category avg: 9.1/10) **Who Is the Company Behind Graylog?** - **Seller:** [Graylog](https://www.g2.com/sellers/graylog) - **Company Website:** https://www.graylog.org - **Year Founded:** 2009 - **HQ Location:** Houston, US - **Twitter:** @graylog2 (9,115 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/sales/company/2783090?_ntb=deUf18mKRvS5YlRE65XIhw%3D%3D (127 employees on LinkedIn®) **Who Uses This Product?** - **Who Uses This:** Software Engineer - **Top Industries:** Information Technology and Services, Computer Software - **Company Size:** 44% Mid-Market, 31% Small-Business #### What Are Graylog's Pros and Cons? **Pros:** - Cost Optimization (1 reviews) - Debugging (1 reviews) - Detailed Information (1 reviews) - Insights (1 reviews) - Pricing (1 reviews) **Cons:** - Complexity (1 reviews) - Debugging Difficulties (1 reviews) - Integration Issues (1 reviews) - Learning Curve (1 reviews) - Time Consumption (1 reviews) ### What Do G2 Reviewers Say About Graylog? *AI-generated summary from verified user reviews* **Pros:** - Users value the **cost optimization** of Graylog, finding it reliable and compliant with industry standards. - Users value the **detailed information for API debugging** , which significantly aids in resolving complex issues efficiently. - Users value the **detailed API information** from Graylog, essential for navigating complex debugging processes effectively. - Users find that the **detailed API information** in Graylog significantly aids in complex debugging processes. - Users commend Graylog's **reliable and cost-effective pricing** , aligning well with industry standards for optimal performance. **Cons:** - Users find the **complexity** of Graylog can waste time during debugging and API response reviews, hindering efficiency. - Users find that **debugging difficulties** with Graylog can lead to wasted time and complicate their workflow. - Users find **integration issues** with multiple platforms in Graylog, which can hinder overall efficiency. - Users find the **learning curve steep** , often leading to wasted time during debugging and API response reviews. - Users find that the **time consumption** with Graylog can hinder efficiency, especially during debugging and API reviews. #### What Are Recent G2 Reviews of Graylog? **"[Graylog 7.1: Lightweight Upgrade with a Much Easier Collector Experience](https://www.g2.com/survey_responses/graylog-review-12839643)"** **Rating:** 5.0/5.0 stars *— Ludwick M.* [Read full review](https://www.g2.com/survey_responses/graylog-review-12839643) --- **"[Easy to Integrate, Essential for Supervision](https://www.g2.com/survey_responses/graylog-review-12818294)"** **Rating:** 4.5/5.0 stars *— Verified User in Computer & Network Security* [Read full review](https://www.g2.com/survey_responses/graylog-review-12818294) --- #### What Are G2 Users Discussing About Graylog? - [What is your experience with Graylog in managing log data, and what features do you find most useful?](https://www.g2.com/discussions/what-is-your-experience-with-graylog-in-managing-log-data-and-what-features-do-you-find-most-useful) - 1 comment - [What is Graylog used for?](https://www.g2.com/discussions/what-is-graylog-used-for) - [Is Graylog a SIEM?](https://www.g2.com/discussions/is-graylog-a-siem) - [How much does Graylog cost?](https://www.g2.com/discussions/how-much-does-graylog-cost) - [Who uses Graylog?](https://www.g2.com/discussions/who-uses-graylog) ### 3. [EventSentry](https://www.g2.com/products/eventsentry/reviews) EventSentry is a hybrid Security Information and Event Management (SIEM) solution designed to assist users in monitoring and managing their IT infrastructure effectively. By combining real-time event log monitoring with comprehensive system health and network monitoring, EventSentry provides a holistic view of servers and endpoints, enabling organizations to maintain robust security and operational efficiency. This SIEM solution is particularly beneficial for IT security teams, system administrators, and compliance officers who require a centralized platform to oversee their network's security posture. It caters to various industries, including finance, healthcare, and technology, where data integrity and security are paramount. The product is designed for organizations of all sizes, from small businesses to large enterprises, looking to enhance their security monitoring capabilities while ensuring system health. One of the standout features of EventSentry is its security event log normalization and correlation engine. This functionality transforms cryptic Windows security events into easily understandable reports, providing users with valuable insights that go beyond raw event data. The descriptive email alerts generated by the system offer additional context, allowing users to respond swiftly to potential security incidents. This capability is crucial for organizations that need to comply with regulatory requirements and maintain a proactive security stance. Moreover, EventSentry includes 200 compliance and security checks that strengthen security settings and reduce the attack surface - proactively identifying issues before they become liabilities. Malware & Ransomware attacks can be mitigated and detected in real time with innovative process activity monitoring and a flexible anomaly detection engine that can reveal suspicious patterns across any log source. EventSentry supports various integrations, making it adaptable to existing IT environments. This flexibility allows organizations to incorporate the SIEM solution seamlessly into their current systems, enhancing their overall security framework without significant disruption. The multi-tenancy feature further enables organizations to manage multiple clients or departments from a single platform, making it an ideal choice for managed service providers or organizations with diverse operational needs. In summary, EventSentry stands out in the SIEM category by providing a comprehensive approach to security and system monitoring. Its combination of real-time log analysis, health monitoring, and user-friendly reporting equips organizations with the tools necessary to safeguard their digital assets effectively. By leveraging this hybrid SIEM solution, users can achieve a clearer understanding of their security landscape, facilitating informed decision-making and enhancing overall cybersecurity resilience. **Average Rating:** 4.6/5.0 **Total Reviews:** 49 **How Do G2 Users Rate EventSentry?** - **Activity Monitoring:** 9.0/10 (Category avg: 9.1/10) - **Data Examination:** 8.8/10 (Category avg: 8.6/10) - **Ease of Use:** 9.0/10 (Category avg: 8.7/10) - **Log Management:** 9.0/10 (Category avg: 9.1/10) **Who Is the Company Behind EventSentry?** - **Seller:** [NETIKUS.NET ltd](https://www.g2.com/sellers/netikus-net-ltd) - **Company Website:** https://www.eventsentry.com - **Year Founded:** 2002 - **HQ Location:** Chicago, Illinois - **Twitter:** @netikus (971 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/2327447/ (4 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Information Technology and Services, Financial Services - **Company Size:** 54% Mid-Market, 28% Small-Business #### What Are EventSentry's Pros and Cons? **Pros:** - Customer Support (4 reviews) - Alerting System (3 reviews) - Implementation Ease (3 reviews) - Pricing (3 reviews) - Robust Support (3 reviews) **Cons:** - Learning Curve (2 reviews) - Learning Difficulty (2 reviews) - Log Management (2 reviews) - Log Management Issues (2 reviews) - Dashboard Issues (1 reviews) ### What Do G2 Reviewers Say About EventSentry? *AI-generated summary from verified user reviews* **Pros:** - Users commend EventSentry's **exceptional customer support** , noting quick response times and knowledgeable assistance from the team. - Users value the **effective alerting system** of EventSentry, ensuring they stay informed without unnecessary notifications. - Users commend the **easy implementation** of EventSentry, appreciating its low resource requirements and intuitive setup process. - Users commend the **affordable pricing** of EventSentry, noting it offers excellent performance and value for money. - Users value the **world-class support** of EventSentry, consistently receiving quick and knowledgeable responses from the team. **Cons:** - Users find the initial **learning curve steep** , though resources exist to help ease the transition. - Users find the **initial learning curve steep** , but resources are available to help overcome it effectively. - Users find EventSentry's **handling of Linux logs and detection rules lacking** , indicating a need for improvement and modernization. - Users criticize the **log management issues** with EventSentry, noting inadequate handling of Linux logs and detection rules. - Users find the **graphical features for reports** outdated, complicating server selection and management processes. #### What Are Recent G2 Reviews of EventSentry? **"[Cost-Effective Compliance Solution that can pass an audit!](https://www.g2.com/survey_responses/eventsentry-review-12816650)"** **Rating:** 4.5/5.0 stars *— AJ J.* [Read full review](https://www.g2.com/survey_responses/eventsentry-review-12816650) --- **"[Granular Local Monitoring with Deep Security Auditing](https://www.g2.com/survey_responses/eventsentry-review-12895715)"** **Rating:** 4.5/5.0 stars *— Chuck K.* [Read full review](https://www.g2.com/survey_responses/eventsentry-review-12895715) --- #### What Are G2 Users Discussing About EventSentry? - [What is EventSentry used for?](https://www.g2.com/discussions/what-is-eventsentry-used-for) - 1 comment ### 4. [NetWitness Platform](https://www.g2.com/products/netwitness-platform/reviews) NetWitness is a comprehensive threat detection, investigation and response platform that combines visibility, analytics, insight, and automation into a single solution. It collects and analyzes data across all capture points (logs, packets, netflow, endpoint and IoT) and computing platforms (physical, virtual and cloud), enriching data with threat intelligence and business context. **Average Rating:** 3.9/5.0 **Total Reviews:** 23 **How Do G2 Users Rate NetWitness Platform?** - **Activity Monitoring:** 8.3/10 (Category avg: 9.1/10) - **Data Examination:** 8.3/10 (Category avg: 8.6/10) - **Ease of Use:** 7.7/10 (Category avg: 8.7/10) - **Log Management:** 8.6/10 (Category avg: 9.1/10) **Who Is the Company Behind NetWitness Platform?** - **Seller:** [NetWitness](https://www.g2.com/sellers/netwitness) - **Year Founded:** 1997 - **HQ Location:** Bedford, MA - **Twitter:** @Netwitness (1,621 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/netwitness-platform/ (194 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 54% Enterprise, 33% Mid-Market #### What Are NetWitness Platform's Pros and Cons? **Pros:** - Centralized Management (1 reviews) - Cybersecurity (1 reviews) - Features (1 reviews) - Investigation (1 reviews) - Management Console (1 reviews) **Cons:** - Complex Implementation (2 reviews) - Complexity (2 reviews) - Complex Setup (2 reviews) - Deployment Difficulties (2 reviews) - Expertise Required (2 reviews) ### What Do G2 Reviewers Say About NetWitness Platform? *AI-generated summary from verified user reviews* **Pros:** - Users value the **centralized management** of NetWitness Platform, which integrates multiple security tools into one console. - Users value the **centralized view for threat hunting** provided by NetWitness Platform's integrated cybersecurity capabilities. - Users appreciate the **ability to capture full network packets** , enhancing deep forensic investigation capabilities significantly. - Users appreciate the **network packet capture** feature of NetWitness Platform, enhancing their forensic investigation capabilities. - Users value the **centralized capabilities** of the Management Console, enhancing efficiency in threat hunting and reducing tool sprawl. **Cons:** - Users find the **complex implementation** of NetWitness Platform challenging, needing significant expertise and facing difficulties during upgrades. - Users find the **complexity of initial setup** and upgrades challenging, often needing significant technical expertise to navigate. - Users face challenges due to the **complex setup** and deployment of the NetWitness Platform, requiring significant technical expertise. - Users face **deployment difficulties** with the NetWitness Platform, needing extensive technical skills for setup and upgrades. - Users find the **expertise required** for initial deployment and upgrades complicates their overall experience with NetWitness Platform. #### What Are Recent G2 Reviews of NetWitness Platform? **"[All-in-One Security Console for Centralized Threat Hunting](https://www.g2.com/survey_responses/netwitness-platform-review-12381089)"** **Rating:** 5.0/5.0 stars *— Verified User in Information Services* [Read full review](https://www.g2.com/survey_responses/netwitness-platform-review-12381089) --- **"[A Powerhouse in Endpoint, Network, and SIEM Integration.](https://www.g2.com/survey_responses/netwitness-platform-review-11524038)"** **Rating:** 4.0/5.0 stars *— pushpendra Y.* [Read full review](https://www.g2.com/survey_responses/netwitness-platform-review-11524038) --- #### What Are G2 Users Discussing About NetWitness Platform? - [What is one of the biggest differentiators for RSA NetWitness platform?](https://www.g2.com/discussions/what-is-one-of-the-biggest-differentiators-for-rsa-netwitness-platform) - [What types of data can the RSA NetWitness platform capture and process?](https://www.g2.com/discussions/what-types-of-data-can-the-rsa-netwitness-platform-capture-and-process) - [What is NetWitness used for?](https://www.g2.com/discussions/what-is-netwitness-used-for) - 1 comment - [What does RSA NetWitness do?](https://www.g2.com/discussions/what-does-rsa-netwitness-do) ### 5. [Check Point SmartEvent Event Management](https://www.g2.com/products/check-point-smartevent-event-management/reviews) SmartEvent event management provides full threat visibility with a single view into security risks. Take control and command the security event through real-time forensic and event investigation, compliance, and reporting. Respond to security incidents immediately and gain network true insights. Features include: integrated threat management, single view into security risks, customizable views and reports, full threat visibility, and real-time forensic and event investigation. **Average Rating:** 4.4/5.0 **Total Reviews:** 13 **How Do G2 Users Rate Check Point SmartEvent Event Management?