SIEM &amp; log analytics

Flexible ingestion from any source+5

Abstract, founded in 2023, has built a revolutionary platform to redefine security operations, launching the world's first AI-Gen Composable SIEM.

Acttrident

Log aggregation and normalization at scale+4

ActTrident™ is a United Kingdom cybersecurity company building a focused platform across human-centered security, AI security, quantum-oriented security planning, and governance-led product lines.

AlienVault USM (AT&T Cybersecurity)

Security information and event management+9

AT&T Cybersecurity AlienVault USM Anywhere is a cloud-hosted SIEM platform that unifies asset discovery, vulnerability assessment, intrusion detection, behavioral monitoring, and incident response for on-premises, cloud, and hybrid environments. It correlates security events from logs, network traffic, and cloud APIs like AWS CloudTrail and CloudWatch, retaining data for 90 days. Integrated with OTX threat intelligence and AlienLabs feeds, it targets SMBs and resource-constrained teams needing all-in-one threat detection without separate tools. OSSIM offers a limited open-source alternative for single-server on-premises use.

Anomali

Threat Intelligence

Aggregate and curate global threat intelligenceEnrich security data with threat context+10

Anomali ThreatStream is a threat intelligence platform that aggregates IOCs and IOAs from hundreds of global sources including Anomali Labs curated feeds, OSINT, premium feeds, and ISACs. It enriches telemetry via automated correlation, campaign analysis, and ML-based scoring for confidence and severity. The Next-Gen version integrates agentic AI for natural language queries via Anomali Copilot, MITRE ATT&CK mapping, and pushes high-confidence intelligence into SIEM, SOAR, EDR, and firewall workflows. Trusted by enterprises and governments for over a decade, it accelerates investigations 300x faster, ideal for CTI and SOC teams operationalizing intelligence at scale.

Anvilogic

Multi-SIEM detection deployment and correlationLow-code detection builder with natural language translation+6

Anvilogic is a threat detection and hunting platform that works alongside existing data platforms (Snowflake, Databricks, Splunk) rather than replacing them. It provides a library of pre-built detection rules, a detection-as-code workflow, and multi-platform hunt capabilities. Popular with teams who want to improve detection quality without migrating their data infrastructure, Anvilogic helps detection engineers measure and close MITRE ATT&CK coverage gaps while standardising rules across heterogeneous data lakes and SIEM stacks.

Axoflow

Security Data Pipeline

Automatically classify security data sourcesParse and normalize security telemetry+9

Ensure security-relevant data is available, accessible, and affordable to SecOps.

Beacon Security

Security telemetry management+4

At Beacon, we're building the unified, intelligent data layer that empowers defenders to see more, move faster, and act with confidence in an AI-driven world.

Bindplane

Security Data Pipeline

Unified telemetry pipeline for log aggregation+8

We are committed to helping organizations gain visibility into their IT infrastructure providing an orchestration engine that is easy to use and flexible enough to meet diverse needs.

Blumira

Pre-built threat detection rules maintained by SecOps team

Blumira is a cloud-native SIEM and XDR platform designed for mid-market organizations and MSPs. It combines log ingestion from 75+ integrations with pre-built threat detection rules maintained by an in-house SecOps team, automated response capabilities including host isolation, and 24/7 managed security operations support. The platform provides one year of searchable log retention, compliance reporting for frameworks including HIPAA, PCI DSS, CMMC 2.0, and NIST, targeting organizations seeking detection and response without dedicated security staff.

Booli

Identity-centric log correlation+7

Booli is an identity-centric SIEM vendor that focuses on log ingestion, event correlation, and investigation context built around user identity. Its platform is positioned for SOCs and MSSPs that want cloud-native log management with reduced alert noise, long-term retention options, and compliance-oriented reporting. Public materials emphasize stitching security events back to identities, custom correlation pipelines, and high-context alerts rather than broad XDR or endpoint telemetry coverage.

Brinqa

Vulnerability Management

Unify vulnerability and risk data+11

Brinqa helps exposure management teams reduce risk faster by unifying data across IT, security, cloud, identity, and application security through 240+ pre-built connectors and the Cyber Risk Graph™, creating a single source of truth. AI agents improve data quality by identifying owners, deduplicating findings, and assessing real exploitability. SmartFlows automate remediation across teams without custom code.

