# Best Enterprise Security Information and Event Management (SIEM) Software

  *By [Brandon Summers-Miller](https://research.g2.com/insights/author/brandon-summers-miller)*

   Products classified in the overall Security Information and Event Management (SIEM) category are similar in many regards and help companies of all sizes solve their business problems. However, enterprise business features, pricing, setup, and installation differ from businesses of other sizes, which is why we match buyers to the right Enterprise Business Security Information and Event Management (SIEM) to fit their needs. Compare product ratings based on reviews from enterprise users or connect with one of G2's buying advisors to find the right solutions within the Enterprise Business Security Information and Event Management (SIEM) category.

In addition to qualifying for inclusion in the Security Information and Event Management (SIEM) Software category, to qualify for inclusion in the Enterprise Business Security Information and Event Management (SIEM) Software category, a product must have at least 10 reviews left by a reviewer from an enterprise business.





## Category Overview

**Total Products under this Category:** 117


## Trust & Credibility Stats

**Why You Can Trust G2's Software Rankings:**

- 30 Analysts and Data Experts
- 5,500+ Authentic Reviews
- 117+ Products
- Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.


## Best Security Information and Event Management (SIEM) Software At A Glance

- **Best for Small Businesses:** [Todyl Security Platform](https://www.g2.com/products/todyl-security-platform/reviews)
- **Best for Mid-Market:** [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews)
- **Best for Enterprise:** [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews)
- **Highest User Satisfaction:** [Todyl Security Platform](https://www.g2.com/products/todyl-security-platform/reviews)
- **Best Free Software:** [IBM QRadar SIEM](https://www.g2.com/products/ibm-ibm-qradar-siem/reviews)


---

**Sponsored**

### EventSentry

EventSentry is a hybrid Security Information and Event Management (SIEM) solution designed to assist users in monitoring and managing their IT infrastructure effectively. By combining real-time event log monitoring with comprehensive system health and network monitoring, EventSentry provides a holistic view of servers and endpoints, enabling organizations to maintain robust security and operational efficiency. This SIEM solution is particularly beneficial for IT security teams, system administrators, and compliance officers who require a centralized platform to oversee their network's security posture. It caters to various industries, including finance, healthcare, and technology, where data integrity and security are paramount. The product is designed for organizations of all sizes, from small businesses to large enterprises, looking to enhance their security monitoring capabilities while ensuring system health. One of the standout features of EventSentry is its security event log normalization and correlation engine. This functionality transforms cryptic Windows security events into easily understandable reports, providing users with valuable insights that go beyond raw event data. The descriptive email alerts generated by the system offer additional context, allowing users to respond swiftly to potential security incidents. This capability is crucial for organizations that need to comply with regulatory requirements and maintain a proactive security stance. Moreover, EventSentry includes 200 compliance and security checks that strengthen security settings and reduce the attack surface - proactively identifying issues before they become liabilities. Malware & Ransomware attacks can be mitigated and detected in real time with innovative process activity monitoring and a flexible anomaly detection engine that can reveal suspicious patterns across any log source. EventSentry supports various integrations, making it adaptable to existing IT environments. This flexibility allows organizations to incorporate the SIEM solution seamlessly into their current systems, enhancing their overall security framework without significant disruption. The multi-tenancy feature further enables organizations to manage multiple clients or departments from a single platform, making it an ideal choice for managed service providers or organizations with diverse operational needs. In summary, EventSentry stands out in the SIEM category by providing a comprehensive approach to security and system monitoring. Its combination of real-time log analysis, health monitoring, and user-friendly reporting equips organizations with the tools necessary to safeguard their digital assets effectively. By leveraging this hybrid SIEM solution, users can achieve a clearer understanding of their security landscape, facilitating informed decision-making and enhancing overall cybersecurity resilience.



[Visit website](https://www.g2.com/external_clickthroughs/record?secure%5Bad_program%5D=ppc&secure%5Bad_slot%5D=category_product_list&secure%5Bcategory_id%5D=1081&secure%5Bdisplayable_resource_id%5D=1081&secure%5Bdisplayable_resource_type%5D=Category&secure%5Bmedium%5D=sponsored&secure%5Bplacement_reason%5D=page_category&secure%5Bplacement_resource_ids%5D%5B%5D=1081&secure%5Bprioritized%5D=false&secure%5Bproduct_id%5D=23676&secure%5Bresource_id%5D=1081&secure%5Bresource_type%5D=Category&secure%5Bsource_type%5D=category_page&secure%5Bsource_url%5D=https%3A%2F%2Fwww.g2.com%2Fcategories%2Fsecurity-information-and-event-management-siem&secure%5Btoken%5D=d2fbc10b3ec03ea5ace75671ba4fb6981e96cf508235aed3223c84965e8b6b72&secure%5Burl%5D=https%3A%2F%2Fwww.eventsentry.com%2Fdownloads%2Ftrial&secure%5Burl_type%5D=free_trial&secure%5Bvisitor_segment%5D=180)

---

## Top-Rated Products (Ranked by G2 Score)
### 1. [CrowdStrike Falcon Endpoint Protection Platform](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews)
  Organizations today face a serious challenge: managing numerous security vendors and tools while confronting an ever-evolving threat landscape. Sophisticated adversaries are becoming smarter, faster, and more evasive, launching complex attacks that can strike in minutes or even seconds. Traditional security approaches struggle to keep pace, leaving businesses vulnerable. The CrowdStrike Falcon Platform addresses this by offering a unified, cloud-native solution. It consolidates previously siloed security solutions and incorporates third-party data into a single platform with one efficient and resource-conscious agent, leveraging advanced AI and real-time threat intelligence. This approach simplifies security operations, speeds analyst decision making, and enhances protection to stop the breach, allowing organizations to reduce risk with less complexity and lower costs. CrowdStrike's Falcon Platform includes: - Endpoint Security: Secure the endpoint, stop the breach - Identify Protection: Identity is the front line, defend it - Next-Gen SIEM: The future of SIEM, today - Data Protection: Real-time data protection from endpoint to cloud - Exposure Management: Understand risk to stop breaches - Charlotte AI: Powering the next evolution of the SOC


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 369

**User Satisfaction Scores:**

- **Activity Monitoring:** 9.5/10 (Category avg: 9.0/10)
- **Data Examination:** 8.8/10 (Category avg: 8.6/10)
- **Ease of Use:** 9.0/10 (Category avg: 8.7/10)
- **Log Management:** 8.6/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [CrowdStrike](https://www.g2.com/sellers/crowdstrike)
- **Company Website:** https://www.crowdstrike.com
- **Year Founded:** 2011
- **HQ Location:** Sunnyvale, CA
- **Twitter:** @CrowdStrike (110,324 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/2497653/ (11,258 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** Security Analyst, Cyber Security Analyst
  - **Top Industries:** Information Technology and Services, Computer & Network Security
  - **Company Size:** 47% Enterprise, 42% Mid-Market


#### Pros & Cons

**Pros:**

- Features (113 reviews)
- Threat Detection (103 reviews)
- Ease of Use (98 reviews)
- Security (97 reviews)
- Detection (86 reviews)

**Cons:**

- Expensive (54 reviews)
- Complexity (39 reviews)
- Learning Curve (35 reviews)
- Limited Features (31 reviews)
- Pricing Issues (29 reviews)

### 2. [Microsoft Sentinel](https://www.g2.com/products/microsoft-sentinel/reviews)
  Microsoft Sentinel lets you see and stop threats before they cause harm, with SIEM reinvented for a modern world. Microsoft Sentinel is your birds-eye view across the enterprise. Put the cloud and large-scale intelligence from decades of Microsoft security experience to work. Make your threat detection and response smarter and faster with artificial intelligence (AI). Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can: - Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds - Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft - Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft -Respond to incidents rapidly with built-in orchestration and automation of common tasks


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 270

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.9/10 (Category avg: 9.0/10)
- **Data Examination:** 8.5/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.5/10 (Category avg: 8.7/10)
- **Log Management:** 8.8/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Microsoft](https://www.g2.com/sellers/microsoft)
- **Year Founded:** 1975
- **HQ Location:** Redmond, Washington
- **Twitter:** @microsoft (13,114,353 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/microsoft/ (227,697 employees on LinkedIn®)
- **Ownership:** MSFT

**Reviewer Demographics:**
  - **Who Uses This:** Senior Software Engineer, Cyber Security Analyst
  - **Top Industries:** Information Technology and Services, Computer & Network Security
  - **Company Size:** 42% Enterprise, 31% Mid-Market


#### Pros & Cons

**Pros:**

- Cloud Services (4 reviews)
- Easy Integrations (4 reviews)
- Features (4 reviews)
- Integrations (4 reviews)
- Integration Support (4 reviews)

**Cons:**

- Expensive (3 reviews)
- Complex Implementation (2 reviews)
- Complex Setup (2 reviews)
- Inefficient Alerts (2 reviews)
- Integration Issues (2 reviews)

### 3. [Splunk Enterprise](https://www.g2.com/products/splunk-enterprise/reviews)
  Find out what is happening in your business and take meaningful action quickly with Splunk Enterprise. Automate the collection, indexing and alerting of machine data that's critical to your operations. Uncover the actionable insights from all your data — no matter the source or format. Leverage artificial intelligence and machine learning for predictive and proactive business decisions.