** - **Activity Monitoring:** 8.3/10 (Category avg: 9.1/10) - **Data Examination:** 8.0/10 (Category avg: 8.6/10) - **Ease of Use:** 9.0/10 (Category avg: 8.7/10) - **Log Management:** 8.3/10 (Category avg: 9.1/10) **Who Is the Company Behind Check Point SmartEvent Event Management?** - **Seller:** [Check Point Software Technologies](https://www.g2.com/sellers/check-point-software-technologies) - **Year Founded:** 1993 - **HQ Location:** Redwood City, CA - **Twitter:** @CheckPointSW (70,955 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/check-point-software-technologies/ (8,554 employees on LinkedIn®) - **Ownership:** NASDAQ:CHKP **Who Uses This Product?** - **Company Size:** 69% Enterprise, 23% Mid-Market #### What Are Check Point SmartEvent Event Management's Pros and Cons? **Pros:** - Threat Detection (2 reviews) - Visibility (2 reviews) - Alerting (1 reviews) - Ease of Use (1 reviews) - Monitoring (1 reviews) **Cons:** - Complexity (1 reviews) - Deployment Difficulties (1 reviews) - Difficult Learning (1 reviews) - Learning Curve (1 reviews) - Setup Difficulty (1 reviews) ### What Do G2 Reviewers Say About Check Point SmartEvent Event Management? *AI-generated summary from verified user reviews* **Pros:** - Users appreciate the **full threat visibility** of Check Point SmartEvent, enabling quick and informed responses to security risks. - Users appreciate the **full threat visibility** offered by SmartEvent, enabling quick responses to relevant events. - Users appreciate the **effective alerting system** of SmartEvent, providing clarity and context for prompt responses. - Users appreciate the **ease of use** of Check Point SmartEvent, as it simplifies network event management significantly. - Users appreciate the **effective monitoring** of SmartEvent, enabling quick response to relevant events without distractions. **Cons:** - Users find the **initial learning curve steep** , as the overwhelming data complexity can hinder effective alert management. - Users report **deployment difficulties** due to random CPSEMD process terminations causing login failures and high CPU usage. - Users experience **difficult learning** due to random CPSEMD process terminations causing login failures and high CPU usage. - Users find the **learning curve steep** , requiring time to adjust filters for optimal alert relevance in SmartEvent. - Users face **setup difficulties** with Check Point SmartEvent, leading to random process terminations and high CPU usage. #### What Are Recent G2 Reviews of Check Point SmartEvent Event Management? **"[SmartEvent Keeps Us Ahead of the Curve](https://www.g2.com/survey_responses/check-point-smartevent-event-management-review-11790784)"** **Rating:** 4.5/5.0 stars *— D. A.* [Read full review](https://www.g2.com/survey_responses/check-point-smartevent-event-management-review-11790784) --- **"[SmartEvent](https://www.g2.com/survey_responses/check-point-smartevent-event-management-review-11095641)"** **Rating:** 4.5/5.0 stars *— Verified User in Banking* [Read full review](https://www.g2.com/survey_responses/check-point-smartevent-event-management-review-11095641) --- #### What Are G2 Users Discussing About Check Point SmartEvent Event Management? - [What does an event management website do?](https://www.g2.com/discussions/what-does-an-event-management-website-do) - [What are the benefits of event management?](https://www.g2.com/discussions/what-are-the-benefits-of-event-management) - [What is SmartEvent?](https://www.g2.com/discussions/what-is-smartevent) - [What are the features of event management?](https://www.g2.com/discussions/what-are-the-features-of-event-management) ### 6. [Cisco Security Manager](https://www.g2.com/products/cisco-security-manager/reviews) Advanced Security Manager is a computer security software that secures information from unwanted intruders in a computer. **Average Rating:** 4.3/5.0 **Total Reviews:** 21 **How Do G2 Users Rate Cisco Security Manager?** - **Activity Monitoring:** 8.5/10 (Category avg: 9.1/10) - **Data Examination:** 8.0/10 (Category avg: 8.6/10) - **Ease of Use:** 8.8/10 (Category avg: 8.7/10) - **Log Management:** 8.6/10 (Category avg: 9.1/10) **Who Is the Company Behind Cisco Security Manager?** - **Seller:** [Cisco](https://www.g2.com/sellers/cisco) - **Year Founded:** 1984 - **HQ Location:** San Jose, CA - **Twitter:** @Cisco (720,366 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/cisco/ (95,545 employees on LinkedIn®) - **Ownership:** NASDAQ:CSCO **Who Uses This Product?** - **Company Size:** 52% Enterprise, 43% Mid-Market #### What Are Recent G2 Reviews of Cisco Security Manager? **"[Cisco Security Manager](https://www.g2.com/survey_responses/cisco-security-manager-review-7031115)"** **Rating:** 5.0/5.0 stars *— Pardeep K.* [Read full review](https://www.g2.com/survey_responses/cisco-security-manager-review-7031115) --- **"[Facilitates process compliance and error free deployment](https://www.g2.com/survey_responses/cisco-security-manager-review-7060681)"** **Rating:** 5.0/5.0 stars *— Shailendra Kumar K.* [Read full review](https://www.g2.com/survey_responses/cisco-security-manager-review-7060681) --- ### 7. [LevelBlue USM Anywhere](https://www.g2.com/products/levelblue-usm-anywhere/reviews) LevelBlue USM Anywhere is a cloud-based security management solution that accelerates and centralizes threat detection, incident response, and compliance management for your cloud, hybrid cloud, and on-premises environments. USM Anywhere includes purpose-built cloud sensors that natively monitor your Amazon Web Services (AWS) and Microsoft Azure cloud environments. On premises, lightweight virtual sensors run on Microsoft Hyper-V and VMware ESXi to monitor your virtual private cloud and physical IT infrastructure. With USM Anywhere, you can rapidly deploy sensors into your cloud and on-premises environments while centrally managing data collection, security analysis, and threat detection from the AlienVault Secure Cloud. Five Essential Security Capabilities in a Single SaaS Platform AlienVault USM Anywhere provides five essential security capabilities in a single SaaS solution, giving you everything you need for threat detection, incident response, and compliance management—all in a single pane of glass. With USM Anywhere, you can focus on finding and responding to threats, not managing software. An elastic, cloud-based security solution, USM Anywhere can readily scale to meet your threat detection needs as your hybrid cloud environment changes and grows. 1. Asset Discovery 2. Vulnerability Assessment 3. Intrusion Detection 4. Behavioral Monitoring 5. SIEM **Average Rating:** 4.4/5.0 **Total Reviews:** 102 **How Do G2 Users Rate LevelBlue USM Anywhere?** - **Activity Monitoring:** 8.9/10 (Category avg: 9.1/10) - **Data Examination:** 8.4/10 (Category avg: 8.6/10) - **Ease of Use:** 8.3/10 (Category avg: 8.7/10) - **Log Management:** 8.9/10 (Category avg: 9.1/10) **Who Is the Company Behind LevelBlue USM Anywhere?** - **Seller:** [LevelBlue](https://www.g2.com/sellers/levelblue-49a2e3c1-ca90-4308-b899-08973f657bae) - **HQ Location:** Dallas, Texas, United States - **LinkedIn® Page:** https://www.linkedin.com/company/levelbluecyber/ (782 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Information Technology and Services, Financial Services - **Company Size:** 62% Mid-Market, 20% Small-Business #### What Are Recent G2 Reviews of LevelBlue USM Anywhere? **"[Comprehensive cloud security and monitoring platform](https://www.g2.com/survey_responses/levelblue-usm-anywhere-review-11718892)"** **Rating:** 5.0/5.0 stars *— Luis Emmanuel M.* [Read full review](https://www.g2.com/survey_responses/levelblue-usm-anywhere-review-11718892) --- **"[Impressive Cloud Based SIEM](https://www.g2.com/survey_responses/levelblue-usm-anywhere-review-9698214)"** **Rating:** 4.5/5.0 stars *— Goodness I.* [Read full review](https://www.g2.com/survey_responses/levelblue-usm-anywhere-review-9698214) --- #### What Are G2 Users Discussing About LevelBlue USM Anywhere? - [How has AlienVault USM supported your cybersecurity efforts, and what features do you rely on most?](https://www.g2.com/discussions/how-has-alienvault-usm-supported-your-cybersecurity-efforts-and-what-features-do-you-rely-on-most) - [What is AlienVault USM (from AT&T Cybersecurity) used for?](https://www.g2.com/discussions/what-is-alienvault-usm-from-at-t-cybersecurity-used-for) ### 8. [Adlumin](https://www.g2.com/products/adlumin/reviews) Adlumin, an N-able Company, provides enterprise-grade cybersecurity for organizations of all sizes through its innovative Security Operations as a Service platform. With an agnostic approach, the Adlumin platform seamlessly integrates with existing tech stacks, and its flexible management options enable it to be self-managed by an internal team, or fully managed by Adlumin experts. The Adlumin platform stops cyber threats early with deep learning models tailored to each environment. It maximizes resource efficiency by optimizing existing technology and streamlining workflows across teams. Adlumin transforms risk into resilience by identifying and addressing vulnerabilities, while cybersecurity experts proactively uncover and neutralize threats before they can do damage. Adlumin empowers organizations to take control of their digital security making advanced protection accessible to all. **Average Rating:** 4.7/5.0 **Total Reviews:** 63 **How Do G2 Users Rate Adlumin?** - **Activity Monitoring:** 9.7/10 (Category avg: 9.1/10) - **Data Examination:** 9.2/10 (Category avg: 8.6/10) - **Ease of Use:** 9.0/10 (Category avg: 8.7/10) - **Log Management:** 9.5/10 (Category avg: 9.1/10) **Who Is the Company Behind Adlumin?** - **Seller:** [N-able](https://www.g2.com/sellers/n-able) - **Company Website:** https://www.n-able.com - **HQ Location:** Morrisville, North Carolina - **Twitter:** @Nable (15,859 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/n-able (2,287 employees on LinkedIn®) - **Ownership:** NYSE: NABL **Who Uses This Product?** - **Top Industries:** Financial Services, Banking - **Company Size:** 56% Mid-Market, 23% Small-Business #### What Are Adlumin's Pros and Cons? **Pros:** - Analytics (1 reviews) - Detailed Analysis (1 reviews) - Detailed Explanation (1 reviews) - Ease of Management (1 reviews) - Ease of Use (1 reviews) **Cons:** - Poor Customer Support (1 reviews) ### What Do G2 Reviewers Say About Adlumin? *AI-generated summary from verified user reviews* **Pros:** - Users value the **detailed analytic reports** provided by Adlumin, finding them reliable and easy to use. - Users appreciate the **detailed analytic reports** from Adlumin, highlighting its reliability and ease of use. - Users value the **detailed analytic reports** offered by Adlumin, finding them reliable and easy to use. - Users value the **ease of management** in Adlumin, appreciating its reliable and user-friendly analytic reports. - Users find Adlumin to be **reliable and easy to use** , particularly appreciating its detailed analytic reports. **Cons:** - Users feel that the **customer support is lacking** , indicating a need for improvement in responsiveness and effectiveness. #### What Are Recent G2 Reviews of Adlumin? **"[Great platform and easy to use](https://www.g2.com/survey_responses/adlumin-review-12981429)"** **Rating:** 4.0/5.0 stars *— KAWSER A.* [Read full review](https://www.g2.com/survey_responses/adlumin-review-12981429) --- **"[Comprehensive security monitoring and simplified compliance reporting.](https://www.g2.com/survey_responses/adlumin-review-13050164)"** **Rating:** 4.0/5.0 stars *— Dom H.* [Read full review](https://www.g2.com/survey_responses/adlumin-review-13050164) --- ### 9. [ManageEngine Log360](https://www.g2.com/products/manageengine-log360/reviews) ManageEngine Log360 is a unified solution that offers holistic organizational security by bringing together crucial security capabilities like UEBA, DLP, CASB to improve visibility into your organization's network. With a simple UI and quick search and filtering capabilities for your device logs, you can easily gain insights into events on your network and plan automated responses to manage them. ManageEngine Log360 helps you secure your IT environment by detecting unauthorized security changes on your network and alerts the people responsible (admins, helpdesk). Our solution can capture the sensitive changes in your network, and present the changes to you in the form of searchable reports using which you can configure alerts. With support extending to your typical IT setups like Active Directory (AD), Azure, file servers, data storage devices, and other services like Amazon Web Services (AWS), ManageEngine Log360 will seamlessly fit into your existing configuration. **Average Rating:** 4.3/5.0 **Total Reviews:** 14 **How Do G2 Users Rate ManageEngine Log360?** - **Activity Monitoring:** 9.0/10 (Category avg: 9.1/10) - **Data Examination:** 7.2/10 (Category avg: 8.6/10) - **Ease of Use:** 9.3/10 (Category avg: 8.7/10) - **Log Management:** 9.2/10 (Category avg: 9.1/10) **Who Is the Company Behind ManageEngine Log360?** - **Seller:** [Zoho](https://www.g2.com/sellers/zoho-b00ca9d5-bca8-41b5-a8ad-275480841704) - **Year Founded:** 1996 - **HQ Location:** Austin, TX - **Twitter:** @Zoho (137,880 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/38373/ (30,766 employees on LinkedIn®) - **Phone:** +1 (888) 900-9646 **Who Uses This Product?