G2

Aman D.

Artificial Intelligence Engineer

Mid-Market (51-1000 emp.)

5/26/2026

"Powerful SIEM That Delivers, But Expect a Learning Curve"

4.5/5

What do you like best about Falcon Next-Gen SIEM?

What I like most is that everything is in one place. Before, we were constantly jumping between tools, and things would get missed. Now, logs and alerts from different sources come together in one view, and it actually makes sense when you look at it.

The correlation engine is honestly what sold me. It automatically picks up connected events—things our team would have spent hours trying to piece together manually. The search speed is no joke either: even with massive log volumes, you get results quickly, which makes a huge difference during a live incident.

Overall, it’s made our investigations faster and given the team much better visibility, without adding extra complexity to our workflow. Review collected by and hosted on G2.com.

What do you dislike about Falcon Next-Gen SIEM?

The interface can feel like a lot when you are just getting started — it is not the most intuitive for newer team members and takes some getting used to. Detection rule setup and fine tuning took way longer than we expected, mostly trial and error in the beginning which ate into time we did not really have.

On the support and onboarding side, better guided walkthroughs would have saved us a lot of headaches early on. Pricing is also on the higher side which for smaller teams is worth thinking about before committing. The AI driven detections are impressive but honestly take some experience to fully understand and act on. Integrations work well overall but initial configuration is not always as plug and play as you would hope. Review collected by and hosted on G2.com.

What problems is Falcon Next-Gen SIEM solving and how is that benefiting you?

Alert fatigue was honestly our biggest headache before this. Too many tools, too much noise and the team was burning out trying to keep up. Falcon Next-Gen SIEM brought everything under one roof and suddenly we could actually see what was going on without drowning in irrelevant alerts.

The automatic event correlation has been a game changer for us. Things that would have taken the team hours to piece together manually now surface on their own. During incidents the fast search means we are not sitting around waiting — we get to the root cause quickly and respond before things escalate. Overall it has saved us a significant amount of time and given the whole team much more confidence in our security coverage. Review collected by and hosted on G2.com.