  **Average Rating:** 4.3/5.0
  **Total Reviews:** 411

**User Satisfaction Scores:**

- **Activity Monitoring:** 9.1/10 (Category avg: 9.0/10)
- **Data Examination:** 8.4/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.1/10 (Category avg: 8.7/10)
- **Log Management:** 9.3/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Cisco](https://www.g2.com/sellers/cisco)
- **Year Founded:** 1984
- **HQ Location:** San Jose, CA
- **Twitter:** @Cisco (721,495 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/cisco/ (95,742 employees on LinkedIn®)
- **Ownership:** NASDAQ:CSCO

**Reviewer Demographics:**
  - **Who Uses This:** Software Engineer, Senior Software Engineer
  - **Top Industries:** Information Technology and Services, Computer Software
  - **Company Size:** 64% Enterprise, 27% Mid-Market


#### Pros & Cons

**Pros:**

- Ease of Use (10 reviews)
- Log Management (8 reviews)
- Dashboards (6 reviews)
- Data Analysis (6 reviews)
- User Interface (5 reviews)

**Cons:**

- Expensive (8 reviews)
- Learning Curve (8 reviews)
- High Resource Consumption (4 reviews)
- Licensing Issues (4 reviews)
- Pricing Issues (4 reviews)

### 4. [Splunk Enterprise Security](https://www.g2.com/products/splunk-enterprise-security/reviews)
  Splunk Enterprise Security (ES) is a data-centric, modern security information and event management (SIEM) solution that delivers data-driven insights for full breadth visibility into your security posture so you can protect your business and mitigate risk at scale. With unparalleled search and reporting, advanced analytics, integrated intelligence, and prepackaged security content, Splunk ES accelerates threat detection and investigation, letting you determine the scope of high-priority threats to your environment so you can quickly take action. Built on an open and scalable data platform, you can stay agile in the face of evolving threats and business needs. Our extensive ecosystem of Splunk, partner, and community-built integrations as well as flexible deployment options ensure your technology investments are working in tandem with Splunk ES whilst meeting you wherever you are on your cloud, multi-cloud, or hybrid journey.


  **Average Rating:** 4.3/5.0
  **Total Reviews:** 222

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.7/10 (Category avg: 9.0/10)
- **Data Examination:** 8.5/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.1/10 (Category avg: 8.7/10)
- **Log Management:** 9.3/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Cisco](https://www.g2.com/sellers/cisco)
- **Year Founded:** 1984
- **HQ Location:** San Jose, CA
- **Twitter:** @Cisco (721,495 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/cisco/ (95,742 employees on LinkedIn®)
- **Ownership:** NASDAQ:CSCO

**Reviewer Demographics:**
  - **Who Uses This:** Software Engineer, Senior Software Engineer
  - **Top Industries:** Information Technology and Services, Computer Software
  - **Company Size:** 59% Enterprise, 30% Mid-Market


#### Pros & Cons

**Pros:**

- Easy Integrations (3 reviews)
- Alerting (2 reviews)
- Customer Support (2 reviews)
- Dashboard Usability (2 reviews)
- Ease of Use (2 reviews)

**Cons:**

- Expensive (3 reviews)
- Complex Setup (2 reviews)
- Integration Issues (2 reviews)
- Resource Management (2 reviews)
- Complex Configuration (1 reviews)

### 5. [IBM QRadar SIEM](https://www.g2.com/products/ibm-ibm-qradar-siem/reviews)
  IBM Security QRadar SIEM is more than a tool, it is a teammate for SOC analysts - with advanced AI, powerful threat intelligence, and access to the latest detection content. IBM Security QRadar SIEM leverages multiple layers of AI and automation to enhance alert enrichment, threat prioritization, and incident correlation - presenting related alerts cohesively in a unified dashboard, reducing noise and saving time. QRadar SIEM helps maximize security team’s productivity by providing a unified experience across all SOC tools, with advanced AI and automation capabilities. ' IBM QRadar SIEM offers two editions tailored to meet your organization’s needs – Cloud Native and Classic. Whether your organization needs cloud-native architecture built for hybrid scale and speed or a solution to complement your on-premises infrastructure, we have you covered. IBM Security QRadar SIEM is available on AWS Marketplace.


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 280

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.7/10 (Category avg: 9.0/10)
- **Data Examination:** 8.3/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.4/10 (Category avg: 8.7/10)
- **Log Management:** 8.8/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [IBM](https://www.g2.com/sellers/ibm)
- **Year Founded:** 1911
- **HQ Location:** Armonk, NY
- **Twitter:** @IBM (709,390 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/1009/ (324,553 employees on LinkedIn®)
- **Ownership:** SWX:IBM

**Reviewer Demographics:**
  - **Top Industries:** Computer & Network Security
  - **Company Size:** 53% Enterprise, 29% Mid-Market


### 6. [Datadog](https://www.g2.com/products/datadog/reviews)
  Datadog is the monitoring, security and analytics platform for developers, IT operations teams, security engineers and business users in the cloud age. The SaaS platform integrates and automates infrastructure monitoring, application performance monitoring and log management to provide unified, real-time observability of our customers' entire technology stack. Datadog is used by organizations of all sizes and across a wide range of industries to enable digital transformation and cloud migration, drive collaboration among development, operations, security and business teams, accelerate time to market for applications, reduce time to problem resolution, secure applications and infrastructure, understand user behavior and track key business metrics.


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 688

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.9/10 (Category avg: 9.0/10)
- **Data Examination:** 8.6/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.2/10 (Category avg: 8.7/10)
- **Log Management:** 9.5/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Datadog](https://www.g2.com/sellers/datadog)
- **Company Website:** https://www.datadoghq.com/
- **Year Founded:** 2010
- **HQ Location:** New York
- **Twitter:** @datadoghq (50,945 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/1066442/ (10,625 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** Software Engineer, DevOps Engineer
  - **Top Industries:** Information Technology and Services, Computer Software
  - **Company Size:** 47% Mid-Market, 33% Enterprise


#### Pros & Cons

**Pros:**

- Ease of Use (145 reviews)
- Monitoring (144 reviews)
- Real-time Monitoring (122 reviews)
- Features (93 reviews)
- Analytics (88 reviews)

**Cons:**

- Expensive (92 reviews)
- Learning Curve (73 reviews)
- Pricing Issues (71 reviews)
- Cost (65 reviews)
- Learning Difficulty (56 reviews)

### 7. [Sumo Logic](https://www.g2.com/products/sumo-logic/reviews)
  Sumo Logic, Inc. unifies and analyzes enterprise data, translating it into actionable insights through one AI-powered cloud-native log analytics platform. This single source of truth enables Dev, Sec and Ops teams to simplify complexity, collaborate efficiently and accelerate data-driven decisions that drive business value. Customers around the world rely on the Sumo Logic SaaS Log Analytics Platform for trusted insights to ensure application reliability, secure and protect against modern security threats, and gain insights into their cloud infrastructures. For more information, visit: SUMOLOGIC.COM


  **Average Rating:** 4.3/5.0
  **Total Reviews:** 381

**User Satisfaction Scores:**

- **Activity Monitoring:** 9.1/10 (Category avg: 9.0/10)
- **Data Examination:** 8.9/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.2/10 (Category avg: 8.7/10)
- **Log Management:** 9.4/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Sumo Logic](https://www.g2.com/sellers/sumo-logic)
- **Company Website:** https://www.sumologic.com
- **Year Founded:** 2010
- **HQ Location:** Redwood City, CA
- **Twitter:** @SumoLogic (6,525 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/1037816/ (808 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** Software Engineer, Senior Software Engineer
  - **Top Industries:** Information Technology and Services, Computer Software
  - **Company Size:** 49% Mid-Market, 37% Enterprise


#### Pros & Cons

**Pros:**

- Ease of Use (63 reviews)
- Log Management (46 reviews)
- Features (37 reviews)
- Real-time Monitoring (37 reviews)
- Insights (35 reviews)