** - **Top Industries:** Information Technology and Services - **Company Size:** 40% Enterprise, 40% Mid-Market #### What Are ManageEngine Log360's Pros and Cons? **Pros:** - Ease of Use (4 reviews) - Log Management (4 reviews) - Real-time Monitoring (3 reviews) - Alerting (2 reviews) - Alerting System (2 reviews) **Cons:** - Complex Configuration (2 reviews) - Configuration Difficulties (2 reviews) - Data Limitations (2 reviews) - Technical Issues (2 reviews) - Complexity (1 reviews) ### What Do G2 Reviewers Say About ManageEngine Log360? *AI-generated summary from verified user reviews* **Pros:** - Users find Log360's interface to be **fast and easy to use** , streamlining log management and threat detection. - Users praise **Log360's integrated log management** , simplifying auditing and enhancing security across both on-premise and cloud environments. - Users value the **real-time monitoring** of Log360, ensuring timely alerts and proactive threat detection for enhanced security. - Users value the **real-time alerting** capabilities of Log360, enabling proactive problem resolution and efficient auditing. - Users value the **real-time alerting system** in Log360, enhancing threat detection and preventing issues effectively. **Cons:** - Users find Log360's **complex configuration** frustrating, especially for non-AWS cloud platforms, leading to a challenging experience. - Users face **configuration difficulties** with Log360, particularly for non-AWS cloud environments, leading to a frustrating experience. - Users face **data limitations** with Log360, particularly in configuring other clouds and needing substantial storage for records. - Users experience **technical issues** like bugs and clunky configurations, affecting usability at times. - Users often find the **complexity** of configuration and glitches to hinder their overall experience with Log360. #### What Are Recent G2 Reviews of ManageEngine Log360? **"[Centralize System events logs](https://www.g2.com/survey_responses/manageengine-log360-review-12709113)"** **Rating:** 4.5/5.0 stars *— Dat V.* [Read full review](https://www.g2.com/survey_responses/manageengine-log360-review-12709113) --- **"[All-in-One Log Collection, Real-Time Monitoring & Compliance Reporting](https://www.g2.com/survey_responses/manageengine-log360-review-12342382)"** **Rating:** 4.0/5.0 stars *— Jeevanandham R.* [Read full review](https://www.g2.com/survey_responses/manageengine-log360-review-12342382) --- ### 10. [Guardsix](https://www.g2.com/products/guardsix/reviews) Guardsix is the sovereign security platform for lean European teams, bringing log management and audit-ready compliance to regulated industries, critical national infrastructure operators, and the Managed Security Service Providers (MSSPs) that serve them throughout Europe and beyond. Headquartered in Copenhagen, Denmark, Guardsix delivers sovereign-by-design security for organisations that carry real operational responsibility. The company employs several hundred cyber security specialists and keeps every organisation it serves in full control of their data, deployment, and operations. Guardsix provides a unified Command Centre platform combining: • Security Information and Event Management (SIEM) • Network Detection and Response (NDR) • Security Orchestration, Automation and Response (SOAR) • Fleet for enabling multi-tenant management • Governance for Healthcare internal risk compliance monitoring The platform is built to support European data sovereignty, regulatory compliance and operational control, with predictable node-based pricing and deployment options spanning on-premises, air-gapped, hybrid and cloud environments. Guardsix solutions help organisations: • Simplify audit readiness for regulations such as NIS2, DORA, and GDPR. • Support lean security teams with efficient log management and simplified workflows. • Scale security operations without increased complexity or ingestion-led pricing surprises. • Keep security data under European jurisdiction and control — where it lives, who operates it, and under whose laws. • Deploy on their own terms, on-prem and in infrastructure they control, keeping migration a real option at every renewal. • See clearly across their whole environment, with SIEM, NDR, SOAR, Fleet, and Governance in one sovereign platform rather than a stack of point tools. Guardsix maintains SOC 2 Type II attestation and designs its solutions in accordance with European data protection requirements. With a strong partner-first model, Guardsix works closely with regional MSSPs and service providers, combining sovereign-by-design security technology with European integrity and deployment flexibility. **Average Rating:** 4.3/5.0 **Total Reviews:** 105 **How Do G2 Users Rate Guardsix?** - **Activity Monitoring:** 8.2/10 (Category avg: 9.1/10) - **Data Examination:** 8.0/10 (Category avg: 8.6/10) - **Ease of Use:** 8.3/10 (Category avg: 8.7/10) - **Log Management:** 8.6/10 (Category avg: 9.1/10) **Who Is the Company Behind Guardsix?** - **Seller:** [guardsix](https://www.g2.com/sellers/guardsix) - **Company Website:** https://guardsix.com/ - **Year Founded:** 2001 - **HQ Location:** Copenhagen, Capital Region - **LinkedIn® Page:** https://linkedin.com/company/guardsix (162 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Computer & Network Security, Information Technology and Services - **Company Size:** 44% Mid-Market, 31% Small-Business #### What Are Guardsix's Pros and Cons? **Pros:** - Ease of Use (8 reviews) - Log Management (5 reviews) - Customer Support (4 reviews) - Easy Integrations (4 reviews) - Efficiency (4 reviews) **Cons:** - Poor Interface Design (3 reviews) - UX Improvement (3 reviews) - Complexity (2 reviews) - Confusing Interface (2 reviews) - Information Deficiency (2 reviews) ### What Do G2 Reviewers Say About Guardsix? *AI-generated summary from verified user reviews* **Pros:** - Users appreciate the **ease of use** of Logpoint, making administration and navigation straightforward and efficient. - Users value the **efficient log management** of Logpoint, appreciating its seamless integration and user-friendly design. - Users commend Logpoint's **excellent customer support** and quick setup, making it an appealing choice for many organizations. - Users love the **easy integrations** of Logpoint, seamlessly enhancing their tech ecosystem and streamlining cybersecurity processes. - Users appreciate the **efficiency** of Logpoint, enabling streamlined incident management and saving valuable time. **Cons:** - Users find the **poor interface design** frustrating, impacting usability and slowing down their overall experience with guardsix. - Users find the **interface slow** and poorly designed, lacking essential functions for an effective UX experience. - Users find the **complexity of the interface** challenging, but anticipate improvements in the future. - Users find the **confusing interface** challenging to navigate, impacting their overall experience with the product. - Users note a lack of **technical information** which hinders proper design and resource allocation when adding devices. #### What Are Recent G2 Reviews of Guardsix? **"[Context-Driven SIEM That Enhances Incident Response](https://www.g2.com/survey_responses/guardsix-review-11985484)"** **Rating:** 4.5/5.0 stars *— Simon A.* [Read full review](https://www.g2.com/survey_responses/guardsix-review-11985484) --- **"[Review](https://www.g2.com/survey_responses/guardsix-review-11378057)"** **Rating:** 4.0/5.0 stars *— Ronny K.* [Read full review](https://www.g2.com/survey_responses/guardsix-review-11378057) --- #### What Are G2 Users Discussing About Guardsix? - [What is your experience with Logpoint for SIEM, and what do you recommend for new users?](https://www.g2.com/discussions/what-is-your-experience-with-logpoint-for-siem-and-what-do-you-recommend-for-new-users) - [What is LogPoint used for?](https://www.g2.com/discussions/what-is-logpoint-used-for) ### 11. [Exabeam New-Scale Platform](https://www.g2.com/products/exabeam-exabeam-new-scale-platform/reviews) The Exabeam New-Scale Security Operations Platform is built to help organizations detect, investigate, and respond to insider threats tied to both human users and non-human identities. It brings together behavioral analytics, automation, and AI-driven workflows to help security operations teams reduce risk and maintain operational integrity. The platform supports AI agent-powered threat detection, investigation, and response (TDIR) by automating high-friction tasks and applying behavioral context to every signal. By combining proactive risk identification with fast, guided response, the New-Scale Platform helps teams move from alert handling to informed decision-making. Designed for enterprise security operations teams, the New-Scale Platform supports organizations that need consistent visibility into internal risk without adding operational overhead. Analysts use behavioral analytics to understand what is normal for a user or agent, then quickly spot meaningful deviations. This approach is especially valuable in data-sensitive industries such as finance, healthcare, and technology, where internal misuse, compromised credentials, or agent misuse can create immediate business impact. At the core of the New-Scale Platform is advanced behavioral analytics. The platform analyzes activity patterns across identities, devices, and services to establish baselines of normal behavior. When activity deviates from those baselines, dynamic risk scoring helps security teams focus on the activity most likely to indicate misuse or compromise. This reduces alert noise and shortens the time it takes to understand what is happening and why. The New-Scale Platform also extends user and entity behavior analytics (UEBA) to non-human identities through Agent Behavior Analytics (ABA). ABA applies the same behavior-based approach as UEBA to service accounts, APIs, automation tools, and AI agents. By monitoring how agents typically interact with data and systems, the platform helps teams detect misuse, drift, or compromise that traditional controls often miss. Automation plays a central role in improving day-to-day operations. The New-Scale Platform automates investigation steps, enrichment, and response actions within TDIR workflows, allowing analysts to spend less time on repetitive tasks and more time validating risk and containing incidents. Behavioral context and AI-driven prioritization help teams address the most relevant threats first, improving response consistency without increasing workload. With the Exabeam New-Scale Platform, security teams can benchmark and prove the value of their security program against peers and measurable outcomes. Outcomes Navigator translates raw security data into business-relevant insights to demonstrate progress against the most strategic use cases, MITRE ATT&CK TTPs, and compliance initiatives. Together, user and entity behavior analytics (UEBA), Agent Behavior Analytics (ABA), and agent-powered automated TDIR workflows help security operations teams detect insider risk earlier, investigate faster, and respond with greater precision. The New-Scale Platform gives organizations a practical way to manage insider threats tied to people and agents, accelerate security operations, and prove security impact over time. **Average Rating:** 4.6/5.0 **Total Reviews:** 14 **How Do G2 Users Rate Exabeam New-Scale Platform?** - **Activity Monitoring:** 9.0/10 (Category avg: 9.1/10) - **Data Examination:** 9.2/10 (Category avg: 8.6/10) - **Ease of Use:** 9.2/10 (Category avg: 8.7/10) - **Log Management:** 9.2/10 (Category avg: 9.1/10) **Who Is the Company Behind Exabeam New-Scale Platform?** - **Seller:** [Exabeam](https://www.g2.com/sellers/exabeam) - **Company Website:** https://www.exabeam.com - **Year Founded:** 2013 - **HQ Location:** Broomfield, CO - **Twitter:** @exabeam (5,374 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/exabeam (793 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 57% Enterprise, 29% Mid-Market #### What Are Exabeam New-Scale Platform's Pros and Cons? **Pros:** - Ease of Use (5 reviews) - Detection Accuracy (3 reviews) - Features (3 reviews) - Security (3 reviews) - Automation (2 reviews) **Cons:** - Complexity (2 reviews) - Complex Setup (2 reviews) - Difficult Setup (2 reviews) - Parsing Issues (2 reviews) - Software Complexity (2 reviews) ### What Do G2 Reviewers Say About Exabeam New-Scale Platform? *AI-generated summary from verified user reviews* **Pros:** - Users appreciate the **ease of use** of the Exabeam New-Scale Platform, highlighting its integration and automation capabilities. - Users value the **detection accuracy** of Exabeam New-Scale Platform, enhancing security and speeding up threat responses. - Users value the **ease of integration and advanced security features** offered by the Exabeam New-Scale Platform. - Users value the **rich set of security features** in Exabeam, enhancing clarity and integration for threat monitoring. - Users appreciate the **automation capabilities** of Exabeam, enhancing efficiency in threat response and reducing manual efforts. **Cons:** - Users find the **complexity** of Exabeam New-Scale Platform challenging, especially regarding setup and log ingestion issues. - Users find the **complex setup** of the Exabeam New-Scale Platform challenging, requiring significant expertise for effective management. - Users find the **difficult setup** of the Exabeam New-Scale Platform to be a significant barrier to effective use. - Users find **parsing issues** with Exabeam New-Scale Platform, leading to a less user-friendly experience and complexity. - Users find the **software complexity** of the Exabeam New-Scale Platform challenging, requiring substantial expertise to navigate effectively. #### What Are Recent G2 Reviews of Exabeam New-Scale Platform? **"[Gives Security Teams Their Time Back with Smart Threat Visibility](https://www.g2.com/survey_responses/exabeam-new-scale-platform-review-9889355)"** **Rating:** 4.5/5.0 stars *— Verified User in Computer Software* [Read full review](https://www.g2.com/survey_responses/exabeam-new-scale-platform-review-9889355) --- **"[The perfect SIEM](https://www.g2.com/survey_responses/exabeam-new-scale-platform-review-10644742)"** **Rating:** 5.0/5.0 stars *— Jorge T.