CriticalStart

24x7x365 human-led monitoring of alerts from EDR/EPP, XDR, identity, and SIEM tools with contractual SLAs for response time

Managed detection and response that backs every commitment with contractual SLAs. US-based SOC. 24/7/365 coverage.

Crogl

Autonomously investigates alerts end to endBuilds a live environmental knowledge graphQueries security tools in native formats+7

AI for Enterprise Security

CrowdStrike

Endpoint Detection & Response (EDR)

12 products

CrowdStrike secures the most critical areas of risk – endpoints and cloud workloads, identity, and data – to keep customers ahead of today's adversaries and stop breaches.

Adversary intelligence profiles+14

Curricula

Security Awareness & Phishing Simulation

Threat-intel backed training episodes+9

Curricula, now part of Huntress Managed Security Awareness Training, provides security awareness training focused on employee behavior change through story-based lessons, phishing simulations, and reporting. In this category it is aimed at SMB and mid-market buyers that need recurring training without building a large internal program. The platform covers phishing, social engineering, password hygiene, and compliance-oriented awareness content, with assignments and tracking for administrators. It is positioned as a managed SAT product rather than a broad human-risk platform, with adjacent capabilities such as phishing simulation and reporting supporting the training workflow.

CyDeploy

Automated asset discovery and mappingImpact analysis for technology changes+4

Continuous Change Assurance for Critical Enterprises.

Cylerian

Security Operations

11 products

By consolidating visibility and control across your organization and providing everything you need out of the box, Cylerian makes IT simpler and safer.

Automated incident triage and response orchestration

Cymulate

Deception Technology

Simulate full attack kill chains+11

Cymulate provides a SaaS-based Breach and Attack Simulation (BAS) platform that automates cyberattack simulations across the full APT kill-chain, validating security controls in email, browser, network, endpoint, and cloud vectors. It integrates exposure data with AI-driven analysis for continuous threat exposure management (CTEM), prioritizing exploitable risks and automating mitigations. Market leader in automated security validation per Frost & Sullivan, trusted by financial services and global enterprises. Best for SecOps teams in mid-to-large organizations needing 24/7 validation of SIEM/EDR detections and red teaming without manual effort.

Databahn

Security Data Pipeline

Intelligent telemetry filtering and routing+9

Databahn offers an intelligent data pipeline platform designed to optimize security data operations (SecDataOps) for SIEM and XDR environments. It enables organizations to ingest, filter, and normalize massive volumes of telemetry before it reaches expensive analytics platforms, significantly reducing licensing costs. By delivering high-quality, governed data, it improves the performance of detection engines and AI-driven security automation.

Databricks

Unified security lakehouse+10

Databricks is not a legacy SIEM vendor; it positions its security offering as an open security lakehouse for ingesting, normalizing, querying, and retaining security telemetry at large scale. In the SIEM scope, it emphasizes open formats such as Delta Lake and Apache Iceberg, schema normalization with OCSF, and long-term retention in cloud object storage. It is best suited for buyers that want to centralize high-volume logs, reduce proprietary indexing costs, and keep data queryable for investigations and compliance workloads. Databricks also offers adjacent data-platform products, but the SIEM-relevant value is primarily log-centric analytics and retention.

Devo

Cloud-native SIEM data platform+7

Devo's integrated platform includes data-powered SIEM, SOAR, and UEBA. AI and intelligent automation help your SOC make the right decisions in real time.

DNIF

Real-time security event monitoringLog normalization and mapping+6

Securing your digital world with trusted expertise and ease.

Elastic

Centralized security event collection+8

Elastic Security provides an open-source SIEM platform built on the Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) for collecting, indexing, and analyzing security logs from endpoints, networks, clouds (AWS, Azure, Google Cloud), and firewalls. It supports ECS-compliant index mappings, threat detection via KQL queries for brute force and lateral movement, correlation rules for multi-stage attacks, IOC matching with enrich policies, and Watcher-based alerting. Best for SOC teams needing scalable search analytics, real-time monitoring, and integration with EDR, XDR, SOAR in resource-constrained environments.