**Cons:**

- Difficult Learning (21 reviews)
- Learning Curve (21 reviews)
- Learning Difficulty (21 reviews)
- Expensive (19 reviews)
- Slow Performance (18 reviews)

### 8. [Panther](https://www.g2.com/products/panther/reviews)
  Panther is the AI SOC Platform that scales security expertise by embedding AI agents across your security operations with native access to your data lake, detection logic, and organizational knowledge. Unlike bolt-on tools, Panther's closed-loop architecture turns every alert into compounding intelligence that makes the system smarter over time. Request a demo today at: https://panther.com/product/request-a-demo/


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 46

**User Satisfaction Scores:**

- **Activity Monitoring:** 9.3/10 (Category avg: 9.0/10)
- **Data Examination:** 9.4/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.8/10 (Category avg: 8.7/10)
- **Log Management:** 9.7/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Panther Labs](https://www.g2.com/sellers/panther-labs)
- **Company Website:** https://panther.com/
- **Year Founded:** 2018
- **HQ Location:** San Francisco, CA
- **Twitter:** @runpanther (4,442 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/runpanther/ (286 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services, Computer Software
  - **Company Size:** 54% Mid-Market, 26% Enterprise


#### Pros & Cons

**Pros:**

- Customer Support (12 reviews)
- Detection Efficiency (9 reviews)
- Ease of Use (9 reviews)
- Features (9 reviews)
- Easy Integrations (7 reviews)

**Cons:**

- Alert Management (3 reviews)
- Complex Configuration (3 reviews)
- Dashboard Issues (3 reviews)
- Limited Access (3 reviews)
- Immaturity (2 reviews)

### 9. [Palo Alto Cortex XSIAM](https://www.g2.com/products/palo-alto-cortex-xsiam/reviews)
  Product Description: Palo Alto Networks' Cortex XSIAM is an AI-driven security operations platform designed to transform traditional Security Operations Centers by integrating and automating key functions such as data centralization, threat detection, and incident response. By leveraging machine learning and automation, it enables organizations to detect and respond to threats more efficiently, reducing manual workloads and improving overall security posture. Key Features and Functionality: - Data Centralization: Aggregates data from various sources into a unified platform, providing comprehensive visibility across the enterprise. - AI-Powered Threat Detection: Utilizes machine learning algorithms to identify anomalies and potential threats in real-time. - Automated Incident Response: Streamlines response processes through automation, enabling rapid mitigation of security incidents. - Integrated SOC Capabilities: Combines functions such as Extended Detection and Response , Security Orchestration, Automation, and Response , Attack Surface Management , and Security Information and Event Management into a cohesive platform, eliminating the need for multiple disparate tools. - Scalability: Designed to handle large volumes of data and adapt to the evolving needs of modern enterprises. Primary Value and Problem Solved: Cortex XSIAM addresses the challenges of disjointed data, weak threat defense, and heavy reliance on manual work in traditional SOCs. By centralizing data and automating security operations, it simplifies processes, enhances threat detection accuracy, and accelerates incident response times. This transformation enables organizations to proactively outpace threats, reduce operational costs, and achieve a more robust security posture.


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 61

**User Satisfaction Scores:**

- **Activity Monitoring:** 9.1/10 (Category avg: 9.0/10)
- **Data Examination:** 8.3/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.4/10 (Category avg: 8.7/10)
- **Log Management:** 9.1/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Palo Alto Networks](https://www.g2.com/sellers/palo-alto-networks)
- **Year Founded:** 2005
- **HQ Location:** Santa Clara, CA
- **Twitter:** @PaloAltoNtwks (128,788 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/30086/ (21,355 employees on LinkedIn®)
- **Ownership:** NYSE: PANW

**Reviewer Demographics:**
  - **Who Uses This:** Information Security Engineer
  - **Top Industries:** Computer & Network Security, Information Technology and Services
  - **Company Size:** 48% Enterprise, 29% Mid-Market


#### Pros & Cons

**Pros:**

- Ease of Use (50 reviews)
- Threat Detection (37 reviews)
- Integrations (28 reviews)
- Cybersecurity (27 reviews)
- Features (27 reviews)

**Cons:**

- Expensive (28 reviews)
- Difficult Learning (17 reviews)
- Complexity (14 reviews)
- Integration Issues (14 reviews)
- UX Improvement (12 reviews)

### 10. [Rapid7 Next-Gen SIEM](https://www.g2.com/products/rapid7-next-gen-siem/reviews)
  Rapid7 InsightIDR is a SaaS SIEM for modern threat detection and response. InsightIDR enables security analysts to work more efficiently and effectively, by unifying diverse data sources, providing early and reliable out of the box detections, and delivering rich visual investigations and automation to expedite response. With a lightweight cloud deployment and intuitive UI and onboarding experience, InsightIDR customers recognize an accelerated return on their investment and start seeing valuable insights from Day 1. With InsightIDR, teams can advance their threat detection and response program without adding headcount.


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 67

**User Satisfaction Scores:**

- **Activity Monitoring:** 9.2/10 (Category avg: 9.0/10)
- **Data Examination:** 8.6/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.9/10 (Category avg: 8.7/10)
- **Log Management:** 9.2/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Rapid7](https://www.g2.com/sellers/rapid7)
- **Year Founded:** 2000
- **HQ Location:** Boston, MA
- **Twitter:** @rapid7 (124,150 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/39624/ (3,249 employees on LinkedIn®)
- **Ownership:** NASDAQ:RPD

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services, Computer Software
  - **Company Size:** 66% Mid-Market, 31% Enterprise


#### Pros & Cons

**Pros:**

- Ease of Use (2 reviews)
- Easy Integrations (2 reviews)
- Integrations (2 reviews)
- Threat Detection (2 reviews)
- Visibility (2 reviews)

**Cons:**

- Limited Features (2 reviews)
- Alerting Issues (1 reviews)
- Alert Management (1 reviews)
- Difficult Customization (1 reviews)
- Difficult Setup (1 reviews)

### 11. [Coralogix](https://www.g2.com/products/coralogix/reviews)
  Coralogix is a modern, full-stack observability platform transforming how businesses process and understand their data. Our unique architecture powers in-stream analytics without reliance on indexing or hot storage. We specialize in comprehensive monitoring of logs, metrics, trace and security events, enhancing operational efficiency and reducing total cost of ownership by up to 70%. Coralogix stands out for its simple pricing model, based solely on data volume ingested and retained, and offers free, fast customer support with less than 30 second response time and 1 hour resolution time. Our platform covers the entire range of observability with features such as APM, RUM, SIEM, Kubernetes monitoring and more, all streamlined for quick integration and immediate value. Components within the stream store the system state to provide stateful insights and real-time alerting without ever needing to index the data — so there are never any trade-offs to achieve observability. Once ingested, parsed, and enriched, data is written remotely to an archive bucket controlled by the client. The archive can be queried directly at any time, from the platform UI or via CLI, giving users infinite retention with full control over, and access to, their data. View and query your data from any dashboard using any syntax. Coralogix has successfully completed relevant security and privacy compliances by BDO including GDPR, SOC 2, PCI, HIPAA, and ISO 27001/27701.


  **Average Rating:** 4.6/5.0
  **Total Reviews:** 339

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.7/10 (Category avg: 9.0/10)
- **Data Examination:** 8.7/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.8/10 (Category avg: 8.7/10)
- **Log Management:** 9.0/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Coralogix](https://www.g2.com/sellers/coralogix)
- **Company Website:** https://www.coralogix.com
- **Year Founded:** 2014
- **HQ Location:** San Francisco, CA
- **Twitter:** @Coralogix (4,088 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/3763125/ (583 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** Software Engineer, DevOps Engineer
  - **Top Industries:** Computer Software, Information Technology and Services
  - **Company Size:** 53% Mid-Market, 34% Enterprise


#### Pros & Cons

**Pros:**

- Ease of Use (82 reviews)
- Log Management (70 reviews)
- Customer Support (65 reviews)
- Real-time Monitoring (57 reviews)
- User Interface (57 reviews)

**Cons:**

- Learning Curve (25 reviews)
- Missing Features (25 reviews)
- Difficult Learning (24 reviews)
- Slow Performance (24 reviews)
- Learning Difficulty (22 reviews)

### 12. [FortiSIEM](https://www.g2.com/products/fortisiem/reviews)
  The complexity of managing network and security operations is resulting in increases in breaches worldwide. Discovery, isolation, and remediation of these incidents are measured in hundreds of days. And with a dwindling pool of skilled cyber security personnel able to manage the wide array of devices and data sources to protect their network assets, success requires a new approach. FortiSIEM provides organizations of all sizes with a comprehensive, holistic, and scalable solution for security, performance, and compliance management, from IoT to the cloud. FortiSIEM expands network visibility through the Fortinet Security Fabric's integrations with the leading security products present in most networks today.