* [Read full review](https://www.g2.com/survey_responses/exabeam-new-scale-platform-review-10644742) --- #### What Are G2 Users Discussing About Exabeam New-Scale Platform? - [What are the components of SIEM?](https://www.g2.com/discussions/what-are-the-components-of-siem) - 1 comment - [What are three characteristics of SIEM?](https://www.g2.com/discussions/what-are-three-characteristics-of-siem) - 1 comment ### 12. [ConnectWise SIEM](https://www.g2.com/products/connectwise-siem/reviews) Designed for MPS, ConnectWise SIEM is a cutting-edge platform that harnesses the power of advanced security information and event management (SIEM) to provide unparalleled visibility and protection for businesses. With its robust multi-tenancy capabilities, ConnectWise SIEM allows IT Service Providers to efficiently manage security operations across multiple clients or departments from a single interface. By seamlessly integrating with the ConnectWise Security Operations Center (SOC), this platform enables users to leverage expert insights and resources to proactively detect and respond to security threats, ensuring comprehensive protection and peace of mind for businesses of all sizes. The core features of ConnectWise SIEM include: 1. Real-time Threat Detection: ConnectWise SIEM continuously monitors network activity to detect and alert on potential security threats in real-time. 2. Log Management: The platform collects, normalizes, and analyzes log data from various sources to provide a comprehensive view of the organization's security posture. 3. Incident Response: ConnectWise SIEM facilitates rapid incident response by providing automated workflows and playbooks for handling security incidents effectively. 4. Compliance Reporting: The platform helps organizations meet regulatory compliance requirements by generating reports and audits to demonstrate adherence to security standards. 5. Threat Intelligence Integration: ConnectWise SIEM integrates with threat intelligence feeds to enhance threat detection capabilities and stay ahead of emerging cyber threats. 6. Multi-Tenancy Support: The platform offers multi-tenancy support, allowing Managed Service Providers (MSPs) to manage security operations for multiple clients from a single interface. 7. ConnectWise SOC Integration: ConnectWise SIEM seamlessly integrates with the ConnectWise Security Operations Center (SOC) to leverage expert insights and resources for enhanced security monitoring and response. **Average Rating:** 4.3/5.0 **Total Reviews:** 20 **How Do G2 Users Rate ConnectWise SIEM?** - **Activity Monitoring:** 8.9/10 (Category avg: 9.1/10) - **Data Examination:** 8.3/10 (Category avg: 8.6/10) - **Ease of Use:** 8.2/10 (Category avg: 8.7/10) - **Log Management:** 8.8/10 (Category avg: 9.1/10) **Who Is the Company Behind ConnectWise SIEM?** - **Seller:** [ConnectWise](https://www.g2.com/sellers/connectwise) - **Company Website:** https://www.connectwise.com/ - **Year Founded:** 1982 - **HQ Location:** Tampa, FL - **Twitter:** @ConnectWise (14,926 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/48576/ (3,388 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Information Technology and Services, Computer & Network Security - **Company Size:** 45% Small-Business, 35% Mid-Market #### What Are Recent G2 Reviews of ConnectWise SIEM? **"[Best in Class Cyber Protection Tool](https://www.g2.com/survey_responses/connectwise-siem-review-9099037)"** **Rating:** 4.5/5.0 stars *— Ajinkya M.* [Read full review](https://www.g2.com/survey_responses/connectwise-siem-review-9099037) --- **"[ConnectWise Cybersecurity Management: MSP-Grade SIEM That Demands Proper Onboarding](https://www.g2.com/survey_responses/connectwise-siem-review-12882405)"** **Rating:** 5.0/5.0 stars *— Verified User in Consulting* [Read full review](https://www.g2.com/survey_responses/connectwise-siem-review-12882405) --- ### 13. [Logsign Unified SO Platform](https://www.g2.com/products/logsign-unified-so-platform/reviews) Logsign Unified SO Platform integrates next-gen SIEM, threat intelligence, UEBA, and SOAR and empowers organizations to optimize and streamline their cybersecurity operations. In addition to that, the platform offers seamless integration capabilities, allowing them to effortlessly integrate their existing security software and leverage our vast integration library, expanding the Logsign USO Platform's functionality and providing a comprehensive security management experience. With these extensive capabilities, it allows organizations to improve their security posture and ensure compliance with relevant regulations and standards. - Easy-to-deploy, easy-to-use Unified SO Platform for all sizes of enterprises. - Enterprise-grade scalability, high availability - Cluster SIEM, big data infrastructure.  - On-premise solution. - 500+ predefined integrations and free plugin service. - Collects & stores high volumes of data. - Threat hunting, fast search & investigation, advanced behaviour analysis, IOC detection. - Threat Intelligence and UEBA embedded. - Real-time detection & prevention, wide correlation library based on Mitre Att&ck framework.  - Real-time monitoring, predefined dashboards & reports, meeting Compliance Requirements (PCI DSS, ISO 27001, HIPAA, SOX, and more). - Automated notifications, automated Incident response - Incident Cycle Management - Incident Response - Multiple pricing options without capacity or log source limit, feature-based pricing. **Average Rating:** 4.7/5.0 **Total Reviews:** 53 **How Do G2 Users Rate Logsign Unified SO Platform?** - **Activity Monitoring:** 9.1/10 (Category avg: 9.1/10) - **Data Examination:** 8.7/10 (Category avg: 8.6/10) - **Ease of Use:** 9.6/10 (Category avg: 8.7/10) - **Log Management:** 9.6/10 (Category avg: 9.1/10) **Who Is the Company Behind Logsign Unified SO Platform?** - **Seller:** [Logsign](https://www.g2.com/sellers/logsign-b186ed7a-a696-4a37-b658-5f865c16557e) - **Year Founded:** 2010 - **HQ Location:** Hague, Netherlands, NL - **Twitter:** @logsign (368 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/logsign/ (41 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Computer & Network Security, Information Technology and Services - **Company Size:** 50% Mid-Market, 31% Small-Business #### What Are Recent G2 Reviews of Logsign Unified SO Platform? **"[Extremely High Reliable](https://www.g2.com/survey_responses/logsign-unified-so-platform-review-8971186)"** **Rating:** 5.0/5.0 stars *— Burak R.* [Read full review](https://www.g2.com/survey_responses/logsign-unified-so-platform-review-8971186) --- **"[Complete Next generation SIEM Tool](https://www.g2.com/survey_responses/logsign-unified-so-platform-review-9174495)"** **Rating:** 4.0/5.0 stars *— surekha k.* [Read full review](https://www.g2.com/survey_responses/logsign-unified-so-platform-review-9174495) --- #### What Are G2 Users Discussing About Logsign Unified SO Platform? - [What is Logsign Next-Gen SIEM used for?](https://www.g2.com/discussions/what-is-logsign-next-gen-siem-used-for) ### 14. [SolarWinds Security Event Manager](https://www.g2.com/products/solarwinds-security-event-manager/reviews) Security Event Manager (SEM) is a powerful, real-time Security Information and Event Management (SIEM) solution designed to act as a virtual Security Operations Center (SOC). It provides active monitoring and automated threat detection across multi-vendor network devices, servers, workstations, and applications. SEM is delivered as a downloadable virtual appliance for rapid deployment, and allows IT teams to centralize log data and enable real-time event correlation right out of the box. SEM goes beyond simple alerting by offering automated remediation actions. When suspicious behavior is detected, the platform can automatically block malicious IPs, disable compromised user accounts, kill unauthorized applications, or detach unmanaged USB devices via its integrated USB Defender. This immediate response capability significantly reduces the window of vulnerability during a cyber-attack. To ensure deep visibility, SEM features built-in File Integrity Monitoring (FIM), allowing you to track sensitive file changes, deletions, and registry modifications. The platform also streamlines audit preparation with hundreds of pre-built, out-of-the-box compliance reports for major regulatory frameworks, including HIPAA, PCI DSS, SOX, ISO, DISA STIGs, and FISMA. With its intuitive text-based searching and integrated threat intelligence feed, SEM normalizes disparate log data into a readable format. This enables faster forensic analysis and historical searching, helping your team identify patterns from known bad actors and strengthen your overall security posture. Whether you are managing internal threats or external breaches, SolarWinds SEM provides the essential tools to detect, respond, and report with confidence. For organizations seeking tailored security control, SEM is highly effective as a standalone SIEM tool, providing dedicated log management and incident response. However, for those looking to eliminate silos between security and IT operations, SEM can also function as a core component of SolarWinds Observability. **Average Rating:** 4.0/5.0 **Total Reviews:** 71 **How Do G2 Users Rate SolarWinds Security Event Manager?** - **Activity Monitoring:** 9.2/10 (Category avg: 9.1/10) - **Data Examination:** 8.5/10 (Category avg: 8.6/10) - **Ease of Use:** 8.2/10 (Category avg: 8.7/10) - **Log Management:** 8.9/10 (Category avg: 9.1/10) **Who Is the Company Behind SolarWinds Security Event Manager?** - **Seller:** [SolarWinds Worldwide LLC](https://www.g2.com/sellers/solarwinds-worldwide-llc) - **Year Founded:** 1999 - **HQ Location:** Austin, TX - **Twitter:** @solarwinds (19,570 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/166039/ (2,824 employees on LinkedIn®) - **Ownership:** NYSE: SWI **Who Uses This Product?** - **Top Industries:** Information Technology and Services, Computer Software - **Company Size:** 51% Enterprise, 39% Mid-Market #### What Are SolarWinds Security Event Manager's Pros and Cons? **Pros:** - Detection Efficiency (1 reviews) - Ease of Use (1 reviews) **Cons:** - Licensing Cost (1 reviews) - Poor Customer Support (1 reviews) ### What Do G2 Reviewers Say About SolarWinds Security Event Manager? *AI-generated summary from verified user reviews* **Pros:** - Users value the **high detection efficiency** of SolarWinds Security Event Manager, making administration straightforward and effective. - Users value the **ease of use** for admins, finding device addition to be straightforward and simple. **Cons:** - Users find the **licensing cost** complex and support options limited, impacting their overall satisfaction with the product. - Users report **poor customer support** , citing limited expert assistance and ineffective online resources for help. #### What Are Recent G2 Reviews of SolarWinds Security Event Manager? **"[Network Monitroing Tools Software](https://www.g2.com/survey_responses/solarwinds-security-event-manager-review-9315556)"** **Rating:** 4.5/5.0 stars *— AFTAB A.* [Read full review](https://www.g2.com/survey_responses/solarwinds-security-event-manager-review-9315556) --- **"[Powerful Security, Clunky Interface](https://www.g2.com/survey_responses/solarwinds-security-event-manager-review-12727479)"** **Rating:** 5.0/5.0 stars *— dennis s.* [Read full review](https://www.g2.com/survey_responses/solarwinds-security-event-manager-review-12727479) --- #### What Are G2 Users Discussing About SolarWinds Security Event Manager? - [What is SolarWinds Security Event Manager used for?](https://www.g2.com/discussions/what-is-solarwinds-security-event-manager-used-for) - [What is Access rights Manager?](https://www.g2.com/discussions/what-is-access-rights-manager) - 1 comment ### 15. [OpenText ArcSight Enterprise Security Manager (ESM)](https://www.g2.com/products/opentext-arcsight-enterprise-security-manager-esm/reviews) ArcSight Enterprise Security Manager (ESM) is a comprehensive threat detection, analysis, triage, and compliance management SIEM platform that dramatically reduces the time to mitigate cyber-security threats. **Average Rating:** 3.7/5.0 **Total Reviews:** 14 **How Do G2 Users Rate OpenText ArcSight Enterprise Security Manager (ESM)?** - **Activity Monitoring:** 9.0/10 (Category avg: 9.1/10) - **Data Examination:** 8.8/10 (Category avg: 8.6/10) - **Ease of Use:** 7.9/10 (Category avg: 8.7/10) - **Log Management:** 8.5/10 (Category avg: 9.1/10) **Who Is the Company Behind OpenText ArcSight Enterprise Security Manager (ESM)?** - **Seller:** [OpenText](https://www.g2.com/sellers/opentext) - **Year Founded:** 1991 - **HQ Location:** Waterloo, ON - **Twitter:** @OpenText (21,565 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/2709/ (23,048 employees on LinkedIn®) - **Ownership:** NASDAQ:OTEX **Who Uses This Product?** - **Top Industries:** Computer & Network Security - **Company Size:** 53% Mid-Market, 29% Enterprise #### What Are Recent G2 Reviews of OpenText ArcSight Enterprise Security Manager (ESM)? **"[A SIEM tool for monitoring real-time security events.](https://www.g2.com/survey_responses/opentext-arcsight-enterprise-security-manager-esm-review-9352226)"** **Rating:** 4.5/5.0 stars *— Hiran T.* [Read full review](https://www.g2.com/survey_responses/opentext-arcsight-enterprise-security-manager-esm-review-9352226) --- **"[The Pioneer in SIEM](https://www.g2.com/survey_responses/opentext-arcsight-enterprise-security-manager-esm-review-8604664)"** **Rating:** 4.0/5.0 stars *— Verified User in Computer & Network Security* [Read full review](https://www.g2.com/survey_responses/opentext-arcsight-enterprise-security-manager-esm-review-8604664) --- #### What Are G2 Users Discussing About OpenText ArcSight Enterprise Security Manager (ESM)? - [What is ESM in Siem?](https://www.g2.com/discussions/what-is-esm-in-siem) - [What is the purpose of ArcSight?](https://www.g2.com/discussions/what-is-the-purpose-of-arcsight) - [What are the components of ArcSight?](https://www.g2.com/discussions/what-are-the-components-of-arcsight) - [What is ESM in security?](https://www.g2.com/discussions/what-is-esm-in-security) ### 16. [BluSapphire XDR Platform](https://www.g2.com/products/blusapphire-xdr-platform/reviews) BluSapphire is a comprehensive cyber defense platform crafted meticulously from the ground up by BluSapphire Labs. Each aspect of our platform embodies innovation without reliance on third-party tools. We redefine cybersecurity for enterprises, offering cutting-edge solutions at unmatched value and with flexible contract options. We offer Next Gen SIEM, Hybrid XDR, MDR Services along with Secure Data Lake, revolutionizing cybersecurity and data management.Our comprehensive suite of products and services empowers your organization's cyber resilience journey. **Average Rating:** 4.6/5.0 **Total Reviews:** 15 **How Do G2 Users Rate BluSapphire XDR Platform?