EventTracker (Netsurion)

Log ingestion and normalization from thousands of sources

One platform for 24/7 detection, investigation, and response, run by our elite SOC.

Exabeam

Cloud-native security log managementHigh-speed log ingestion and search+8

8 products

Exabeam is the leader in behavior intelligence for the agentic enterprise.

Exaforce

AI-agent-driven autonomous alert triage+5

At Exaforce, we are on a mission to 10x improve the productivity and efficacy of security and operations teams using our transformative multi-model AI engine.

Expel

24×7 human-led monitoring and alert triage across endpoints (Windows, Mac, Linux), networks, SIEMs, AWS/Azure/GCP control planes, and SaaS apps like Okta and Microsoft 365, detecting threats via EDR agent telemetry and cloud configuration logsActive response authority enabling analysts to isolate hosts, block malicious IPs/domains at firewalls, disable compromised accounts, terminate processes, and quarantine files without waiting for customer approval on every action+6

Does MDR have to be so bad? (Turns out, no.)

Fencer

Application Security (DAST/SAST)

9 products

Fencer is the platform we wish we had.

Continuous DAST scanningBlack-box runtime probingExact finding location+8

Fortinet

Firewall / NGFW

9 products

Fortinet’s FortiGate line is the company’s Firewall/NGFW offering, covering stateful firewalling, application control, IPS, web filtering, SSL/TLS inspection, and threat-intelligence-backed blocking. It is widely deployed from branch and edge sites to enterprise perimeter and segmentation use cases, with hardware, virtual, and cloud form factors managed through the same Fortinet policy stack. Buyers typically choose it when they need firewall enforcement plus inline inspection and VPN capability in one appliance, especially in environments that already use FortiGuard threat feeds or the Fortinet Security Fabric. Adjacent products include SD-WAN and ZTNA, but those are not the core scope here.

Next-generation firewall inspection+10

Google Cloud Security

Data Security Posture Management (DSPM)

Automatic sensitive data discovery+10

Google Cloud DLP (now Sensitive Data Protection) is a fully managed service for discovering, classifying, and protecting sensitive data across Google Cloud Platform resources including BigQuery, Cloud Storage, and Datastore. It scans structured/unstructured data, text streams, and images via OCR, using over 200 built-in infoType detectors for PII like credit card numbers and phone numbers. De-identification methods include masking, redaction, tokenization, format-preserving encryption, and date-shifting. Best for enterprises with heavy GCP usage needing automated, scalable scanning of data at rest and in transit via API or console.

Gravwell, Inc

Ingest raw security data without normalization+9

Gravwell is an unstructured data fusion platform designed for security teams needing flexible, high-speed ingestion and analysis without the overhead of rigid schemas. It utilizes a piped query language similar to Unix pipes or Splunk, allowing for retroactive analysis of any data type, including binaries, logs, and netflow. The platform complements traditional SIEMs by providing a 'data lake' approach for forensic investigations and real-time threat hunting where formal ingestion pipelines are too slow.

Graylog

Centralize and normalize security logs+10

Graylog is the AI-powered SIEM and log management platform built for security and IT operations. The platform centralizes and analyzes event data from across complex environments to help teams detect threats faster, investigate smarter, and control data costs, without compromise.

Gurucul

Cloud-native SIEM architecture+9

Gurucul sells a cloud-native SIEM platform built around log ingestion, normalization, behavioral analytics, and risk-based alerting. In the SIEM category, it is aimed at security operations teams that need to consolidate security and non-security telemetry, retain logs for compliance, and reduce noisy detections with custom machine-learning content and correlation logic. Gurucul also markets adjacent UEBA, SOAR, and identity analytics modules, but its SIEM offering is the core entry point for SOC monitoring, investigation, and reporting.