  **Average Rating:** 4.3/5.0
  **Total Reviews:** 39

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.7/10 (Category avg: 9.0/10)
- **Data Examination:** 7.9/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.6/10 (Category avg: 8.7/10)
- **Log Management:** 8.7/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Fortinet](https://www.g2.com/sellers/fortinet)
- **Year Founded:** 2000
- **HQ Location:** Sunnyvale, CA
- **Twitter:** @Fortinet (151,495 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/6460/ (16,112 employees on LinkedIn®)
- **Ownership:** NASDAQ: FTNT

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services, Computer & Network Security
  - **Company Size:** 48% Mid-Market, 30% Enterprise


#### Pros & Cons

**Pros:**

- Alerting (1 reviews)
- Log Management (1 reviews)
- Threat Detection (1 reviews)
- Troubleshooting (1 reviews)
- Visibility (1 reviews)

**Cons:**

- Complex Configuration (1 reviews)
- Complex Setup (1 reviews)
- Difficult Customization (1 reviews)
- Learning Curve (1 reviews)
- Poor Interface Design (1 reviews)

### 13. [Pandora FMS](https://www.g2.com/products/pandora-fms/reviews)
  Pandora FMS is a unified monitoring and observability platform designed to consolidate visibility, alerting, reporting, and automation across heterogeneous IT environments. Instead of combining multiple point tools for networks, servers, applications, and cloud services, Pandora FMS centralizes data collection and operational workflows in a single console, reducing integration effort and operational complexity in on-premise, hybrid, and multi-cloud architectures. The platform collects telemetry using multiple methods, including agents, remote checks, standard protocols (e.g., SNMP/WMI), APIs, and log/event ingestion. This enables teams to monitor infrastructure and services end-to-end, correlate signals, and maintain consistent alerting policies and dashboards across distributed estates. Pandora FMS also supports capacity and trend analysis to anticipate resource constraints and identify recurring patterns, and includes AI-assisted capabilities for anomaly detection and automated thresholds to surface hard-to-spot operational signals. Pandora FMS is extensible through a large plugin ecosystem (500+ plugins and integrations), covering a wide range of enterprise and infrastructure technologies such as SAP, Oracle, Citrix, JBoss, VMware, AWS, SQL Server, Red Hat, and WebSphere. This extensibility helps organizations standardize monitoring across legacy and modern stacks without redesigning their monitoring approach per technology. Core capabilities: -Unified monitoring for networks, servers, applications, cloud services, endpoints, and logs -Centralized alerting, event correlation, dashboards, and scheduled reporting -Flexible data collection via agents, remote checks, APIs, and plugins -Scalability for distributed environments and large numbers of monitored elements -Analytics for trend/capacity planning plus AI-assisted anomaly detection and dynamic thresholds -A key differentiator is direct vendor support, which simplifies escalation and ensures continuity of expertise for deployment, tuning, and ongoing operations.


  **Average Rating:** 4.6/5.0
  **Total Reviews:** 216

**User Satisfaction Scores:**

- **Activity Monitoring:** 10.0/10 (Category avg: 9.0/10)
- **Data Examination:** 8.3/10 (Category avg: 8.6/10)
- **Ease of Use:** 9.1/10 (Category avg: 8.7/10)
- **Log Management:** 10.0/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Pandora FMS](https://www.g2.com/sellers/pandora-fms)
- **Company Website:** https://pandorafms.com/
- **Year Founded:** 2004
- **HQ Location:** Madrid, Spain
- **Twitter:** @pandorafms (5,470 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/pandora-pfms/ (57 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** Data Analyst
  - **Top Industries:** Information Technology and Services, Telecommunications
  - **Company Size:** 51% Mid-Market, 38% Small-Business


#### Pros & Cons

**Pros:**

- Monitoring (139 reviews)
- Ease of Use (114 reviews)
- Real-time Monitoring (96 reviews)
- Flexibility (64 reviews)
- Network Monitoring (61 reviews)

**Cons:**

- Learning Curve (45 reviews)
- Complex Setup (32 reviews)
- Learning Difficulty (30 reviews)
- Difficult Learning (28 reviews)
- Complex Configuration (27 reviews)

### 14. [NetWitness Platform](https://www.g2.com/products/netwitness-platform/reviews)
  NetWitness is a comprehensive threat detection, investigation and response platform that combines visibility, analytics, insight, and automation into a single solution. It collects and analyzes data across all capture points (logs, packets, netflow, endpoint and IoT) and computing platforms (physical, virtual and cloud), enriching data with threat intelligence and business context.


  **Average Rating:** 3.9/5.0
  **Total Reviews:** 23

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.3/10 (Category avg: 9.0/10)
- **Data Examination:** 8.3/10 (Category avg: 8.6/10)
- **Ease of Use:** 7.7/10 (Category avg: 8.7/10)
- **Log Management:** 8.6/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [NetWitness](https://www.g2.com/sellers/netwitness)
- **Year Founded:** 1997
- **HQ Location:** Bedford, MA
- **Twitter:** @Netwitness (1,626 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/netwitness-platform/ (186 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Company Size:** 54% Enterprise, 33% Mid-Market


#### Pros & Cons

**Pros:**

- Investigation (2 reviews)
- Threat Detection (2 reviews)
- Centralized Management (1 reviews)
- Cybersecurity (1 reviews)
- Features (1 reviews)

**Cons:**

- Complex Implementation (2 reviews)
- Complexity (2 reviews)
- Complex Setup (2 reviews)
- Deployment Difficulties (2 reviews)
- Expertise Required (2 reviews)

### 15. [Cynet](https://www.g2.com/products/cynet/reviews)
  Cynet is the unified, AI-powered cybersecurity platform that delivers robust and comprehensive protection for security teams while maximizing operational efficiency for managed service providers (MSPs). This platform consolidates a wide array of security capabilities into a single, user-friendly interface, ensuring that organizations can effectively safeguard their digital assets without the complexity often associated with multi-solution environments. Cynet’s platform simplifies security management by integrating various functionalities, such as endpoint protection, threat detection, and incident response, into one cohesive system. This integration not only streamlines operations but also allows organizations to allocate their resources more effectively, ultimately enhancing their overall security posture. One of the standout features of Cynet’s platform is its remarkable performance in the MITRE ATT&CK Evaluations. Cynet delivered 100% visibility and 100% analytic coverage without requiring any configuration changes three years in a row. This capability ensures that organizations can monitor their environments comprehensively and respond to threats with precision. The platform’s built-in analytics and reporting tools provide actionable insights, enabling users to make informed decisions about their cybersecurity strategies. Additionally, Cynet offers 24/7 expert support, which is crucial for organizations that may not have in-house cybersecurity expertise. This round-the-clock assistance ensures that users can quickly address any security incidents or concerns, minimizing potential downtime and damage. The combination of advanced technology and dedicated support positions Cynet as a valuable partner for SMEs and service providers looking to enhance their cybersecurity measures. In summary, Cynet’s unified, AI-powered cybersecurity platform stands out in the crowded cybersecurity market by offering a unified solution tailored to the needs of MSPs. Its comprehensive features, exceptional performance in industry evaluations, and continuous expert support make it a compelling choice for organizations seeking to bolster their cybersecurity defenses while maintaining operational efficiency.


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 208

**User Satisfaction Scores:**

- **Activity Monitoring:** 9.2/10 (Category avg: 9.0/10)
- **Data Examination:** 8.6/10 (Category avg: 8.6/10)
- **Ease of Use:** 9.1/10 (Category avg: 8.7/10)
- **Log Management:** 8.5/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Cynet](https://www.g2.com/sellers/cynet)
- **Company Website:** https://www.cynet.com/
- **Year Founded:** 2014
- **HQ Location:** Boston, MA
- **LinkedIn® Page:** https://www.linkedin.com/company/cynet-security/ (329 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** SOC Analyst, Technical Engineer
  - **Top Industries:** Information Technology and Services, Computer & Network Security
  - **Company Size:** 58% Mid-Market, 30% Small-Business


#### Pros & Cons

**Pros:**

- Ease of Use (48 reviews)
- Features (36 reviews)
- Threat Detection (34 reviews)
- Customer Support (32 reviews)
- Security (31 reviews)

**Cons:**

- Limited Customization (11 reviews)
- Feature Limitations (10 reviews)
- Lack of Customization (10 reviews)
- Limited Features (10 reviews)
- Missing Features (10 reviews)

### 16. [Check Point Infinity Platform](https://www.g2.com/products/check-point-infinity-platform/reviews)
  Check Point Infinity is the only fully consolidated cyber security architecture that provides unprecedented protection against Gen V mega-cyber attacks as well as future cyber threats across all networks, endpoint, cloud and mobile. The architecture is designed to resolve the complexities of growing connectivity and inefficient security.