** - **Activity Monitoring:** 9.0/10 (Category avg: 9.1/10) - **Data Examination:** 8.8/10 (Category avg: 8.6/10) - **Ease of Use:** 8.8/10 (Category avg: 8.7/10) - **Log Management:** 9.0/10 (Category avg: 9.1/10) **Who Is the Company Behind BluSapphire XDR Platform?** - **Seller:** [BluSapphire](https://www.g2.com/sellers/blusapphire) - **Year Founded:** 2017 - **HQ Location:** Hyderabad, Telegana - **LinkedIn® Page:** https://www.linkedin.com/company/blusapphire/ (109 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 47% Mid-Market, 33% Enterprise #### What Are BluSapphire XDR Platform's Pros and Cons? **Pros:** - Threat Detection (7 reviews) - Customer Support (4 reviews) - Easy Integrations (4 reviews) - Implementation Ease (3 reviews) - Incident Response (3 reviews) **Cons:** - Complex Configuration (2 reviews) - Implementation Challenges (2 reviews) - Pricing Issues (2 reviews) - Cloud Dependency (1 reviews) - Communication Issues (1 reviews) ### What Do G2 Reviewers Say About BluSapphire XDR Platform? *AI-generated summary from verified user reviews* **Pros:** - Users value the **comprehensive threat detection** of BluSapphire XDR Platform, enhancing security through advanced automation and real-time responses. - Users praise the **responsive customer support** of BluSapphire XDR Platform, highlighting its quick and helpful assistance. - Users value the **easy integrations** of BluSapphire XDR Platform, enhancing risk detection across various enterprise solutions. - Users find the **implementation ease** of BluSapphire XDR Platform outstanding, with quick integration and hassle-free setup. - Users value the **automated incident response** of BluSapphire XDR Platform, enhancing threat detection and operational efficiency. **Cons:** - Users face a **steep learning curve and initial setup complexity** , making adoption of BluSapphire XDR challenging. - Users report **integration challenges** that hinder seamless adoption and functionality of the BluSapphire XDR Platform. - Users find the **pricing transparency lacking** and note that the high costs can be challenging for newcomers. - Users note the **cloud dependency** of BluSapphire, complicating issue resolution and limiting customization options. - Users report experiencing **communication issues** due to slow response times and unreliable custom tools. #### What Are Recent G2 Reviews of BluSapphire XDR Platform? **"[Best XDR platform with threat detection, analytics and automated response.](https://www.g2.com/survey_responses/blusapphire-xdr-platform-review-10774098)"** **Rating:** 4.5/5.0 stars *— Aakash K.* [Read full review](https://www.g2.com/survey_responses/blusapphire-xdr-platform-review-10774098) --- **"[Privacy friendly XDR platform with advanced analytics capabilities](https://www.g2.com/survey_responses/blusapphire-xdr-platform-review-10846805)"** **Rating:** 4.0/5.0 stars *— Siranjeevi D.* [Read full review](https://www.g2.com/survey_responses/blusapphire-xdr-platform-review-10846805) --- ### 17. [Logz.io](https://www.g2.com/products/logz-io/reviews) Logz.io is an AI-powered observability platform designed to help teams solve critical log management, monitoring, and troubleshooting challenges. Built for modern environments, Logz.io unifies log management, infrastructure monitoring, and distributed tracing in a single platform to provide deep, actionable insights into system performance and health. At its core, Logz.io’s AI Agent technology automates root cause analysis (RCA) and surfaces insights that accelerate investigations, reduce MTTR, and eliminate the need for time-consuming manual analysis or navigating multiple dashboards. Whether managing microservices or troubleshooting production issues, Logz.io empowers teams to quickly pinpoint issues, de-risk deployments, and focus on innovation. Unlike traditional observability tools that require ever-increasing data volumes and expertise, Logz.io offers a smarter, cost-optimized solution. With the ability to customize data ingestion and optimize telemetry costs, Logz.io ensures you get the insights you need without breaking the budget. **Average Rating:** 4.5/5.0 **Total Reviews:** 163 **How Do G2 Users Rate Logz.io?** - **Activity Monitoring:** 9.0/10 (Category avg: 9.1/10) - **Data Examination:** 8.5/10 (Category avg: 8.6/10) - **Ease of Use:** 8.8/10 (Category avg: 8.7/10) - **Log Management:** 8.8/10 (Category avg: 9.1/10) **Who Is the Company Behind Logz.io?** - **Seller:** [Logz.io](https://www.g2.com/sellers/logz-io) - **Year Founded:** 2014 - **HQ Location:** Boston, MA - **Twitter:** @logzio (3,156 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/4831888/ (110 employees on LinkedIn®) **Who Uses This Product?** - **Who Uses This:** Software Engineer, Software Developer - **Top Industries:** Computer Software, Information Technology and Services - **Company Size:** 53% Mid-Market, 30% Small-Business #### What Are Logz.io's Pros and Cons? **Pros:** - Log Management (5 reviews) - Customer Support (4 reviews) - Ease of Implementation (4 reviews) - Implementation Ease (4 reviews) - Insights (4 reviews) **Cons:** - Dashboard Issues (2 reviews) - Integration Issues (2 reviews) - Limited Customization (2 reviews) - Complex Configuration (1 reviews) - Complex Debugging (1 reviews) ### What Do G2 Reviewers Say About Logz.io? *AI-generated summary from verified user reviews* **Pros:** - Users value the **extensive customization and alerting options** provided by Logz.io for efficient log management. - Users commend the **excellent customer support** of Logz.io, noting its speed and knowledgeable assistance. - Users appreciate the **ease of implementation** with Logz.io, enjoying a smooth integration and user-friendly dashboard. - Users appreciate the **ease of implementation** of Logz.io, enjoying a smooth integration and user-friendly dashboard. - Users value the **user-friendly dashboard and insightful logs** of Logz.io for seamless monitoring and troubleshooting. **Cons:** - Users find the **dashboard issues** in Logz.io frustrating, citing challenges with charts and UI updates. - Users face **integration issues** due to lag in data indexing and complexity in configurations and chart creation. - Users note the **limited customization** options in Logz.io, which restricts their flexibility and adaptation to specific needs. - Users find the **complex configuration** challenging, often needing to analyze data to set up alerts and reports effectively. - Users find **complex debugging** challenging, often struggling to set up alerts and reports due to data intricacies. #### What Are Recent G2 Reviews of Logz.io? **"[Great Logs Monitoring For Any Requirements](https://www.g2.com/survey_responses/logz-io-review-10244120)"** **Rating:** 5.0/5.0 stars *— Nitin J.* [Read full review](https://www.g2.com/survey_responses/logz-io-review-10244120) --- **"[Perfect monitoring log management tool](https://www.g2.com/survey_responses/logz-io-review-9589251)"** **Rating:** 4.0/5.0 stars *— Verified User in Information Technology and Services* [Read full review](https://www.g2.com/survey_responses/logz-io-review-9589251) --- #### What Are G2 Users Discussing About Logz.io? - [What is Logz.io used for?](https://www.g2.com/discussions/what-is-logz-io-used-for) - 1 comment ### 18. [Fluency SIEM](https://www.g2.com/products/fluency-siem/reviews) Traditional SIEMs struggle with alert fatigue, false positives, and overwhelming data volumes, problems that directly limit security visibility. Fluency eliminates these barriers through its streaming architecture and intelligent analytics. Its patented scoring and correlation engine automatically groups related events, dramatically reducing redundant alerts and enabling analysts to focus on genuine threats. Continuous learning from historical data minimizes false positives, while its true streaming model processes massive telemetry volumes in real time without relying on costly database storage. The result is a SIEM that scales effortlessly, cuts through the noise, and turns security monitoring into actionable intelligence. Fluency is a next-generation Security Information and Event Management (SIEM) solution designed to help organizations enhance their cybersecurity posture through real-time threat detection and response. Unlike traditional SIEM systems that rely on centralized databases for data ingestion and analysis, Fluency leverages a true streaming analytics model. This innovative approach allows for the immediate processing of events as they occur, significantly improving the speed and accuracy of threat identification. The target audience for Fluency includes cybersecurity teams and IT professionals across various industries who require advanced tools to monitor, detect, and respond to security incidents. As cyber threats become increasingly complex and sophisticated, organizations need solutions that not only identify potential risks but also provide actionable insights. Fluency addresses this need by offering a comprehensive view of security events, enabling teams to respond swiftly and effectively to emerging threats. Key features of Fluency include its patented scoring and correlation engine, which links related events across users, devices, and time. This capability automatically builds context around security incidents, reducing the likelihood of false positives and minimizing alert fatigue. By streamlining the alerting process, Fluency allows analysts to focus on genuine threats rather than being overwhelmed by a high volume of notifications. Additionally, the built-in artificial intelligence and machine learning capabilities continuously learn from historical data, enhancing detection accuracy and enabling the identification of anomalies that may indicate new or evolving threats. Fluency's GenAI workflow further enriches the user experience by generating structured case insights and suggesting next steps for incident response. This feature empowers analysts to engage directly with security incidents through intelligent summarization and guided responses, facilitating a more efficient investigation process. By integrating these advanced capabilities, Fluency not only improves operational efficiency but also helps organizations maintain a proactive stance against cyber threats, ensuring that they are better equipped to safeguard their digital assets. Overall, Fluency represents a significant advancement in the SIEM landscape, combining real-time analytics with intelligent automation to provide organizations with the tools they need to effectively combat cyber threats. Its unique approach to data processing and incident response positions it as a valuable asset for any organization looking to bolster its cybersecurity defenses. **Average Rating:** 4.9/5.0 **Total Reviews:** 16 **How Do G2 Users Rate Fluency SIEM?** - **Activity Monitoring:** 9.6/10 (Category avg: 9.1/10) - **Data Examination:** 9.5/10 (Category avg: 8.6/10) - **Ease of Use:** 8.0/10 (Category avg: 8.7/10) - **Log Management:** 9.5/10 (Category avg: 9.1/10) **Who Is the Company Behind Fluency SIEM?** - **Seller:** [Fluency Security](https://www.g2.com/sellers/fluency-security) - **Company Website:** https://www.fluencysecurity.com/ - **Year Founded:** 2013 - **HQ Location:** Greenbelt, Maryland - **Twitter:** @fluencysecurity (192 Twitter followers) - **LinkedIn® Page:** http://www.linkedin.com/company/fluency-security (7 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Computer & Network Security - **Company Size:** 56% Mid-Market, 25% Small-Business #### What Are Recent G2 Reviews of Fluency SIEM? **"[Exceptional](https://www.g2.com/survey_responses/fluency-siem-review-9748818)"** **Rating:** 5.0/5.0 stars *— William S.* [Read full review](https://www.g2.com/survey_responses/fluency-siem-review-9748818) --- **"[A Mature, Dependable Platform for Actionable Security Intelligence](https://www.g2.com/survey_responses/fluency-siem-review-12927087)"** **Rating:** 5.0/5.0 stars *— Cornell B.* [Read full review](https://www.g2.com/survey_responses/fluency-siem-review-12927087) --- ### 19. [InsightOps](https://www.g2.com/products/insightops/reviews) Ridiculously easy log management is just the beginning **Average Rating:** 3.1/5.0 **Total Reviews:** 11 **How Do G2 Users Rate InsightOps?** - **Activity Monitoring:** 10.0/10 (Category avg: 9.1/10) - **Data Examination:** 10.0/10 (Category avg: 8.6/10) - **Ease of Use:** 6.5/10 (Category avg: 8.7/10) - **Log Management:** 10.0/10 (Category avg: 9.1/10) **Who Is the Company Behind InsightOps?** - **Seller:** [Rapid7](https://www.g2.com/sellers/rapid7) - **Year Founded:** 2000 - **HQ Location:** Boston, MA - **Twitter:** @rapid7 (124,405 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/39624/ (3,274 employees on LinkedIn®) - **Ownership:** NASDAQ:RPD **Who Uses This Product?** - **Top Industries:** Computer Software - **Company Size:** 73% Small-Business, 27% Mid-Market #### What Are Recent G2 Reviews of InsightOps? **"[Real time and endpoints management solutions.](https://www.g2.com/survey_responses/insightops-review-2956271)"** **Rating:** 5.0/5.0 stars *— Paul D.* [Read full review](https://www.g2.com/survey_responses/insightops-review-2956271) --- **"[Logentries is a must to not get lost in logging](https://www.g2.com/survey_responses/insightops-review-169899)"** **Rating:** 4.0/5.0 stars *— Christophe N.