Best SIEM Tools and Software

SolarWinds : Best for log aggregation

Figure A

SolarWinds Security Event Manager (SEM) is focused on log aggregation and threat detection. It can easily process and forward raw event log data to external applications for further analysis using syslog protocols, which is an area where it stands out from the competition.

Pricing

• SolarWinds annual SEM subscriptions start at $2,877.
• Perpetual licensing is available for around $5,000.

Features

• Automation to remediate some incidents.
• Export log data and share with other teams or vendors.
• Dashboards indicate the state of security, and reports address compliance requirements.
• Pre-built connectors pull data from numerous sources.
• A file integrity checker tracks access and changes made to files and folders to detect unauthorized or malicious activity.

Pros

• Good for network-related events and analyzing per-host activities, such as logons, privilege usage and registry alterations.
• Security features include data encryption, single sign-on and smart card authorization.
• Ability to restrict access from IPs, block applications and deny access to removable media.

Cons

• Dashboards can become cluttered and hard to understand when processing large amounts of data.
• Can struggle with the complexity of very large enterprise environments.
• Automated does not provide a full range of remediation capabilities.

CrowdStrike Falcon LogScale: Best for remediation

Falcon LogScale is a SIEM and log management platform that lets users collect logs and access live data. It takes things a stage further than most SIEM tools by including a wide range of remediation features courtesy of its integration with the rest of the CrowdStrike Falcon platform as well as its extensive XDR capabilities.

Pricing

• Pricing for the enterprise edition of the Falcon platform starts at $925 a year for five devices, but additional fees will be needed for complete log management and remediation features.

Features

• Collect logs at petabyte scale.
• Rapidly access live data with sub-second latency.
• Fast search, real-time alerting and customizable dashboards
• Retain data as long as you need for compliance, threat hunting and historical investigations.

Pros

• Index-free architecture and compression technology minimize the computing and storage resources required to ingest and manage data.
• Said to cut log management costs by up to 80% compared to alternative solutions.
• Strong remediation capabilities, courtesy of integration with the CrowdStrike Falcon platform.

Cons

• Evolved from the XDR side, so is more of a log management tool with SIEM-like features than a full-featured SIEM suite.

Splunk Enterprise Security: Best for cloud native environments

Figure B

Splunk Enterprise Security offers cloud-based security-related event notifications and log monitoring. It can identify resource bottlenecks, failing hardware, capacity issues and other potential issues. As it evolved in the era of the cloud, it is particularly well suited to cloud-native environments. Splunk Incident Review dashboard Image: Splunk

Pricing

• Splunk’s complex pricing structure is split into entity, activity, workload and ingest categories.
• Splunk does not publish exact prices, but user reports place them anywhere from $173 per month up to $1,800 per GB.

Features

• Threat detection with machine learning, including 1,400 detections for frameworks such as MITRE and others.
• Ingest and monitor tens of terabytes of data per day from any source, structured or unstructured.
• Attribute risk to users and systems, map alerts to cybersecurity frameworks and trigger alerts when risk exceeds thresholds.
• Investigate security events or suspicious activity rapidly.

Pros

• Triggers that respond to logged situations with customized response patterns.
• Analytics capabilities are built in, which can produce long-term graphs.
• View a wide range of logs and drill down into specific times or data sources.
• Ability to solve problems across multiple platforms.

Cons

• Some users consider Splunk to be expensive when monitoring large amounts of data in major enterprise environments.
• The company’s recently announced acquisition by Cisco may lead to long integration delays and lack of progress on its innovation roadmap.

Datadog Security Monitoring: Best for customization

Figure C

Datadog has designed its platform to be highly customizable to user needs. Datadog Security Monitoring makes it relatively easy to see at a glance what’s happening with all sources being analyzed.

Pricing

• The pro version costs $15 per host per month, and the enterprise version is $23 per host per month.

Features

• Over 350 detection rules and more than 500 integrations with log sources provide full visibility into security operations.
• Ability to see inside any stack or application at any scale and anywhere.
• Infrastructure monitoring, APM, log management, device monitoring, cloud workload monitoring, server monitoring and database monitoring, all included.
• Assemble data from logs and other metrics to provide context and minimize incident response time.

Pros

• Datadog takes a monitoring approach geared toward analytics and is favored by DevOps and IT to address cloud and infrastructure performance.
• Datadog installation is straightforward, courtesy of agent deployment.
• Dashboards and interfaces are easy to customize.

Cons

• Datadog stops short of calling itself a complete SIEM platform, as it is more focused on cloud monitoring and security but has been expanding its cloud SIEM capabilities.
• Datadog lacks some of the log monitoring capabilities of full-featured SIEM platforms.

LogRhythm SIEM: Best for on-premises.

Figure D

LogRhythm’s SIEM software is designed to be hosted on-premises. It has built AI and automation features into its platform. Reporting based on queries is easy to configure. The system integrates well with an array of security and technological solutions..

Pricing

• Begins at $28,000.
• A variety of pricing options are available, such as perpetual or subscription software licenses, an unlimited data plan and a high-performance plan.

Features

• Heightens the detection of security and potential threats.
• LogRhythm provides an integrated user experience.
• Combines enterprise log management, security analytics, user entity and behavioral analytics (UEBA), network traffic and behavioral analytics (NTBA) and security automation and orchestration.
• As well as an on-prem version, it also offers a cloud-based SIEM.