  **Average Rating:** 4.5/5.0
  **Total Reviews:** 47

**User Satisfaction Scores:**

- **Ease of Use:** 8.8/10 (Category avg: 8.7/10)


**Seller Details:**

- **Seller:** [Check Point Software Technologies](https://www.g2.com/sellers/check-point-software-technologies)
- **Year Founded:** 1993
- **HQ Location:** Redwood City, CA
- **Twitter:** @CheckPointSW (70,998 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/check-point-software-technologies/ (8,356 employees on LinkedIn®)
- **Ownership:** NASDAQ:CHKP

**Reviewer Demographics:**
  - **Top Industries:** Computer & Network Security, Information Technology and Services
  - **Company Size:** 42% Mid-Market, 32% Small-Business


#### Pros & Cons

**Pros:**

- Centralized Management (12 reviews)
- Security (11 reviews)
- Easy Management (10 reviews)
- Features (9 reviews)
- Ease of Use (8 reviews)

**Cons:**

- Learning Curve (10 reviews)
- Complexity (6 reviews)
- Delays (4 reviews)
- Difficult Configuration (4 reviews)
- Expensive (4 reviews)

### 17. [Graylog](https://www.g2.com/products/graylog/reviews)
  Graylog is a log management and security information and event management (SIEM) solution designed to assist security and IT teams in detecting, investigating, and responding to potential threats with increased efficiency. By leveraging advanced technologies such as scalable log management, real-time data correlation, and explainable artificial intelligence (AI), Graylog transforms complex data sets into actionable insights, enabling organizations to make informed decisions swiftly. The platform caters to a diverse range of users, from small businesses to large enterprises, all of whom require enhanced visibility and control over their IT environments. Graylog is particularly beneficial for security analysts and IT professionals who need to sift through vast amounts of log data to identify anomalies, track incidents, and ensure compliance with various regulatory standards. Its user-friendly interface and powerful analytical tools streamline the process of threat detection and response, making it an essential asset for organizations aiming to bolster their cybersecurity posture. Key features of Graylog include automated workflows that simplify repetitive tasks, anomaly detection capabilities that flag unusual patterns in data, and guided investigations that assist users in navigating complex security incidents. The platform also offers AI-driven summaries that distill critical information, allowing analysts to focus on high-priority issues without getting bogged down by excessive data. These features collectively enhance the speed and accuracy of threat responses, ensuring that security teams remain in control of their environments. Graylog's versatility is evident in its range of products, which includes Graylog Security, Enterprise, API Security, and Open solutions. Each product is tailored to meet the specific needs of different organizations, providing clarity and context across various operational landscapes. With a user base of over 60,000 organizations globally, Graylog has established itself as a trusted partner in the realm of cybersecurity and log management, helping teams navigate the complexities of modern threats while maintaining a clear focus on their objectives.


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 104

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.7/10 (Category avg: 9.0/10)
- **Data Examination:** 8.3/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.4/10 (Category avg: 8.7/10)
- **Log Management:** 9.2/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Graylog](https://www.g2.com/sellers/graylog)
- **Company Website:** https://www.graylog.org
- **Year Founded:** 2009
- **HQ Location:** Houston, US
- **Twitter:** @graylog2 (9,128 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/sales/company/2783090?_ntb=deUf18mKRvS5YlRE65XIhw%3D%3D (122 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** Software Engineer
  - **Top Industries:** Information Technology and Services, Computer Software
  - **Company Size:** 45% Mid-Market, 31% Small-Business


#### Pros & Cons

**Pros:**

- Cost Optimization (1 reviews)
- Debugging (1 reviews)
- Detailed Information (1 reviews)
- Insights (1 reviews)
- Pricing (1 reviews)

**Cons:**

- Complexity (1 reviews)
- Debugging Difficulties (1 reviews)
- Integration Issues (1 reviews)
- Learning Curve (1 reviews)
- Time Consumption (1 reviews)

### 18. [Cisco Security Manager](https://www.g2.com/products/cisco-security-manager/reviews)
  Advanced Security Manager is a computer security software that secures information from unwanted intruders in a computer.


  **Average Rating:** 4.3/5.0
  **Total Reviews:** 21

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.5/10 (Category avg: 9.0/10)
- **Data Examination:** 8.0/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.8/10 (Category avg: 8.7/10)
- **Log Management:** 8.6/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Cisco](https://www.g2.com/sellers/cisco)
- **Year Founded:** 1984
- **HQ Location:** San Jose, CA
- **Twitter:** @Cisco (721,495 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/cisco/ (95,742 employees on LinkedIn®)
- **Ownership:** NASDAQ:CSCO

**Reviewer Demographics:**
  - **Company Size:** 52% Enterprise, 43% Mid-Market


### 19. [LogRhythm SIEM](https://www.g2.com/products/exabeam-logrhythm-siem/reviews)
  Rapidly deploy LogRhythm SIEM, the leading self-hosted SIEM, to secure your organization with powerful detections, synchronized threat intelligence, automated workflows, and achieve faster, more accurate threat detection, investigation, and response (TDIR).


  **Average Rating:** 4.2/5.0
  **Total Reviews:** 137

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.9/10 (Category avg: 9.0/10)
- **Data Examination:** 8.4/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.3/10 (Category avg: 8.7/10)
- **Log Management:** 9.0/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Exabeam](https://www.g2.com/sellers/exabeam)
- **Year Founded:** 2013
- **HQ Location:** Foster City, US
- **Twitter:** @exabeam (5,374 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/exabeam (819 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Who Uses This:** Information Security Analyst, Cyber Security Analyst
  - **Top Industries:** Information Technology and Services, Computer & Network Security
  - **Company Size:** 40% Enterprise, 40% Mid-Market


### 20. [LevelBlue USM Anywhere](https://www.g2.com/products/levelblue-usm-anywhere/reviews)
  LevelBlue USM Anywhere is a cloud-based security management solution that accelerates and centralizes threat detection, incident response, and compliance management for your cloud, hybrid cloud, and on-premises environments. USM Anywhere includes purpose-built cloud sensors that natively monitor your Amazon Web Services (AWS) and Microsoft Azure cloud environments. On premises, lightweight virtual sensors run on Microsoft Hyper-V and VMware ESXi to monitor your virtual private cloud and physical IT infrastructure. With USM Anywhere, you can rapidly deploy sensors into your cloud and on-premises environments while centrally managing data collection, security analysis, and threat detection from the AlienVault Secure Cloud. Five Essential Security Capabilities in a Single SaaS Platform AlienVault USM Anywhere provides five essential security capabilities in a single SaaS solution, giving you everything you need for threat detection, incident response, and compliance management—all in a single pane of glass. With USM Anywhere, you can focus on finding and responding to threats, not managing software. An elastic, cloud-based security solution, USM Anywhere can readily scale to meet your threat detection needs as your hybrid cloud environment changes and grows. 1. Asset Discovery 2. Vulnerability Assessment 3. Intrusion Detection 4. Behavioral Monitoring 5. SIEM


  **Average Rating:** 4.4/5.0
  **Total Reviews:** 102

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.9/10 (Category avg: 9.0/10)
- **Data Examination:** 8.4/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.3/10 (Category avg: 8.7/10)
- **Log Management:** 8.9/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [LevelBlue](https://www.g2.com/sellers/levelblue-49a2e3c1-ca90-4308-b899-08973f657bae)
- **HQ Location:** Dallas, Texas, United States
- **LinkedIn® Page:** https://www.linkedin.com/company/levelbluecyber/ (638 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services, Financial Services
  - **Company Size:** 62% Mid-Market, 20% Small-Business


### 21. [SolarWinds Security Event Manager](https://www.g2.com/products/solarwinds-security-event-manager/reviews)
  Security Event Manager (SEM) is a powerful, real-time Security Information and Event Management (SIEM) solution designed to act as a virtual Security Operations Center (SOC). It provides active monitoring and automated threat detection across multi-vendor network devices, servers, workstations, and applications. SEM is delivered as a downloadable virtual appliance for rapid deployment, and allows IT teams to centralize log data and enable real-time event correlation right out of the box. SEM goes beyond simple alerting by offering automated remediation actions. When suspicious behavior is detected, the platform can automatically block malicious IPs, disable compromised user accounts, kill unauthorized applications, or detach unmanaged USB devices via its integrated USB Defender. This immediate response capability significantly reduces the window of vulnerability during a cyber-attack. To ensure deep visibility, SEM features built-in File Integrity Monitoring (FIM), allowing you to track sensitive file changes, deletions, and registry modifications. The platform also streamlines audit preparation with hundreds of pre-built, out-of-the-box compliance reports for major regulatory frameworks, including HIPAA, PCI DSS, SOX, ISO, DISA STIGs, and FISMA. With its intuitive text-based searching and integrated threat intelligence feed, SEM normalizes disparate log data into a readable format. This enables faster forensic analysis and historical searching, helping your team identify patterns from known bad actors and strengthen your overall security posture. Whether you are managing internal threats or external breaches, SolarWinds SEM provides the essential tools to detect, respond, and report with confidence. For organizations seeking tailored security control, SEM is highly effective as a standalone SIEM tool, providing dedicated log management and incident response. However, for those looking to eliminate silos between security and IT operations, SEM can also function as a core component of SolarWinds Observability.