* [Read full review](https://www.g2.com/survey_responses/insightops-review-169899) --- ### 20. [Trellix Enterprise Security Manager](https://www.g2.com/products/trellix-enterprise-security-manager/reviews) Trellix EnterprisTrellix Enterprise Security Manager (ESM) is a highly scalable Security Information and Event Management (SIEM) solution delivering real-time visibility across systems, networks, databases, and applications. Engineered for speed, ESM collects and correlates data from over 460 integrated technologies to provide actionable threat intelligence. It stores billions of events, offering immediate ad-hoc query capabilities, rapid forensics, and historical rule validation without impacting performance. ESM empowers security operations center (SOC) teams to automate and coordinate incident response through advanced bi-directional integrations. To streamline operations, the platform includes hundreds of customizable dashboards, reports, and correlation rules. Robust compliance features help organizations seamlessly address regulatory frameworks. With flexible hybrid deployment options (on-premises, virtual, or cloud), Trellix ESM accelerates threat detection, prioritizes alerts, and unifies security operations within a single centralized platform. **Average Rating:** 4.1/5.0 **Total Reviews:** 37 **How Do G2 Users Rate Trellix Enterprise Security Manager?** - **Activity Monitoring:** 7.9/10 (Category avg: 9.1/10) - **Data Examination:** 8.1/10 (Category avg: 8.6/10) - **Ease of Use:** 8.1/10 (Category avg: 8.7/10) - **Log Management:** 8.1/10 (Category avg: 9.1/10) **Who Is the Company Behind Trellix Enterprise Security Manager?** - **Seller:** [Skyhigh Security](https://www.g2.com/sellers/skyhigh-security-2026-07-02) - **Year Founded:** 2004 - **HQ Location:** Plano, TX - **Twitter:** @Trellix (241,168 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/skyhighsecurity/posts/?feedView=all (751 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Information Technology and Services - **Company Size:** 42% Enterprise, 29% Mid-Market #### What Are Trellix Enterprise Security Manager's Pros and Cons? **Pros:** - Log Management (3 reviews) - Dashboard Customization (1 reviews) - Dashboard Usability (1 reviews) - Debugging (1 reviews) - Ease of Use (1 reviews) **Cons:** - Difficult Customization (1 reviews) - Difficult Navigation (1 reviews) - Expensive (1 reviews) - Faulty Detection (1 reviews) - Integration Issues (1 reviews) ### What Do G2 Reviewers Say About Trellix Enterprise Security Manager? *AI-generated summary from verified user reviews* **Pros:** - Users praise the **instant access and filtering options** of Trellix Enterprise Security Manager for efficient log management. - Users find the **dashboard customization** of Trellix ESM efficient, enhancing visibility and simplifying monitoring at a glance. - Users praise the **dashboard usability** of Trellix Enterprise Security Manager, noting its clarity and efficiency for quick insights. - Users appreciate the **efficient debugging capabilities** of Trellix Enterprise Security Manager, significantly reducing troubleshooting time. - Users appreciate the **ease of use** of Trellix Enterprise Security Manager, making dashboard creation and monitoring straightforward. **Cons:** - Users find **difficult customization** of Trellix Enterprise Security Manager time-consuming, requiring technical expertise for effective use. - Users find the **difficult navigation** of Trellix Enterprise Security Manager frustrating due to its outdated UI and lack of scrollability. - Users find Trellix Enterprise Security Manager **expensive** , particularly challenging for organizations with limited budgets and large deployments. - Users express concerns over **faulty detection** , noting issues with false positives due to limited data compatibility. - Users face **integration issues** with diverse log sources, making customization time-consuming and technically challenging. #### What Are Recent G2 Reviews of Trellix Enterprise Security Manager? **"[McAfee Enterprise Log review](https://www.g2.com/survey_responses/trellix-enterprise-security-manager-review-9909615)"** **Rating:** 5.0/5.0 stars *— Nitheesh K.* [Read full review](https://www.g2.com/survey_responses/trellix-enterprise-security-manager-review-9909615) --- **"[One of the best endpoint protection in the Market!](https://www.g2.com/survey_responses/trellix-enterprise-security-manager-review-9535944)"** **Rating:** 4.0/5.0 stars *— Emmanuel D.* [Read full review](https://www.g2.com/survey_responses/trellix-enterprise-security-manager-review-9535944) --- #### What Are G2 Users Discussing About Trellix Enterprise Security Manager? - [What is MVISION ePO used for?](https://www.g2.com/discussions/what-is-mvision-epo-used-for) ### 21. [DNIF HYPERCLOUD](https://www.g2.com/products/dnif-hypercloud/reviews) DNIF HYPERCLOUD is a cloud native platform that brings the functionality of SIEM, UEBA and SOAR into a single continuous workflow to solve cybersecurity challenges at scale. DNIF HYPERCLOUD is the flagship SaaS platform from NETMONASTERY that delivers key detection functionality using big data analytics and machine learning. NETMONASTERY aims to deliver a platform that helps customers in ingesting machine data and automatically identify anomalies in these data streams using machine learning and outlier detection algorithms. The objective is to make it easy for untrained engineers and analysts to use the platform and extract benefit reliably and efficiently. **Average Rating:** 4.2/5.0 **Total Reviews:** 10 **How Do G2 Users Rate DNIF HYPERCLOUD?** - **Activity Monitoring:** 8.9/10 (Category avg: 9.1/10) - **Data Examination:** 7.8/10 (Category avg: 8.6/10) - **Ease of Use:** 8.8/10 (Category avg: 8.7/10) - **Log Management:** 8.9/10 (Category avg: 9.1/10) **Who Is the Company Behind DNIF HYPERCLOUD?** - **Seller:** [DNIF](https://www.g2.com/sellers/dnif) - **Year Founded:** 2002 - **HQ Location:** Mountain View, California - **LinkedIn® Page:** https://www.linkedin.com/company/dnif/ (59 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 45% Mid-Market, 36% Enterprise #### What Are Recent G2 Reviews of DNIF HYPERCLOUD? **"[Excellent security system](https://www.g2.com/survey_responses/dnif-hypercloud-review-6936355)"** **Rating:** 5.0/5.0 stars *— Yairlyn F.* [Read full review](https://www.g2.com/survey_responses/dnif-hypercloud-review-6936355) --- **"[Intuitive Cyber Threats Detection Platform.](https://www.g2.com/survey_responses/dnif-hypercloud-review-7014258)"** **Rating:** 4.5/5.0 stars *— Veronica D.* [Read full review](https://www.g2.com/survey_responses/dnif-hypercloud-review-7014258) --- ### 22. [Corelight](https://www.g2.com/products/corelight/reviews) Corelight's Open Network Detection and Response (NDR) Platform improves network detection coverage, accelerates incident response, and reduces operational costs by consolidating NDR, intrusion detection (IDS), and PCAP functionality in a single solution and by providing security analysts with machine learning-assisted investigations and one-click-pivots from prioritized alerts to the evidence needed to investigate and remediate them. Network Detection and Response platforms monitor and analyze network traffic, delivering telemetry into existing SIEM, XDR, or SaaS-based solutions. Corelight’s platform is unique because our detections and visibility engineering are community driven—with continuous content creation from Zeek®, Suricata IDS, and other Intel communities. And our integration with CrowdStrike XDR enables cross platform (EDR+NDR) analytics. This provides you with the most complete network visibility, powerful analytics, and threat hunting capabilities, and accelerates investigation across your entire kill chain. Corelight also delivers a comprehensive suite of network security analytics that help organizations identify more than 75 adversarial TTPs across the MITRE ATT&CK® spectrum including Exfiltration, Command and Control (C2), and Lateral Movement. These detections reveal known and unknown threats via hundreds of unique insights and alerts across machine learning, behavioral analysis, and signature-based approaches. CORELIGHT PRODUCTS + SERVICES Open NDR Platform Appliance, Cloud, Software, Virtual and SaaS Sensors IDS Fleet Manager Investigator Threat Hunting Platform Smart PCAP Corelight Training CERTIFICATIONS FIPS 140-2 **Average Rating:** 4.6/5.0 **Total Reviews:** 20 **How Do G2 Users Rate Corelight?** - **Activity Monitoring:** 9.0/10 (Category avg: 9.1/10) - **Data Examination:** 8.9/10 (Category avg: 8.6/10) - **Ease of Use:** 8.5/10 (Category avg: 8.7/10) - **Log Management:** 8.9/10 (Category avg: 9.1/10) **Who Is the Company Behind Corelight?** - **Seller:** [Corelight](https://www.g2.com/sellers/corelight) - **Year Founded:** 2013 - **HQ Location:** San Francisco, CA - **Twitter:** @corelight_inc (4,227 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/corelight (474 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Information Technology and Services, Computer & Network Security - **Company Size:** 50% Enterprise, 50% Mid-Market #### What Are Corelight's Pros and Cons? **Pros:** - Comprehensive Security (2 reviews) - Cybersecurity (2 reviews) - Network Security (2 reviews) - Security (2 reviews) - Security Features (2 reviews) **Cons:** - Complex Coding (2 reviews) - Complex Configuration (2 reviews) - Complexity (2 reviews) - Complex Setup (2 reviews) - Learning Curve (2 reviews) ### What Do G2 Reviewers Say About Corelight? *AI-generated summary from verified user reviews* **Pros:** - Users highlight the **comprehensive security** of Corelight, effectively detecting threats and presenting network events clearly. - Users value Corelight for its **great network telemetry** that simplifies security event analysis and enhances threat detection. - Users appreciate the **great network telemetry** of Corelight, making security event analysis simple and effective. - Users value the **great network telemetry** of Corelight, making security event analysis easy and effective. - Users value Corelight's **great network telemetry** , ensuring secure monitoring and easy detection of potential threats. **Cons:** - Users find the **complex coding** of Corelight challenging, especially for novice security analysts requiring costly personalized training. - Users find the **complex configuration** of Corelight challenging, especially for those lacking specialized security knowledge. - Users find Corelight's setup and management to be **complex** , requiring specialized knowledge and potentially costly personalized training. - Users find Corelight's **complex setup** challenging, requiring specialized knowledge and potentially costly personalized training. - Users find the **learning curve steep** for Corelight, making it challenging for novice analysts to utilize effectively. #### What Are Recent G2 Reviews of Corelight? **"[Best NDR solution Guardians of Network](https://www.g2.com/survey_responses/corelight-review-8692252)"** **Rating:** 5.0/5.0 stars *— Aman P.* [Read full review](https://www.g2.com/survey_responses/corelight-review-8692252) --- **"[Corelight the Threat Hunters](https://www.g2.com/survey_responses/corelight-review-11196044)"** **Rating:** 4.5/5.0 stars *— Andy V.* [Read full review](https://www.g2.com/survey_responses/corelight-review-11196044) --- ### 23. [BMC AMI Ops](https://www.g2.com/products/bmc-ami-ops/reviews) BMC AMI Ops is an AI-driven mainframe operations management solution for IBM Z environments. It helps enterprises monitor, automate, and optimize the performance and availability of mission-critical systems while reducing operational complexity and manual effort. BMC AMI Ops uses real-time monitoring, intelligent automation, and predictive analytics to detect issues early, prioritize actions, and resolve problems faster across z/OS, Db2, IMS, and supporting infrastructure. The solution enables operations teams to shift from reactive monitoring to proactive, service-focused operations. Key capabilities include: - Real-time and predictive monitoring of mainframe workloads and resources - Intelligent automation to reduce manual intervention and operator dependency - Root cause analysis and anomaly detection to accelerate problem resolution - Service-level visibility aligned to business outcomes - On-premises execution that keeps operational data on the mainframe By modernizing mainframe operations with AI and automation, BMC AMI Ops helps organizations improve system reliability, reduce downtime, and operate IBM Z environments more efficiently at scale. **Average Rating:** 4.1/5.0 **Total Reviews:** 34 **How Do G2 Users Rate BMC AMI Ops?** - **Ease of Use:** 8.3/10 (Category avg: 8.7/10) **Who Is the Company Behind BMC AMI Ops?** - **Seller:** [BMC Software](https://www.g2.com/sellers/bmc-software) - **Company Website:** https://www.bmc.com - **Year Founded:** 1980 - **HQ Location:** Houston, TX - **Twitter:** @BMCSoftware (47,946 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/1597/ (8,877 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Banking, Information Technology and Services - **Company Size:** 51% Enterprise, 31% Small-Business #### What Are Recent G2 Reviews of BMC AMI Ops? **"[AI-Driven Mainframe Observability That Predicts Issues and Cuts Costs](https://www.g2.com/survey_responses/bmc-ami-ops-review-12997111)"** **Rating:** 4.0/5.0 stars *— Aswindev P.* [Read full review](https://www.g2.com/survey_responses/bmc-ami-ops-review-12997111) --- **"[Excellent Visibility and Monitoring for Reliable System Performance](https://www.g2.com/survey_responses/bmc-ami-ops-review-12995959)"** **Rating:** 4.0/5.0 stars *— Om V.