SIEM &amp; log analytics

AI-powered Alert Triage & EnrichmentAutonomous InvestigationsAutomated Remediation+1

7AI is the foundational AI security company.

ABLATON LLC

AI investigationaudit trailEDR+6

Ablaton is an autonomous AI investigation platform that runs on top of the security tools a team already has, including SIEM, EDR and SOAR. It investigates each detection by testing competing hypotheses, scores feasibility and risk, and presents a decision with its supporting evidence, while people approve critical actions. It is offered as managed MDR for startups, as investigation for enterprise security teams, and as capacity for MSSPs and MDR providers.

Abstract

Flexible ingestion from any source+5

Abstract, founded in 2023, has built a revolutionary platform to redefine security operations, launching the world's first AI-Gen Composable SIEM.

Acttrident

AlienVault USM (AT&T Cybersecurity)

ActTrident™ is a United Kingdom cybersecurity company building a focused platform across human-centered security, AI security, quantum-oriented security planning, and governance-led product lines.

AT&T Cybersecurity AlienVault USM Anywhere is a cloud-hosted SIEM platform that unifies asset discovery, vulnerability assessment, intrusion detection, behavioral monitoring, and incident response for on-premises, cloud, and

Anomali

Threat Intelligence

Anomali ThreatStream is a threat intelligence platform that aggregates IOCs and IOAs from hundreds of global sources including Anomali Labs curated feeds, OSINT, premium feeds, and ISACs.

Anvilogic is a threat detection and hunting platform that works alongside existing data platforms (Snowflake, Databricks, Splunk) rather than replacing them.

Axoflow

Security Data Pipeline

Parse and normalize security telemetry+9

Ensure security-relevant data is available, accessible, and affordable to SecOps.

Beacon Security

Security telemetry management+4

At Beacon, we're building the unified, intelligent data layer that empowers defenders to see more, move faster, and act with confidence in an AI-driven world.

Bindplane

Security Data Pipeline

We are committed to helping organizations gain visibility into their IT infrastructure providing an orchestration engine that is easy to use and flexible enough to meet diverse needs.

Blumira

Identity-centric log correlation+7

Blumira is a cloud-native SIEM and XDR platform designed for mid-market organizations and MSPs.

Booli is an identity-centric SIEM vendor that focuses on log ingestion, event correlation, and investigation context built around user identity.

CrowdStrike

EDR

9 products

CrowdStrike Falcon is a cloud-native endpoint detection and response (EDR) platform that unifies endpoint protection, threat hunting, and managed response services to defend against advanced adversaries.

Adversary intelligence profiles+14

CyDeploy

Automated asset discovery and mappingImpact analysis for technology changes+4

Continuous Change Assurance for Critical Enterprises.

Cylake

Cylake is an AI-native cybersecurity platform built for organizations that require complete data sovereignty, including critical infrastructure and highly regulated environments.

Databahn

Security Data Pipeline

Databahn offers an intelligent data pipeline platform designed to optimize security data operations (SecDataOps) for SIEM and XDR environments.

Databricks

Unified security lakehouse+10

Databricks is not a legacy SIEM vendor; it positions its security offering as an open security lakehouse for ingesting, normalizing, querying, and retaining security telemetry at large scale.

Datadog

API Security

8 products

Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale.

Detexus sells SACMS, a detection control plane for teams running more than one SIEM.

SIEM-independent detection libraryMulti-SIEM deploymentCoverage measurement+2

Devo

Cloud-native SIEM data platform+7

Devo's integrated platform includes data-powered SIEM, SOAR, and UEBA. AI and intelligent automation help your SOC make the right decisions in real time.

DNIF

Real-time security event monitoringLog normalization and mapping+6

Securing your digital world with trusted expertise and ease.

Elastic

Centralized security event collection+8

6 products

Elastic Security provides an open-source SIEM platform built on the Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) for collecting, indexing, and analyzing security logs from endpoints, networks, clouds (AWS, Azure, Google

EventTracker (Netsurion)

One platform for 24/7 detection, investigation, and response, run by our elite SOC.

Exabeam

Cloud-native security log managementHigh-speed log ingestion and search+8

Exabeam is the leader in behavior intelligence for the agentic enterprise.

Fortinet

NGFW

8 products

Fortinet’s FortiGate line is the company’s Firewall/NGFW offering, covering stateful firewalling, application control, IPS, web filtering, SSL/TLS inspection, and threat-intelligence-backed blocking.

Next-generation firewall inspection+10

Google Cloud Security

DSPM

Automatic sensitive data discovery+10

Google Cloud DLP (now Sensitive Data Protection) is a fully managed service for discovering, classifying, and protecting sensitive data across Google Cloud Platform resources including BigQuery, Cloud Storage, and Datastore.

Gravwell, Inc

Gravwell is an unstructured data fusion platform designed for security teams needing flexible, high-speed ingestion and analysis without the overhead of rigid schemas.

Graylog

Centralize and normalize security logs+10

Graylog is the AI-powered SIEM and log management platform built for security and IT operations.

Gurucul

Cloud-native SIEM architecture+9

Gurucul sells a cloud-native SIEM platform built around log ingestion, normalization, behavioral analytics, and risk-based alerting.