  **Average Rating:** 4.0/5.0
  **Total Reviews:** 71

**User Satisfaction Scores:**

- **Activity Monitoring:** 9.2/10 (Category avg: 9.0/10)
- **Data Examination:** 8.5/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.2/10 (Category avg: 8.7/10)
- **Log Management:** 8.9/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [SolarWinds Worldwide LLC](https://www.g2.com/sellers/solarwinds-worldwide-llc)
- **Year Founded:** 1999
- **HQ Location:** Austin, TX
- **Twitter:** @solarwinds (19,616 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/166039/ (2,818 employees on LinkedIn®)
- **Ownership:** NYSE: SWI

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services, Computer Software
  - **Company Size:** 51% Enterprise, 39% Mid-Market


#### Pros & Cons

**Pros:**

- Detection Efficiency (1 reviews)
- Ease of Use (1 reviews)

**Cons:**

- Licensing Cost (1 reviews)
- Poor Customer Support (1 reviews)

### 22. [Trellix Enterprise Security Manager](https://www.g2.com/products/trellix-enterprise-security-manager/reviews)
  Trellix Enterprise Security Manager, a core Trellix SIEM solution, delivers performance, actionable intelligence, and solution integration at the speed and scale required for your security organization. It allows your organization to quickly prioritize, investigate, and respond to hidden threats and meet compliance requirements.


  **Average Rating:** 4.1/5.0
  **Total Reviews:** 37

**User Satisfaction Scores:**

- **Activity Monitoring:** 7.9/10 (Category avg: 9.0/10)
- **Data Examination:** 8.1/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.1/10 (Category avg: 8.7/10)
- **Log Management:** 8.1/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Trellix](https://www.g2.com/sellers/trellix)
- **Year Founded:** 2004
- **HQ Location:** Milpitas, CA
- **Twitter:** @Trellix (241,709 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/44195/ (811 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Information Technology and Services
  - **Company Size:** 42% Enterprise, 29% Mid-Market


#### Pros & Cons

**Pros:**

- Log Management (3 reviews)
- Dashboard Customization (1 reviews)
- Dashboard Usability (1 reviews)
- Debugging (1 reviews)
- Ease of Use (1 reviews)

**Cons:**

- Difficult Customization (1 reviews)
- Difficult Navigation (1 reviews)
- Expensive (1 reviews)
- Faulty Detection (1 reviews)
- Integration Issues (1 reviews)

### 23. [guardsix](https://www.g2.com/products/guardsix/reviews)
  guardsix is a comprehensive cybersecurity solution designed specifically for Managed Security Service Providers (MSSPs) and Critical National Infrastructure Providers (CNI). guardsix command center, a unified SecOps platform, enables organizations to effectively detect cyberattacks while ensuring compliance with various data regulations. By offering a robust framework for monitoring and managing security events, guardsix addresses the increasing need for advanced threat detection and regulatory adherence in today’s complex digital landscape. guardsix command center stands out by providing complete visibility across IT environments through the integration of multiple security technologies, including Security Information and Event Management (SIEM), Network Detection and Response (NDR), and Security Orchestration, Automation, and Response (SOAR). This integration allows organizations to monitor their systems holistically, ensuring that potential threats are identified and addressed promptly. Additionally, guardsix employs hypergraph technology, which connects detections from diverse sources, enabling users to determine whether an incident is part of a more extensive attack. This capability enhances situational awareness and improves incident response times. One of the key advantages of guardsix is its open, vendor- and platform-agnostic nature, allowing users to choose how and from where to ingest data. This flexibility is crucial for organizations that operate in heterogeneous environments, as it enables them to tailor their security solutions to fit their specific needs. Furthermore, guardsix automatically normalizes data into a common taxonomy, simplifying the analysis and utilization of ingested information. This feature ensures that users can easily derive insights from their data, regardless of its original format or source. guardsix also prioritizes compliance with major regulatory frameworks, including NIS2, Schrems II, HIPAA, GDPR, PCI-DSS, and SOX. By providing centralized logging and reporting capabilities, the platform facilitates adherence to security guidelines such as CERT-In, SOC 2 Type II, and ISO27001. This focus on compliance not only helps organizations avoid potential legal pitfalls but also enhances their overall security posture by ensuring that they meet industry standards and best practices. In summary, guardsix is a versatile cybersecurity solution that empowers MSSPs and CNI providers to detect threats effectively while maintaining compliance with regulatory requirements. Its integration of essential security technologies, flexible data ingestion options, and emphasis on compliance make it a valuable asset for organizations looking to strengthen their cybersecurity defenses.


  **Average Rating:** 4.3/5.0
  **Total Reviews:** 105

**User Satisfaction Scores:**

- **Activity Monitoring:** 8.2/10 (Category avg: 9.0/10)
- **Data Examination:** 8.0/10 (Category avg: 8.6/10)
- **Ease of Use:** 8.3/10 (Category avg: 8.7/10)
- **Log Management:** 8.6/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [guardsix](https://www.g2.com/sellers/guardsix)
- **Company Website:** https://guardsix.com/
- **Year Founded:** 2001
- **HQ Location:** Copenhagen, Capital Region
- **LinkedIn® Page:** https://linkedin.com/company/guardsix (117 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Computer & Network Security, Information Technology and Services
  - **Company Size:** 44% Mid-Market, 31% Small-Business


#### Pros & Cons

**Pros:**

- Ease of Use (8 reviews)
- Log Management (5 reviews)
- Customer Support (4 reviews)
- Easy Integrations (4 reviews)
- Efficiency (4 reviews)

**Cons:**

- Poor Interface Design (3 reviews)
- UX Improvement (3 reviews)
- Complexity (2 reviews)
- Confusing Interface (2 reviews)
- Information Deficiency (2 reviews)

### 24. [Logsign Unified SO Platform](https://www.g2.com/products/logsign-unified-so-platform/reviews)
  Logsign Unified SO Platform integrates next-gen SIEM, threat intelligence, UEBA, and SOAR and empowers organizations to optimize and streamline their cybersecurity operations. In addition to that, the platform offers seamless integration capabilities, allowing them to effortlessly integrate their existing security software and leverage our vast integration library, expanding the Logsign USO Platform's functionality and providing a comprehensive security management experience. With these extensive capabilities, it allows organizations to improve their security posture and ensure compliance with relevant regulations and standards. - Easy-to-deploy, easy-to-use Unified SO Platform for all sizes of enterprises. - Enterprise-grade scalability, high availability - Cluster SIEM, big data infrastructure.  - On-premise solution. - 500+ predefined integrations and free plugin service. - Collects & stores high volumes of data. - Threat hunting, fast search & investigation, advanced behaviour analysis, IOC detection. - Threat Intelligence and UEBA embedded. - Real-time detection & prevention, wide correlation library based on Mitre Att&ck framework.  - Real-time monitoring, predefined dashboards & reports, meeting Compliance Requirements (PCI DSS, ISO 27001, HIPAA, SOX, and more). - Automated notifications, automated Incident response - Incident Cycle Management - Incident Response - Multiple pricing options without capacity or log source limit, feature-based pricing.