Pros

• Built on a machine analytics/data lake technology foundation that’s designed to scale easily.
• Open platform allows for integration with enterprise security and IT infrastructure.
• Embedded modules, dashboards and rules deliver threat monitoring, threat hunting, threat investigation and incident response.
• Integration with many third-party platforms.
• User comments are favorable about the speed and responsiveness of the support team.

Cons

• Large upfront investment often needed for the on-prem version.

RSA NetWitness: Best for large enterprises

Figure E

RSA, well known for its multifactor soft and hard token authentication products, has a strong footprint in the overall security community. Its NetWitness SIEM is geared more toward large businesses, with versions that work both on-premises and via cloud.

Pricing

• Pricing starts at $857 per node per month.

Features

• NetWitness monitors for actionable events.
• Behavior analytics observe hacker activity and recreate full sessions to observe the precise anatomy of an attack.
• Intelligence feeds based on customizable information track and remain key operations.
• Visibility into log data spread across the IT environment

Pros

• Simplifies threat detection, reduces dwell time and supports compliance.
• Centralized log management and log monitoring for logs generated by public clouds and SaaS applications.
• Identification of suspicious activity that evades signature-based security tools.

Cons

• The learning curve and implementation efforts can be steep.
• Some users require a large amount of rack space.

ManageEngine Log360: Best for small businesses

ManageEngine Log360 is a SIEM that serves businesses of all sizes but is especially suited to small business deployments. It also integrates well with a series of other security and monitoring products that the company offers.

Pricing

• Starts at $595.

Features

• Detect internal threats, such as data exfiltration and user account compromise, by recognizing subtle changes in user activity.
• Identify suspicious or blocklisted IPs, URLs and domains intruding into your network by correlating your log data with reputed threat feeds.
• Automate responses to events with configurable workflows.
• Monitor active VPN connections and receive alerts on unusual VPN activities and VPN access from malicious sources.

Pro

• Migrate SharePoint environments to Microsoft 365 by selecting the required SharePoint site users, groups and permission levels.
• Audit changes in Active Directory infrastructure and Azure AD in real time.
• Discover and classify sensitive files, audit users’ file activities and analyze file permissions.
• Detect, disrupt and prevent sensitive data leaks via endpoints, like USBs and printers, email and web applications with real-time security monitoring.

Cons

• Some users complain of poor support.
• May struggle to scale well enough in large, complex environments.

IBM Security QRadar SIEM: Best for IBM shops

Figure F

IBM QRadar is a threat detection and response solution that includes an SIEM module. As such, IBM Security QRadar SIEM is especially suited to enterprises that are heavily invested in IBM tools and systems, as well as large enterprise deployments.

Pricing

• Per node monthly cost starts at $2,340.

Features

• Accelerated threat response by dashboards that highlight alerts that matter.
• Uses near real-time analytics to intelligently investigate and prioritize high-fidelity alerts based on severity of risk.
• Identifies insider threats and risky user behavior.
• Part of IBM Cloud Pak for Security which uses AI to provide risk assessments as well as analytics.

Pros

• Machine learning-based analytics to identify anomalies as potential threat actors.
• QRadar SIEM augments traditional log data by monitoring key network flow data.

Cons

• Lack of integration with other SIEM tools.
• Those not using IBM platforms may find it difficult to deploy.

Trellix Security Operations and Analytics: Best for Windows shops

Trellix Security Operations and Analytics contains the bones of the old McAfee Enterprise Security Manager SIEM platform and is now a module known as Trellix Enterprise Security Manager. That SIEM offering was Active Directory-based and well suited to Windows environments. But Trellix has expanded it to offer strong cloud support.

Pricing

• Trellix Virtual ESM is priced at $61,294.33 per VM.

Features

• The Trellix Helix SecOps platform is part of a suite that includes SIEM to help IT take control from incident to detection to response.
• Trellix Insights provides threat intelligence to predict and prioritize threats and prescribe countermeasures.
• Trellix ePO security management platform helps IT control and administer all endpoints from a single console.

Pros

• A central view of potential threats with built-in workflows removes complexity.
• Get greater transparency monitoring users, applications, networks and devices.
• Real-time threat identification and response reduces lead time to protect against threats.
• Can integrate products from 650+ third-party vendors.

Cons

• The full Trellix suite is needed to provide complete remediation capabilities.
• Some users complain that it can be slow to respond.

AT&T USM Anywhere: Best for asset discovery

AlienVault Unified Security Management platform (USM) is now AT&T USM Anywhere. It discovers assets and gathers data about running services, users, operating systems and hardware information. This asset focus means it can pick up any devices in the environment that it protects.

Pricing

• The essentials version starts at $1,075 per month. The standard starts at $1,695 per month and the premium at $2,595.

Features

• Automatically collects and analyzes data across the attack surface.
• Threat intelligence provided by AT&T Alien Labs.
• Supports an ecosystem of AlienApps to orchestrate and automate actions towards other security technologies and respond to incidents.

Pros

• Good for those who want their cybersecurity and SIEM services managed by someone else.

Cons

• Not suitable for organizations that need to maintain tight control over their own assets for sensitivity or compliance reasons.