Hunters

Centralized log collection and searching+9

Hunters is a cloud-native, AI-powered SIEM built for modern SOC teams who have outgrown legacy SIEM platforms. It ingests data from across the security stack, normalises it automatically using the Open Cybersecurity Schema Framework (OCSF), and uses AI to surface prioritised incidents rather than raw alerts. Designed to reduce analyst workload and time-to-detection, it is a common evaluation target for organisations looking to replace or augment Splunk or QRadar with a more automated, scalable SOC platform.

IBM QRadar

Centralized security log collection+8

IBM Security QRadar SIEM is a security information and event management platform that collects, normalizes, and correlates log and network flow data from thousands of on-premises, hybrid, and cloud sources. It uses the Sense Analytics Engine for real-time threat detection via correlation rules, behavioral anomaly identification, and integration with over 700 pre-built device connectors. Complementary modules include Risk Manager, Vulnerability Manager, and Incident Forensics. Available as cloud-native SaaS with Sigma community rules and machine learning-based risk scoring. Best suited for large enterprises requiring scalable SOC operations and compliance reporting.

LimaCharlie

Universal log and telemetry ingestion+11

LimaCharlie provides a 'SecOps Cloud Platform' that delivers an API-first approach to security infrastructure, allowing teams to mix and match security capabilities. It features a cross-platform EDR agent, real-time log ingestion, and a detection-as-code engine that simplifies the creation of custom response playbooks. The platform is designed to replace fragmented security toolsets with a unified infrastructure-as-a-service model for MSSPs and sophisticated enterprise SOCs.

Logpoint

Centralized security log collectionLog parsing and normalizationReal-time threat detection and alerting+5

European cybersecurity ally

ManageEngine PAM360

Privileged Access Management (PAM)

Centralized privileged access governance+11

ManageEngine PAM360 is a unified Privileged Access Management platform that centralizes governance of privileged credentials, sessions, and accounts across IT infrastructure for humans and non-human entities. It stores credentials in an encrypted vault with automated rotation, enforces Just-In-Time elevation, and provides session recording with command filtering. Trusted by over 5000 organizations and government agencies, it suits enterprises needing comprehensive PAM with endpoint privilege management, behavioral anomaly detection via AI/ML, and role-based access controls. Best for mid-to-large IT teams managing hybrid environments with strict compliance requirements.

Microsoft Sentinel

Ingests security data from many sources+10

Microsoft Sentinel is a cloud-native SIEM and SOAR platform deployed on Azure that centralizes threat detection, investigation, and response across multicloud and hybrid environments. It combines machine learning analytics, threat intelligence integration, and automated playbook orchestration to reduce alert noise and accelerate incident handling. Best suited for organizations with existing Microsoft security investments (Microsoft 365 Defender, Azure Defender for Cloud) seeking unified cloud-based security operations without on-premises infrastructure.

NetBrain

Respond faster to IDS and SIEM alerts+6

NetBrain delivers no-code network automation that enhances cybersecurity by reducing manual tasks, accelerating incident response, and ensuring consistent enforcement of network policies. By continuously assessing and visualising hybrid network environments, NetBrain helps security teams detect anomalies faster, validate configurations, and close attack surfaces, all while reducing operational risk and downtime.

NetWitness

Enriched log data analysis+10

NetWitness is a comprehensive threat detection and response platform that integrates SIEM, network forensics, endpoint data, and user entity behavior analytics (UEBA). It provides security analysts with deep visibility across the entire attack lifecycle by capturing and analyzing packet-level data alongside logs and endpoint telemetry. The platform is designed for high-scale enterprise environments, replacing fragmented point solutions with a unified workbench for incident investigation and response orchestration.

Palo Alto Networks

Firewall / NGFW

21 products

Palo Alto Networks is a major vendor in the Firewall / NGFW market, best known for PAN-OS-based next-generation firewalls and Cloud NGFW. Its firewalls combine application-aware policy, user-based controls, and threat prevention to inspect traffic, including encrypted sessions, and block known and unknown threats. It fits enterprises that need granular segmentation, internet edge protection, and consistent policy across physical and cloud deployments. Adjacent offerings exist, but the core firewall line remains centered on network traffic control, inspection, and prevention.

Active-passive firewall high availability+22

Panther

Detection-as-code in PythonCloud-native SIEM data lake+8

Our mission is to make security teams smarter and faster than attackers.