  **Average Rating:** 4.7/5.0
  **Total Reviews:** 53

**User Satisfaction Scores:**

- **Activity Monitoring:** 9.1/10 (Category avg: 9.0/10)
- **Data Examination:** 8.7/10 (Category avg: 8.6/10)
- **Ease of Use:** 9.6/10 (Category avg: 8.7/10)
- **Log Management:** 9.6/10 (Category avg: 9.1/10)


**Seller Details:**

- **Seller:** [Logsign](https://www.g2.com/sellers/logsign-b186ed7a-a696-4a37-b658-5f865c16557e)
- **Year Founded:** 2010
- **HQ Location:** Hague, Netherlands, NL
- **Twitter:** @logsign (373 Twitter followers)
- **LinkedIn® Page:** https://www.linkedin.com/company/logsign/ (39 employees on LinkedIn®)

**Reviewer Demographics:**
  - **Top Industries:** Computer & Network Security, Information Technology and Services
  - **Company Size:** 50% Mid-Market, 31% Small-Business




## Parent Category

[System Security Software](https://www.g2.com/categories/system-security)



## Related Categories

- [Incident Response Software](https://www.g2.com/categories/incident-response)
- [Log Analysis Software](https://www.g2.com/categories/log-analysis)
- [Security Orchestration, Automation, and Response (SOAR) Software](https://www.g2.com/categories/security-orchestration-automation-and-response-soar)



---

## Buyer Guide

### What You Should Know About SIEM Software

### What is security information and event management (SIEM) software?

Security Information and Event Management (SIEM) is a centralized system for threat detection that aggregates security alerts from multiple sources, simplifying threat response and compliance reporting. SIEM software is one of the most commonly used tools for security administrators and security incident response professionals. They provide a single platform capable of facilitating event and threat protection, log analysis and investigation, and threat remediation. Some cutting-edge tools provide additional functionality for creating response workflows, data normalization, and advanced threat protection.

SIEM platforms help security programs operate by collecting security data for future analysis, storing these data points, correlating them to security events, and facilitating analysis of those events.

Security teams can define rules for typical and suspicious activities with SIEM tools. Advanced Next-Gen SIEM solutions leverage [machine learning](https://www.g2.com/articles/what-is-machine-learning) and [AI](https://www.g2.com/articles/what-is-artificial-intelligence) to refine behavior models continuously, enhancing [User and Entity Behavior Analytics (UEBA)](https://www.g2.com/categories/user-and-entity-behavior-analytics-ueba) and reducing false positives. These systems analyze data against set rules and behavioral patterns, flagging notable events when anomalies are detected.

Companies using SIEM solutions deploy sensors across digital assets to automate data collection. Sensors relay information back to the SIEM’s log and event database. When additional security incidents arise, the SIEM platform detects anomalies. It correlates similar logs to provide context and threat information for security teams as they attempt to remediate any existing threats or vulnerabilities.

#### **What does SIEM stand for?**

SIEM stands for security information and event management (SIEM), which is a combination of two different acronyms for security technology: security information monitoring (SIM) and security event management (SEM).

SIM is the practice of collecting, aggregating, and analyzing security data, typically in the form of logs. SIM tools automate this process and document security information for other sources, such as [intrusion detection systems](https://www.g2.com/categories/intrusion-detection-and-prevention-systems-idps), [firewalls](https://www.g2.com/categories/firewall-software), or [routers](https://www.g2.com/categories/routers). Event logs and their associated informational components are recorded and stored for long periods for either retrospective analysis or compliance requirements.

SEM is a family of security software for discovering, analyzing, visualizing, and responding to threats as they arise. SEM is a core component of a security operations system. While SIM tools are designed for log collection and storage, SEM tools typically rely on SQL databases to store specific logs and other event data as they are generated in real time by security devices and IT systems. They usually also provide the functionality to correlate and analyze event data, monitor systems in real time, and alert security teams of abnormal activity.

SIEM combines the functionality of SIM and SEM to centralize control over log storage, event management, and real-time analysis. SIM and SEM have become defunct technologies, as SIEM’s rise has provided dual-purpose functionality. SIEM vendors offer a single tool capable of performing data aggregation, information correlation, and event management.

### Types of SIEM solutions

#### **Traditional SIEM**

Traditional SIEM tools are deployed on-premises with sensors placed on IT assets to analyze events and collect system logs. The data is used to develop baseline references and identify indicators of compromise. The SIEM product alerts security teams for intervention when a system becomes compromised. 

#### **Cloud or virtual SIEM**

Cloud-based and virtualized SIEM software are tools typically used to secure cloud infrastructure and services a cloud provider delivers. These tools are often less expensive than on-premises solutions and more accessible to implement, as no physical labor is required. They are ideal for companies without local IT infrastructure.

#### [**Managed SIEM services**](https://www.g2.com/categories/managed-siem-services)

Companies that do not have a full-fledged security program may choose managed SIEM services to aid in management and reduce work for internal employees. These SIEM services are delivered by managed service providers who provide the customer data and dashboards with security information and activity, but the provider handles implementation and remediation. 

### What are the common features of SIEM systems?

The following are some core features within SIEM software that can help users collect security data, analyze logs, and detect threats:

**Activity monitoring:** SIEM systems document the actions from endpoints within a network. The system alerts users of incidents and abnormal activities and documents the access point. Real-time tracking will document these for analysis as an event takes place.

**Asset management:** These SIEM features keep records of each network asset and its activity. The feature may also refer to the discovery of new assets accessing the network.

**Log management:** This functionality documents and stores event logs in a secure repository for reference, analysis, or compliance reasons.

**Event management:** As events occur in real time, the SIEM software alerts users of incidents. This allows security teams to intervene manually or trigger an automated response to resolve the issue.

[**Automated response**](https://www.g2.com/categories/security-information-and-event-management-siem/f/automated-response) **:** Response automation reduces the time spent diagnosing and resolving issues manually. The features are typically capable of quickly resolving common network security incidents.

**Incident reporting:** Incident reports document cases of abnormal activity and compromised systems. These can be used for forensic analysis or as a reference point for future incidents.

**Threat intelligence:** Threat intelligence feeds integrate information to train SIEM systems to detect emerging and existing threats. These threat feeds store information related to potential threats and vulnerabilities to ensure issues are discovered and teams are provided with the information necessary to resolve the problems as they occur.

[**Vulnerability assessment**](https://www.g2.com/categories/security-information-and-event-management-siem/f/vulnerability-assessment) **:** Vulnerability assessment tools may scan networks for potential vulnerabilities or audit data to discover non-compliant practices. Mainly, they’re used to analyze an existing network and IT infrastructure to outline access points that can be easily compromised.

[**Advanced analytics**](https://www.g2.com/categories/security-information-and-event-management-siem/f/advanced-analytics) **:** Advanced analytics features allow users to customize analysis with granular or individually specific metrics pertinent to the business’ resources.

[**Data examination**](https://www.g2.com/categories/security-information-and-event-management-siem/f/data-examination) **:** Data examination features typically facilitate the forensic analysis of incident data and event logs. These features allow users to search databases and incident logs to gain insights into vulnerabilities and incidents.

### What are the benefits of using SIEM products?

Below are a few of the main reasons SIEM software is commonly used to protect businesses of all sizes:

**Data aggregation and correlation:** SIEM systems and companies collect vast amounts of information from an entire network environment. This information is gathered from virtually anything interacting with a network, from endpoints and servers to firewalls and antivirus tools. It is either given directly to the SIEM or using agents (decision-making programs designed to identify irregular information). The platform is set up to deploy agents and collect and store similar information together according to security policies set in place by administrators.

**Incident alerting:** As information comes in from a network’s various connected components, the SIEM system correlates it using rule-based policies. These policies inform agents of normal behavior and threats. If any action violates these policies or malware or intrusion is discovered. At the same time, the SIEM platform monitors network activity; it is labeled as suspicious, security controls restrict access, and administrators are alerted.

**Security analysis:** Retrospective analysis may be performed by searching log data during specific periods or based on specific criteria. Security teams may suspect a certain misconfiguration or kind of malware caused an event. They may also suspect an unapproved party went undetected at a specific time. Teams will analyze the logs and look for specific characteristics in the data to determine whether their suspicion was right. They may also discover vulnerabilities or misconfigurations that leave them susceptible to attack and remediate them.

### Software related to SIEM tools

Many network and system security solutions involve collecting and analyzing event logs and security information. SIEM systems are typically the most all-encompassing solutions available, but many other security solutions may integrate with them for added functionality or complementary use. These are a few different technology categories related to SIEM software.

[Threat intelligence software](https://www.g2.com/categories/threat-intelligence) **:** Threat intelligence software is an informational service that provides SIEM tools and other information security systems with up-to-date information on web-based threats. They can inform the system of zero-day threats, new forms of malware, potential exploits, and different kinds of vulnerabilities.