* [Read full review](https://www.g2.com/survey_responses/bmc-ami-ops-review-12995959) --- #### What Are G2 Users Discussing About BMC AMI Ops? - [What is BMC AMI Ops Automation for Capping used for?](https://www.g2.com/discussions/what-is-bmc-ami-ops-automation-for-capping-used-for) - [What is BMC Compuware ThruPut Manager used for?](https://www.g2.com/discussions/what-is-bmc-compuware-thruput-manager-used-for) - [What is BMC AMI Ops Monitoring used for?](https://www.g2.com/discussions/what-is-bmc-ami-ops-monitoring-used-for) - [What is BMC AMI Capacity and Cost used for?](https://www.g2.com/discussions/what-is-bmc-ami-capacity-and-cost-used-for) - [What is BMC AMI Cost Management used for?](https://www.g2.com/discussions/what-is-bmc-ami-cost-management-used-for) ### 24. [DICE Central Station](https://www.g2.com/products/dice-central-station/reviews) DICE Central Station is built to reduce central station activity and data entry, providing a seamless interface for operators. **Average Rating:** 4.3/5.0 **Total Reviews:** 7 **How Do G2 Users Rate DICE Central Station?** - **Activity Monitoring:** 7.9/10 (Category avg: 9.1/10) - **Data Examination:** 8.1/10 (Category avg: 8.6/10) - **Ease of Use:** 7.1/10 (Category avg: 8.7/10) - **Log Management:** 7.8/10 (Category avg: 9.1/10) **Who Is the Company Behind DICE Central Station?** - **Seller:** [DICE](https://www.g2.com/sellers/dice-53c92638-f438-43c7-92aa-99c0ae95d368) - **Year Founded:** 1985 - **HQ Location:** Bay City, US - **Twitter:** @DICECorp (1,510 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/dice-corporation/ (44 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 86% Mid-Market, 14% Small-Business #### What Are Recent G2 Reviews of DICE Central Station? **"[Dice Central Station --- "Best place to keep our data safe"](https://www.g2.com/survey_responses/dice-central-station-review-2070146)"** **Rating:** 4.5/5.0 stars *— shamroz s.* [Read full review](https://www.g2.com/survey_responses/dice-central-station-review-2070146) --- **"[Large amounts of data at your fingertips!](https://www.g2.com/survey_responses/dice-central-station-review-3632562)"** **Rating:** 5.0/5.0 stars *— Carolina V.* [Read full review](https://www.g2.com/survey_responses/dice-central-station-review-3632562) --- #### What Are G2 Users Discussing About DICE Central Station? - [What is DICE Central Station used for?](https://www.g2.com/discussions/what-is-dice-central-station-used-for) ### 25. [Logmanager](https://www.g2.com/products/logmanager/reviews) Logmanager is a log management platform enhanced with SIEM capabilities that radically simplifies response to cyberthreats, legal compliance, and troubleshooting. By transforming diverse logs, events, metrics, and traces into actionable insights, it helps security and operations teams respond swiftly to any incident. With unmatched ease of use, peerless functionality, and flexibility, Logmanager ensures control over the entire technology stack. Visit logmanager.com. **Average Rating:** 4.7/5.0 **Total Reviews:** 36 **How Do G2 Users Rate Logmanager?** - **Ease of Use:** 9.2/10 (Category avg: 8.7/10) - **Log Management:** 10.0/10 (Category avg: 9.1/10) **Who Is the Company Behind Logmanager?** - **Seller:** [Logmanager a.s.](https://www.g2.com/sellers/logmanager-a-s) - **Company Website:** https://www.logmanager.com - **Year Founded:** 2014 - **HQ Location:** Prague 5, CZ - **LinkedIn® Page:** https://www.linkedin.com/company/logmanager (22 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Computer & Network Security, Information Technology and Services - **Company Size:** 53% Small-Business, 39% Mid-Market #### What Are Logmanager's Pros and Cons? **Pros:** - Customer Support (7 reviews) - Ease of Use (7 reviews) - Log Management (7 reviews) - Efficiency (5 reviews) - Performance Efficiency (5 reviews) **Cons:** - Slow Performance (4 reviews) - Difficult Customization (3 reviews) - Lack of Automation (3 reviews) - Limited Customization (3 reviews) - Difficult Setup (2 reviews) ### What Do G2 Reviewers Say About Logmanager? *AI-generated summary from verified user reviews* **Pros:** - Users praise the **excellent customer support** of Logmanager, highlighting responsiveness and helpfulness in resolving issues. - Users appreciate the **ease of use** of Logmanager, enjoying seamless integration and intuitive features for effective monitoring. - Users find **centralized log management** in Logmanager invaluable for efficient monitoring and proactive issue resolution. - Users appreciate the **efficiency** of Logmanager, enjoying seamless integration and reliable performance with minimal oversight required. - Users highlight the **performance efficiency** of Logmanager, noting its smooth operation even with large data volumes. **Cons:** - Users experience **slow performance** when exporting large reports, impacting efficiency and overall workflow. - Users find **difficult customization** a barrier due to limited options and complex configurations for specific needs. - Users find the **lack of automation** in Logmanager cumbersome, particularly for backups and API functionality. - Users find the **limited customization** options in Logmanager hinder their ability to tailor the software to their needs. - Users find the **difficult setup** process for Logmanager cumbersome, needing manual configurations for backups. #### What Are Recent G2 Reviews of Logmanager? **"[Streamlined our log management](https://www.g2.com/survey_responses/logmanager-review-11722088)"** **Rating:** 5.0/5.0 stars *— mikhail S.* [Read full review](https://www.g2.com/survey_responses/logmanager-review-11722088) --- **"[A simple tool with great benefits](https://www.g2.com/survey_responses/logmanager-review-11079398)"** **Rating:** 5.0/5.0 stars *— Verified User in Hospital & Health Care* [Read full review](https://www.g2.com/survey_responses/logmanager-review-11079398) --- ## What Is Security Information and Event Management (SIEM) Software? [System Security Software](https://www.g2.com/categories/system-security) ## What Software Categories Are Similar to Security Information and Event Management (SIEM) Software? - [Incident Response Software](https://www.g2.com/categories/incident-response) - [Log Analysis Software](https://www.g2.com/categories/log-analysis) - [Log Monitoring Software](https://www.g2.com/categories/log-monitoring) - [Security Orchestration, Automation, and Response (SOAR) Software](https://www.g2.com/categories/security-orchestration-automation-and-response-soar) - [User and Entity Behavior Analytics (UEBA) Software](https://www.g2.com/categories/user-and-entity-behavior-analytics-ueba) - [Cloud Security Monitoring and Analytics Software](https://www.g2.com/categories/cloud-security-monitoring-and-analytics) - [Extended Detection and Response (XDR) Platforms](https://www.g2.com/categories/extended-detection-and-response-xdr-platforms) --- ## How Do You Choose the Right Security Information and Event Management (SIEM) Software? ### What You Should Know About SIEM Software ### What is security information and event management (SIEM) software? Security Information and Event Management (SIEM) is a centralized system for threat detection that aggregates security alerts from multiple sources, simplifying threat response and compliance reporting. SIEM software is one of the most commonly used tools for security administrators and security incident response professionals. They provide a single platform capable of facilitating event and threat protection, log analysis and investigation, and threat remediation. Some cutting-edge tools provide additional functionality for creating response workflows, data normalization, and advanced threat protection. SIEM platforms help security programs operate by collecting security data for future analysis, storing these data points, correlating them to security events, and facilitating analysis of those events. Security teams can define rules for typical and suspicious activities with SIEM tools. Advanced Next-Gen SIEM solutions leverage [machine learning](https://www.g2.com/articles/what-is-machine-learning) and [AI](https://www.g2.com/articles/what-is-artificial-intelligence) to refine behavior models continuously, enhancing [User and Entity Behavior Analytics (UEBA)](https://www.g2.com/categories/user-and-entity-behavior-analytics-ueba) and reducing false positives. These systems analyze data against set rules and behavioral patterns, flagging notable events when anomalies are detected. Companies using SIEM solutions deploy sensors across digital assets to automate data collection. Sensors relay information back to the SIEM’s log and event database. When additional security incidents arise, the SIEM platform detects anomalies. It correlates similar logs to provide context and threat information for security teams as they attempt to remediate any existing threats or vulnerabilities. #### **What does SIEM stand for?** SIEM stands for security information and event management (SIEM), which is a combination of two different acronyms for security technology: security information monitoring (SIM) and security event management (SEM). SIM is the practice of collecting, aggregating, and analyzing security data, typically in the form of logs. SIM tools automate this process and document security information for other sources, such as [intrusion detection systems](https://www.g2.com/categories/intrusion-detection-and-prevention-systems-idps), [firewalls](https://www.g2.com/categories/firewall-software), or [routers](https://www.g2.com/categories/routers). Event logs and their associated informational components are recorded and stored for long periods for either retrospective analysis or compliance requirements. SEM is a family of security software for discovering, analyzing, visualizing, and responding to threats as they arise. SEM is a core component of a security operations system. While SIM tools are designed for log collection and storage, SEM tools typically rely on SQL databases to store specific logs and other event data as they are generated in real time by security devices and IT systems. They usually also provide the functionality to correlate and analyze event data, monitor systems in real time, and alert security teams of abnormal activity. SIEM combines the functionality of SIM and SEM to centralize control over log storage, event management, and real-time analysis. SIM and SEM have become defunct technologies, as SIEM’s rise has provided dual-purpose functionality. SIEM vendors offer a single tool capable of performing data aggregation, information correlation, and event management. ### Types of SIEM solutions #### **Traditional SIEM** Traditional SIEM tools are deployed on-premises with sensors placed on IT assets to analyze events and collect system logs. The data is used to develop baseline references and identify indicators of compromise. The SIEM product alerts security teams for intervention when a system becomes compromised.  #### **Cloud or virtual SIEM** Cloud-based and virtualized SIEM software are tools typically used to secure cloud infrastructure and services a cloud provider delivers. These tools are often less expensive than on-premises solutions and more accessible to implement, as no physical labor is required. They are ideal for companies without local IT infrastructure. #### [**Managed SIEM services**](https://www.g2.com/categories/managed-siem-services) Companies that do not have a full-fledged security program may choose managed SIEM services to aid in management and reduce work for internal employees. These SIEM services are delivered by managed service providers who provide the customer data and dashboards with security information and activity, but the provider handles implementation and remediation.  ### What are the common features of SIEM systems? The following are some core features within SIEM software that can help users collect security data, analyze logs, and detect threats: **Activity monitoring:** SIEM systems document the actions from endpoints within a network. The system alerts users of incidents and abnormal activities and documents the access point. Real-time tracking will document these for analysis as an event takes place. **Asset management:** These SIEM features keep records of each network asset and its activity. The feature may also refer to the discovery of new assets accessing the network. **Log management:** This functionality documents and stores event logs in a secure repository for reference, analysis, or compliance reasons. **Event management:** As events occur in real time, the SIEM software alerts users of incidents. This allows security teams to intervene manually or trigger an automated response to resolve the issue. [**Automated response**](https://www.g2.com/categories/security-information-and-event-management-siem/f/automated-response) **:** Response automation reduces the time spent diagnosing and resolving issues manually. The features are typically capable of quickly resolving common network security incidents. **Incident reporting:** Incident reports document cases of abnormal activity and compromised systems. These can be used for forensic analysis or as a reference point for future incidents. **Threat intelligence:** Threat intelligence feeds integrate information to train SIEM systems to detect emerging and existing threats. These threat feeds store information related to potential threats and vulnerabilities to ensure issues are discovered and teams are provided with the information necessary to resolve the problems as they occur. [**Vulnerability assessment**](https://www.g2.com/categories/security-information-and-event-management-siem/f/vulnerability-assessment) **:** Vulnerability assessment tools may scan networks for potential vulnerabilities or audit data to discover non-compliant practices. Mainly, they’re used to analyze an existing network and IT infrastructure to outline access points that can be easily compromised. [**Advanced analytics**](https://www.g2.com/categories/security-information-and-event-management-siem/f/advanced-analytics) **:** Advanced analytics features allow users to customize analysis with granular or individually specific metrics pertinent to the business’ resources. [**Data examination**](https://www.g2.com/categories/security-information-and-event-management-siem/f/data-examination) **:** Data examination features typically