PuppyGraph

Zero-ETL graph querying+9

The Only Graph Analytic Engine That Enables Users To Query One Or More Relational Data Stores As A Unified Graph Model.

Rapid7

Vulnerability Management

11 products

Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers.

Asset discovery and vulnerability scanning+11

Redborder

Correlate email, network, remote login, and endpoint signals

We provide Cybersecurity tools to a wide range of companies, institutions, telecomunication providers, etc..We make life easier for CISO and system administrators.

ReliaQuest

Autonomous alert investigation and triage+10

10 products

ReliaQuest delivers an Agentic AI Security Operations platform, GreyMatter, that unifies detection, investigation, and response across SIEM, EDR, and Cloud environments. It utilizes AI agents to automate data collection and the standard diagnostic workflows typically handled by Tier 1 and Tier 2 analysts. The platform provides a centralized console to orchestrate response actions without the need for constant data migration to a single lake.

RSA NetWitness

Centralized log management+9

RSA provides an AI-powered Unified Identity Platform to protect the world's most secure organizations. RSA provides automated identity intelligence, authentication, access, governance, and lifecycle capabilities to reduce risks, secure authentication, maintain compliance, and automate processes.

RunReveal

Centralized security log managementBuilt-in data pipeline ingestion+8

One platform for security data. Ingest, detect, respond.

Scanner

Stores structured and unstructured security data at scale, including nested JSON logs, so analysts can keep cloud audit, identity, and application telemetry in one repository.Provides full-text search over complex security logs, which is useful when native JSON fields, free-form messages, and variable event shapes make SQL-only workflows insufficient.

Making years of security logs searchable in seconds.

Seceon

Autonomous alert triage+11

Seceon is a cybersecurity platform vendor positioned for SOC operations, with its aiSOC/aiSIEM and SOC automation offerings used for alert triage, investigation, threat hunting, and response orchestration. In the Agentic SOC & Investigations scope, its pitch centers on correlating logs, flows, identities, cloud, endpoint, and application data to reduce manual analyst work and speed incident decisions. It is best suited for MSSPs, MDR providers, and enterprise SOCs that want multi-tenant operations and automated investigation workflows rather than an endpoint-only tool.

SecureVisio

Risk-Based Prioritization+3

SecureVisio connects the dots between Incidents, Vulnerabilities, Assets, and Risks, empowering your team with AI-assisted guided response and risk-based prioritization. We give your teams the insight, automation, and context they need to act decisively.

Securonix

Cloud-native SIEM data collection+8

Securonix is a cloud-native SIEM vendor offering unified detection and response across SIEM, UEBA, SOAR, and threat intelligence capabilities in a single platform. The company positions itself as analytics-driven with integrated machine learning for threat detection and automated incident response. Securonix targets mid-to-large enterprises seeking to consolidate security tools and reduce alert fatigue through behavioral analytics and threat chain modeling rather than signature-based detection alone.

ServiceNow Security Operations

Connect existing security tools to incidents+10

ServiceNow Security Operations (SecOps) is a SOAR-integrated security platform that consolidates incident response, vulnerability management, and threat intelligence within the ServiceNow ecosystem. It ingests data from existing security tools including SIEMs, firewalls, and endpoint products to prioritize incidents by business impact and automate response workflows. Positioned for enterprises seeking unified security orchestration across IT, security, and risk teams, SecOps emphasizes cross-functional collaboration and reduces manual handoffs between disparate security systems.

Snowflake

Unified security data storageHigh-scale threat hunting+9

Snowflake is not a dedicated SIEM vendor; in this category it functions as a data platform for security log retention, normalization, and SQL-based analysis of Snowflake audit data. Snowflake documentation and SIEM-migration guidance emphasize ingesting logs from sources such as Kafka, Spark, and ServiceNow, then storing and querying security events in Snowflake or exporting them to an external SIEM. It is best suited for teams that want long-term retention, custom detection logic, and compliance-oriented access to large volumes of security telemetry rather than a turnkey SOC console.