Hunters

Centralized log collection and searching+9

Hunters is a cloud-native, AI-powered SIEM built for modern SOC teams who have outgrown legacy SIEM platforms.

IBM QRadar

Centralized security log collectionEvent normalization and correlation+7

IBM Security QRadar SIEM is a security information and event management platform that collects, normalizes, and correlates log and network flow data from thousands of on-premises, hybrid, and cloud sources.

LimaCharlie

Universal log and telemetry ingestion+11

LimaCharlie provides a 'SecOps Cloud Platform' that delivers an API-first approach to security infrastructure, allowing teams to mix and match security capabilities.

Verified · Managed by the vendor

Logpoint

Centralized security log collectionLog parsing and normalizationReal-time threat detection and alerting+5

European cybersecurity ally

Microsoft Sentinel

Ingests security data from many sources+10

Microsoft Sentinel is a cloud-native SIEM and SOAR platform deployed on Azure that centralizes threat detection, investigation, and response across multicloud and hybrid environments.

NetBrain

Respond faster to IDS and SIEM alerts+6

NetBrain delivers no-code network automation that enhances cybersecurity by reducing manual tasks, accelerating incident response, and ensuring consistent enforcement of network policies.

NetWitness

Enriched log data analysis+10

NetWitness is a comprehensive threat detection and response platform that integrates SIEM, network forensics, endpoint data, and user entity behavior analytics (UEBA).

Night/Shift

asset inventoryCAASMdata sovereignty+7

Night/Shift combines SIEM, cyber asset management, continuous controls monitoring and cyber risk quantification in one platform. It analyzes logs from IT systems and business applications to build a live asset inventory, flag policy violations, and detect and forecast incidents. It also estimates what a breach could cost, for use in leadership decisions.

Palo Alto Networks

NGFW

18 products

Palo Alto Networks is the world's leading cybersecurity company delivering AI-powered platform-based security solutions for networks, cloud, identities, and security operations across enterprises globally.

+22

Panther

Agentic SOC & Investigations

Detection-as-code in PythonCloud-native SIEM data lake+8

Our mission is to make security teams smarter and faster than attackers.

PuppyGraph

Zero-ETL graph querying+9

The Only Graph Analytic Engine That Enables Users To Query One Or More Relational Data Stores As A Unified Graph Model.

Rapid7

Vulnerability Management

9 products

Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience.

RSA provides an AI-powered Unified Identity Platform to protect the world's most secure organizations.

Centralized log management+9

RunReveal

Centralized security log managementBuilt-in data pipeline ingestion+8

One platform for security data. Ingest, detect, respond.

Scanner

Agentic SOC & Investigations

Making years of security logs searchable in seconds.

Seceon

Autonomous alert triage+11

Seceon is a cybersecurity platform vendor positioned for SOC operations, with its aiSOC/aiSIEM and SOC automation offerings used for alert triage, investigation, threat hunting, and response orchestration.

SecureVisio

Risk-Based Prioritization+3

SecureVisio connects the dots between Incidents, Vulnerabilities, Assets, and Risks, empowering your team with AI-assisted guided response and risk-based prioritization.

Securonix

Cloud-native SIEM data collection+8

Securonix is a cloud-native SIEM vendor offering unified detection and response across SIEM, UEBA, SOAR, and threat intelligence capabilities in a single platform.

ServiceNow Security Operations

Unified security data storage+10

ServiceNow Security Operations (SecOps) is a SOAR-integrated security platform that consolidates incident response, vulnerability management, and threat intelligence within the ServiceNow ecosystem.

Snowflake is not a dedicated SIEM vendor; in this category it functions as a data platform for security log retention, normalization, and SQL-based analysis of Snowflake audit data.

SOC Prime

Threat Intelligence

SOC Prime operates the world's largest and most advanced platform for detection engineering, transforming how security teams discover, build, and respond to threats through real-time intelligence, AI-driven context, and advanced

Spectrum Security

Threat detection for security operations+6

Spectrum Security is a cybersecurity startup founded in 2025 that focuses on security operations and threat detection.

Splunk

Collect and normalize security dataCorrelate events in real time+10

Our purpose is simple and unwavering: to build a safer and more resilient digital world.

Stellar Cyber

NDR

9 products

Build the platform that makes it easy for everyone to see what's coming – and act fast with confidence.

Stormshield

NGFW

6 products

Stormshield Network Security (SNS) is the company’s firewall and NGFW line, aimed at organizations that want perimeter and segmentation controls with integrated inspection, IPS, VPN, and application control.

Sumo Logic

Cloud-native security analytics+8

Intelligent Operations for the AI era. Agentic AI-powered security and cloud analytics to automate, detect and investigate at the speed of now.

Trellix Helix

Trellix Helix is a SaaS security operations platform that unifies SIEM, SOAR, and threat intelligence, integrating over 600 Trellix and third-party tools for multi-vector threat detection and response.

Trench Security appears to have no publicly verifiable SIEM product presence in the provided search results, so a factual vendor profile cannot be confirmed from source material alone.

TrendAI

AI-SPM

AI stack discovery and inventory+6

TrendAI’s AI Security Posture Management (AI-SPM) capability is part of Trend Vision One and is positioned to give security teams visibility into the cloud assets used to build AI services, including threats, misconfigurations,

Ziggiz