[Incident response software](https://www.g2.com/categories/incident-response) **:** SIEM systems may facilitate incident response, but these tools are specifically designed to streamline the remediation process or add investigative capabilities during security workflow processes. Incident response solutions will not provide the same compliance maintenance or log storage capabilities. Still, they can be used to increase a team’s ability to tackle threats as they emerge.

[Network security policy management (NSPM) software](https://www.g2.com/categories/network-security-policy-management-nspm) **:** NSPM software has some overlapping functionality to ensure security hardware and IT systems are correctly configured but cannot detect and resolve threats. They are typically used to ensure devices like firewalls or DNS filters are functioning correctly and in alignment with the security rules put in place by security teams.

[Intrusion detection and prevention systems (IDPS)](https://www.g2.com/categories/intrusion-detection-and-prevention-systems-idps) **:** While SIEM systems specialize in log management, alerting, and correlation, IDPS provide additional detection and protection features to prevent unapproved parties from accessing sensitive systems and network breaches. However, they will not facilitate the analysis and forensic investigation of logs with the same level of detail as an SIEM system.

[Managed security services providers](https://www.g2.com/categories/managed-security-services) **:** Various managed security services are available for businesses without the resources or staff necessary to operate a full-fledged security administration and operations team. Managed services are a viable option and will provide companies with skilled staff to protect their customers’ systems and keep their sensitive information protected.

### Challenges with SIEM software

**Staffing:** There is an existing shortage of skilled security professionals. Managing SIEM products and maintaining a well-rounded security posture requires dedicated personnel with highly specialized skills. Some smaller or growing companies may not have the means to recruit, hire, and retain qualified security pros. In such cases, businesses can consider managed services to outsource the labor. 

**Compliance:** Some industries have specific compliance requirements determined by various governing bodies, but SIEM software can be used across several industries to maintain compliance standards. Many industry-specific compliance requirements exist, but most require security teams to protect sensitive data, restrict access to unapproved parties, and monitor changes made to identities, information, or privileges. For example, SIEM systems can maintain GDPR compliance by verifying security controls and data access, facilitating long-term storage of log data, and notifying security staff of security incidents, as GDPR requires.

### Which companies should buy SIEM solutions?

**Vertical industries:** Vertical industries, such as healthcare and financial services, often have additional compliance requirements related to data protection and privacy. SIEM is an ideal solution for outlining requirements, mapping threats, and remediating vulnerabilities. 

**SaaS business:** SaaS businesses utilizing resources from a cloud service provider are still responsible for a significant portion of the security efforts required to protect a cloud-native business. These companies may jump for cloud-native SIEM tools but will benefit from any SIEM to prevent, detect, and respond to threats. 

### How to choose the best SIEM software

#### Requirements Gathering (RFI/RFP) for Security Information and Event Management (SIEM) Software

The first step to purchasing a SIEM solution is to outline the options. Companies should be sure whether they need a cloud-based or on-premises solution. They should also outline the number of interconnected devices they need and whether they want physical or virtual sensors to secure them. Additional and possibly obvious requirements should include budgetary considerations, staffing limitations, and required integrations_. _

#### **Compare Security Information and Event Management (SIEM) Software Products**

##### **Create a long list**

Once the requirements are outlined, buyers should prioritize the tools and identify the ones with as many features as possible that fit the budget window. It is recommended to restrict the list to products with desired features, pricing, and deployment methods to identify a dozen or so options. For example, if the business needs a cloud-native SIEM for less than $10k a year, half of the SIEM options will be eliminated. 

When choosing a SIEM provider, focus on the vendor’s experience, reputation, and specific functionality relevant to your security needs. Core capabilities ensure essential threat detection, while next-gen features add advanced intelligence and automation, allowing for a more proactive security posture. Here’s a breakdown to guide your selection:

**Core SIEM capabilities**

- Threat detection: Look for SIEMs with robust threat detection, which uses rules and behavioral analytics, along with threat feed integration, to accurately identify potential threats.
- Threat intelligence and security alerting: Leading SIEMs incorporate threat intelligence feeds, aggregate security data, and alert you when suspicious activities are detected, ensuring real-time updates on evolving threats.
- Compliance reporting: Compliance support is crucial, especially for meeting standards like HIPAA, PCI, and FFIEC. SIEMs streamline compliance assessment and reporting, helping prevent costly non-compliance.
- Real-time notifications: Swift alerts are vital; SIEMs that notify you of breaches immediately enable faster responses to potential threats.
- Data aggregation: A centralized view of all network activities ensures no area is left unmonitored, which is crucial for comprehensive threat visibility as your organization scales.
- Data normalization: SIEMs that normalize incoming data make it easier to analyze security events and extract actionable insights from disparate sources.

**Next-gen SIEM capabilities**

- Data collection and management: Next-gen SIEMs pull data from the cloud, on-premises, and external devices, consolidating insights across the entire IT environment.
- Cloud delivery: Cloud-based SIEMs use scalable storage, accommodating large data volumes without the limitations of on-premises hardware.
- User and entity behavior analytics (UEBA): By establishing normal user behavior and identifying deviations, UEBA helps detect insider threats and new, unknown threats.
- Security orchestration and automation response (SOAR): SOAR automates incident response, integrates with IT infrastructure, and enables coordinated responses across firewalls, email servers, and access controls.
- Automated attack timelines: Next-gen SIEMs automatically create visual attack timelines, simplifying investigation and triage, even for less experienced analysts.

Selecting an SIEM vendor with both core and next-gen capabilities offers your organization a comprehensive and agile approach to security, meeting both current and future requirements.

##### **Create a short list**

Narrowing down a short list can be tricky, especially for the indecisive, but these decisions must be made. Once the long list is limited to affordable products with the desired features, it’s time to search for third-party validation. For each tool, the buyer must analyze end-user reviews, analyst reports, and empirical security evaluations. Combining these specified factors should help rank options and eliminate poorly performing products. _ _

##### **Conduct demos**

With the list narrowed down to three to five possible products, businesses can contact vendors and schedule demos. This will help them get first-hand experience with the product, ask targeted questions, and gauge the vendors' quality of service. 

Here are some essential questions to guide your decision:

- Will the tool enhance log collection and management?: 

Effective log collection is foundational. Look for compatible software across systems and devices, offering a user-friendly dashboard for streamlined monitoring.

- Does the tool support compliance efforts?

Even if compliance isn't a priority, choosing an SIEM that facilitates auditing and reporting can future-proof your operations. Look for tools that simplify compliance processes and reporting.

- Can the tool leverage past security events in threat response?

One of SIEM’s strengths is using historical data to inform future threat detection. Ensure the tool offers in-depth analytics and drill-down capabilities to analyze and act on past incidents.

- Is the incident response fast and automated?

Timely, effective responses are critical. The tool should provide customizable alerts that notify your team immediately when needed so you can confidently leave the dashboard. 

#### Selection of Security Information and Event Management (SIEM) Software

##### **Choose a selection team**

Decision-makers need to involve subject matter experts from all teams that will use the system in choosing a selection team. For backup software, this primarily involves product managers, developers, IT, and security staff. Any manager or department-level leader should also include individuals managing any solution the backup product will be integrating with. 

##### **Negotiation**

The seniority of the negotiation team may vary depending on the maturity of the business. It is advisable to include relevant directors or managers from the security and IT departments as well as from any other cross-functional departments that may be impacted.

##### **Final decision**

If the company has a chief information security officer (CISO), that individual will likely decide. If not, companies must trust their security professionals’ ability to use and understand the product. 

### How much does SIEM software cost?

Potential growth should be considered if the buyer chooses a cloud-based SIEM tool that offers pricing on the SaaS pay-as-you-use model. Some solutions are inexpensive at the start and offer affordable, low-tier pricing. Alternatively, some may rapidly increase pricing and fees as the company and storage need to scale. Some vendors provide permanently free backup products for individuals or small teams.

**Cloud SIEM_:_** SIEM as a service pricing may vary, but it traditionally scales as storage increases. Additional costs may come from increased features such as automated remediation, security orchestration, and integrated threat intelligence. 

**On-premises SIEM:** On-premises solutions are typically more expensive and require more effort and resources. They will also be more costly to maintain and require dedicated staff. Still, companies with high compliance requirements should adopt on-premises security regardless. 

#### Return on Investment (ROI)

Cloud-based SIEM solutions will provide a quicker ROI, similar to their lower average cost. The situation is pretty cut and dry since there is much lower initial investment and lower demand for dedicated staffing. 

However, for on-premises systems, the ROI will depend on the scale and scope of business IT systems. Hundreds of servers will require hundreds of sensors, potentially more, as time wears on computing equipment. Once implemented, they must be operated and maintained by (expensive) security professionals.