SOC Prime

Threat Intelligence

Provides continuously updated threat detection content enriched with actionable cyber threat intelligence and metadata, so teams can operationalize new threats without building every rule from scratch.Maps detection content to the MITRE ATT&CK framework, helping analysts link indicators and techniques to adversary tactics, techniques, and procedures.

SOC Prime operates the world's largest and most advanced platform for detection engineering, transforming how security teams discover, build, and respond to threats through real-time intelligence, AI-driven context, and advanced detection engineering workflows.

Spectrum Security

Threat detection for security operations+6

Spectrum Security is a cybersecurity startup founded in 2025 that focuses on security operations and threat detection. Based on available reporting, its platform is designed to close the detection gap by automating detection upstream, which places it in the detection engineering and SOC tooling segment rather than endpoint or network security. It appears best suited for security teams that want earlier-stage detection logic and alert generation to support SOC workflows. Public information is limited, so detailed deployment, integration, and workflow specifics are not broadly disclosed.

Splunk

Collect and normalize security data+11

8 products

Our purpose is simple and unwavering: to build a safer and more resilient digital world. Every day, we help SecOps, ITOps, and engineering teams secure their systems, resolve issues quickly, and keep their organizations running without interruption.

Sqreen (DataDog)

API Security

9 products

Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale.

Runtime application protection in the application code

Stellar Cyber

Network Detection & Response (NDR)

12 products

Build the platform that makes it easy for everyone to see what's coming – and act fast with confidence.

Deep packet inspection collects L2–L7 metadata and files for over 4,000 network applications from raw packets to enable behavioral anomaly detection and threat identification.

Stormshield

Firewall / NGFW

Unified cybersecurity firewall protection+8

Stormshield Network Security (SNS) is the company’s firewall and NGFW line, aimed at organizations that want perimeter and segmentation controls with integrated inspection, IPS, VPN, and application control. Its product pages describe real-time protection, URL filtering, IP geolocation controls, and multi-WAN routing, which places it in the UTM-style NGFW segment rather than a pure packet-filtering firewall. It is typically positioned for enterprises, public-sector networks, and distributed sites that need on-premises firewall appliances and centralized management.

Sumo Logic

Cloud-native security analytics+8

Intelligent Operations for the AI era. Agentic AI-powered security and cloud analytics to automate, detect and investigate at the speed of now.

Tenex AI

AI-native alert triage and prioritizationAutomated threat containment with playbooks24/7 human-led continuous monitoring+3

100% Security Alert Coverage.

Trellix Helix

Next-generation SIEM with advanced search+11

Trellix Helix is a SaaS security operations platform that unifies SIEM, SOAR, and threat intelligence, integrating over 600 Trellix and third-party tools for multi-vector threat detection and response. It augments existing SIEMs with analytics, behavioral analysis, and workflow automation, enabling correlated investigations across endpoints, networks, and cloud environments. Best suited for enterprises seeking XDR capabilities without replacing legacy SIEMs, it leverages Trellix's global threat intelligence for contextual IOCs and TTP-based rules, streamlining alert triage and containment.

Trench Security

Agentic direction mesh for rapid threat detection+4

Trench Security appears to have no publicly verifiable SIEM product presence in the provided search results, so a factual vendor profile cannot be confirmed from source material alone. Based on the category scope, a SIEM profile would normally cover centralized log collection, normalization, correlation rules, long-term retention, and compliance reporting for SOC and audit use cases. If Trench Security has a SIEM offering, the buyer fit would likely be organizations seeking log management and detection content rather than SOAR or EDR features, but that cannot be substantiated here.

TrendAI

AI Security Posture (AI-SPM)

AI stack discovery and inventory+6

TrendAI’s AI Security Posture Management (AI-SPM) capability is part of Trend Vision One and is positioned to give security teams visibility into the cloud assets used to build AI services, including threats, misconfigurations, and attack paths. Trend Micro describes it as helping organizations understand the AI-related cloud assets in use and the security status of those assets through interactive dashboards and tables. It is best suited for enterprises already using cloud-based AI services and wanting posture visibility across AI build environments rather than runtime enforcement. TrendAI also markets adjacent platform capabilities outside this scope.

Ziggiz