facilitate the forensic analysis of incident data and event logs. These features allow users to search databases and incident logs to gain insights into vulnerabilities and incidents. ### What are the benefits of using SIEM products? Below are a few of the main reasons SIEM software is commonly used to protect businesses of all sizes: **Data aggregation and correlation:** SIEM systems and companies collect vast amounts of information from an entire network environment. This information is gathered from virtually anything interacting with a network, from endpoints and servers to firewalls and antivirus tools. It is either given directly to the SIEM or using agents (decision-making programs designed to identify irregular information). The platform is set up to deploy agents and collect and store similar information together according to security policies set in place by administrators. **Incident alerting:** As information comes in from a network’s various connected components, the SIEM system correlates it using rule-based policies. These policies inform agents of normal behavior and threats. If any action violates these policies or malware or intrusion is discovered. At the same time, the SIEM platform monitors network activity; it is labeled as suspicious, security controls restrict access, and administrators are alerted. **Security analysis:** Retrospective analysis may be performed by searching log data during specific periods or based on specific criteria. Security teams may suspect a certain misconfiguration or kind of malware caused an event. They may also suspect an unapproved party went undetected at a specific time. Teams will analyze the logs and look for specific characteristics in the data to determine whether their suspicion was right. They may also discover vulnerabilities or misconfigurations that leave them susceptible to attack and remediate them. ### Software related to SIEM tools Many network and system security solutions involve collecting and analyzing event logs and security information. SIEM systems are typically the most all-encompassing solutions available, but many other security solutions may integrate with them for added functionality or complementary use. These are a few different technology categories related to SIEM software. [Threat intelligence software](https://www.g2.com/categories/threat-intelligence) **:** Threat intelligence software is an informational service that provides SIEM tools and other information security systems with up-to-date information on web-based threats. They can inform the system of zero-day threats, new forms of malware, potential exploits, and different kinds of vulnerabilities. [Incident response software](https://www.g2.com/categories/incident-response) **:** SIEM systems may facilitate incident response, but these tools are specifically designed to streamline the remediation process or add investigative capabilities during security workflow processes. Incident response solutions will not provide the same compliance maintenance or log storage capabilities. Still, they can be used to increase a team’s ability to tackle threats as they emerge. [Network security policy management (NSPM) software](https://www.g2.com/categories/network-security-policy-management-nspm) **:** NSPM software has some overlapping functionality to ensure security hardware and IT systems are correctly configured but cannot detect and resolve threats. They are typically used to ensure devices like firewalls or DNS filters are functioning correctly and in alignment with the security rules put in place by security teams. [Intrusion detection and prevention systems (IDPS)](https://www.g2.com/categories/intrusion-detection-and-prevention-systems-idps) **:** While SIEM systems specialize in log management, alerting, and correlation, IDPS provide additional detection and protection features to prevent unapproved parties from accessing sensitive systems and network breaches. However, they will not facilitate the analysis and forensic investigation of logs with the same level of detail as an SIEM system. [Managed security services providers](https://www.g2.com/categories/managed-security-services) **:** Various managed security services are available for businesses without the resources or staff necessary to operate a full-fledged security administration and operations team. Managed services are a viable option and will provide companies with skilled staff to protect their customers’ systems and keep their sensitive information protected. ### Challenges with SIEM software **Staffing:** There is an existing shortage of skilled security professionals. Managing SIEM products and maintaining a well-rounded security posture requires dedicated personnel with highly specialized skills. Some smaller or growing companies may not have the means to recruit, hire, and retain qualified security pros. In such cases, businesses can consider managed services to outsource the labor.  **Compliance:** Some industries have specific compliance requirements determined by various governing bodies, but SIEM software can be used across several industries to maintain compliance standards. Many industry-specific compliance requirements exist, but most require security teams to protect sensitive data, restrict access to unapproved parties, and monitor changes made to identities, information, or privileges. For example, SIEM systems can maintain GDPR compliance by verifying security controls and data access, facilitating long-term storage of log data, and notifying security staff of security incidents, as GDPR requires. ### Which companies should buy SIEM solutions? **Vertical industries:** Vertical industries, such as healthcare and financial services, often have additional compliance requirements related to data protection and privacy. SIEM is an ideal solution for outlining requirements, mapping threats, and remediating vulnerabilities.  **SaaS business:** SaaS businesses utilizing resources from a cloud service provider are still responsible for a significant portion of the security efforts required to protect a cloud-native business. These companies may jump for cloud-native SIEM tools but will benefit from any SIEM to prevent, detect, and respond to threats.  ### How to choose the best SIEM software #### Requirements Gathering (RFI/RFP) for Security Information and Event Management (SIEM) Software The first step to purchasing a SIEM solution is to outline the options. Companies should be sure whether they need a cloud-based or on-premises solution. They should also outline the number of interconnected devices they need and whether they want physical or virtual sensors to secure them. Additional and possibly obvious requirements should include budgetary considerations, staffing limitations, and required integrations_. _ #### **Compare Security Information and Event Management (SIEM) Software Products** ##### **Create a long list** Once the requirements are outlined, buyers should prioritize the tools and identify the ones with as many features as possible that fit the budget window. It is recommended to restrict the list to products with desired features, pricing, and deployment methods to identify a dozen or so options. For example, if the business needs a cloud-native SIEM for less than $10k a year, half of the SIEM options will be eliminated.  When choosing a SIEM provider, focus on the vendor’s experience, reputation, and specific functionality relevant to your security needs. Core capabilities ensure essential threat detection, while next-gen features add advanced intelligence and automation, allowing for a more proactive security posture. Here’s a breakdown to guide your selection: **Core SIEM capabilities** - Threat detection: Look for SIEMs with robust threat detection, which uses rules and behavioral analytics, along with threat feed integration, to accurately identify potential threats. - Threat intelligence and security alerting: Leading SIEMs incorporate threat intelligence feeds, aggregate security data, and alert you when suspicious activities are detected, ensuring real-time updates on evolving threats. - Compliance reporting: Compliance support is crucial, especially for meeting standards like HIPAA, PCI, and FFIEC. SIEMs streamline compliance assessment and reporting, helping prevent costly non-compliance. - Real-time notifications: Swift alerts are vital; SIEMs that notify you of breaches immediately enable faster responses to potential threats. - Data aggregation: A centralized view of all network activities ensures no area is left unmonitored, which is crucial for comprehensive threat visibility as your organization scales. - Data normalization: SIEMs that normalize incoming data make it easier to analyze security events and extract actionable insights from disparate sources. **Next-gen SIEM capabilities** - Data collection and management: Next-gen SIEMs pull data from the cloud, on-premises, and external devices, consolidating insights across the entire IT environment. - Cloud delivery: Cloud-based SIEMs use scalable storage, accommodating large data volumes without the limitations of on-premises hardware. - User and entity behavior analytics (UEBA): By establishing normal user behavior and identifying deviations, UEBA helps detect insider threats and new, unknown threats. - Security orchestration and automation response (SOAR): SOAR automates incident response, integrates with IT infrastructure, and enables coordinated responses across firewalls, email servers, and access controls. - Automated attack timelines: Next-gen SIEMs automatically create visual attack timelines, simplifying investigation and triage, even for less experienced analysts. Selecting an SIEM vendor with both core and next-gen capabilities offers your organization a comprehensive and agile approach to security, meeting both current and future requirements. ##### **Create a short list** Narrowing down a short list can be tricky, especially for the indecisive, but these decisions must be made. Once the long list is limited to affordable products with the desired features, it’s time to search for third-party validation. For each tool, the buyer must analyze end-user reviews, analyst reports, and empirical security evaluations. Combining these specified factors should help rank options and eliminate poorly performing products. _ _ ##### **Conduct demos** With the list narrowed down to three to five possible products, businesses can contact vendors and schedule demos. This will help them get first-hand experience with the product, ask targeted questions, and gauge the vendors' quality of service.  Here are some essential questions to guide your decision: - Will the tool enhance log collection and management?: Effective log collection is foundational. Look for compatible software across systems and devices, offering a user-friendly dashboard for streamlined monitoring. - Does the tool support compliance efforts? Even if compliance isn't a priority, choosing an SIEM that facilitates auditing and reporting can future-proof your operations. Look for tools that simplify compliance processes and reporting. - Can the tool leverage past security events in threat response? One of SIEM’s strengths is using historical data to inform future threat detection. Ensure the tool offers in-depth analytics and drill-down capabilities to analyze and act on past incidents. - Is the incident response fast and automated? Timely, effective responses are critical. The tool should provide customizable alerts that notify your team immediately when needed so you can confidently leave the dashboard.  #### Selection of Security Information and Event Management (SIEM) Software ##### **Choose a selection team** Decision-makers need to involve subject matter experts from all teams that will use the system in choosing a selection team. For backup software, this primarily involves product managers, developers, IT, and security staff. Any manager or department-level leader should also include individuals managing any solution the backup product will be integrating with.  ##### **Negotiation** The seniority of the negotiation team may vary depending on the maturity of the business. It is advisable to include relevant directors or managers from the security and IT departments as well as from any other cross-functional departments that may be impacted. ##### **Final decision** If the company has a chief information security officer (CISO), that individual will likely decide. If not, companies must trust their security professionals’ ability to use and understand the product.  ### How much does SIEM software cost? Potential growth should be considered if the buyer chooses a cloud-based SIEM tool that offers pricing on the SaaS pay-as-you-use model. Some solutions are inexpensive at the start and offer affordable, low-tier pricing. Alternatively, some may rapidly increase pricing and fees as the company and storage need to scale. Some vendors provide permanently free backup products for individuals or small teams. **Cloud SIEM_:_** SIEM as a service pricing may vary, but it traditionally scales as storage increases. Additional costs may come from increased features such as automated remediation, security orchestration, and integrated threat intelligence.  **On-premises SIEM:** On-premises solutions are typically more expensive and require more effort and resources. They will also be more costly to maintain and require dedicated staff. Still, companies with high compliance requirements should adopt on-premises security regardless.  #### Return on Investment (ROI) Cloud-based SIEM solutions will provide a quicker ROI, similar to their lower average cost. The situation is pretty cut and dry since there is much lower initial investment and lower demand for dedicated staffing.  However, for on-premises systems, the ROI will depend on the scale and scope of business IT systems. Hundreds of servers will require hundreds of sensors, potentially more, as time wears on computing equipment. Once implemented, they must be operated and maintained by (expensive) security professionals.