License & Deployment Mix: 33 tools – 13 OSS, 14 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)

What Is SIEM?

Security Information and Event Management (SIEM) is a security technology that collects, normalizes, correlates, and analyzes log data from across an organization’s entire IT environment – servers, network devices, applications, endpoints, cloud services, and identity providers – to detect security threats, support incident investigation, and meet compliance requirements.

SIEM platforms combine two historically separate functions:

• SIM (Security Information Management) – long-term log collection, storage, and compliance reporting
• SEM (Security Event Management) – real-time event correlation, alerting, and dashboarding

Modern SIEM has evolved far beyond simple log aggregation. Today’s platforms incorporate User and Entity Behavior Analytics (UEBA), machine learning for anomaly detection, threat intelligence feeds, Security Orchestration Automation and Response (SOAR) capabilities, and detection-as-code workflows. The boundary between SIEM, XDR, and security data lakes is increasingly blurred.

Enterprise SIEM platforms provide:

• Log collection and normalization – ingest logs from hundreds of source types (syslog, agents, API collectors, cloud connectors) and normalize them into a common schema for cross-source correlation
• Correlation rules – define detection logic that matches patterns across multiple log sources and time windows; MITRE ATT&CK mapping; chained rules for multi-stage attack detection
• UEBA (User and Entity Behavior Analytics) – ML-driven baselines of normal user and device behavior; detect anomalies such as impossible travel, unusual access patterns, privilege escalation, and lateral movement
• Threat intelligence – ingest IOC feeds (STIX/ TAXII, MISP, commercial feeds) and automatically correlate against incoming logs for known-bad IPs, domains, file hashes, and TTPs
• Incident response – case management, alert triage, investigation timelines, evidence collection, and analyst collaboration; SOAR playbooks for automated response actions
• Compliance reporting – pre-built report templates for PCI-DSS, HIPAA, SOX, GDPR, SOC 2, NIST, and CIS; scheduled report generation; audit trail and evidence export
• Threat hunting – ad-hoc search across historical log data; query languages (SPL, KQL, Lucene, SQL) for proactive investigation; saved searches and hunt notebooks
• Dashboards and visualization – real-time security dashboards; drill-down from summary metrics to individual events; geographic and timeline visualizations
• Multi-tenancy – centralized management of multiple customer environments with data isolation; per-tenant rules, dashboards, and retention policies; essential for MSPs and MSSPs

SIEM is the backbone of Security Operations Centers (SOCs). Without SIEM, security teams lack the centralized visibility needed to detect attacks that span multiple systems, correlate seemingly unrelated events into coherent incident timelines, and demonstrate compliance to auditors.

The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.

Comparison

This evaluation covers the full SIEM and security log-analytics landscape: self-hosted open source, commercial, and cloud-native platforms.

Overview Comparison

Log Collection & Processing

Detection & Analytics

Incident Response

Storage & Scale

SSO / OIDC Comparison

These tools assume an Authentik-class OIDC provider as the IdP. OIDC is the preferred SSO protocol.

* = requires extension, plugin, specific configuration, or cloud identity federation

Best SSO support: Splunk ES, Exabeam, Securonix, Sumo Logic, Datadog, Panther (OIDC + SAML + SCIM)

No SSO: Security Onion, OSSIM, Graylog (OSS), Elastic (Basic), Apache Metron, OSSEC

OIDC among OSS: OpenSearch Security Analytics, TheHive, Velociraptor, Wazuh (via OpenSearch)

Monitoring Integration

monitoring stack integration for monitoring the SIEM platform itself and for sharing data between monitoring and SIEM.

Compliance & Reporting

Tools

33 tools.

Amazon GuardDuty

Amazon GuardDuty is an intelligent threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

Apache Metron

Apache Metron was an open-source big data security analytics platform designed to process and analyze massive volumes of security telemetry in real time.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

AWS Security Lake

AWS Security Lake is a purpose-built security data lake service that automatically centralizes security data from AWS services, SaaS providers, on-premises systems, and cloud sources into a purpose-built data lake stored in S3.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

Datadog Security

Datadog Security is the security monitoring suite within the Datadog observability platform, providing Cloud SIEM, Cloud Security Management (CSM), Application Security Management (ASM), and Cloud Workload Security (CWS).

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

Devo

Devo is a cloud-native security data analytics platform designed for high-speed data ingestion and real-time analysis at massive scale.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

Elastic Security Basic

Elastic Security is the SIEM and security analytics solution built into the Elastic Stack (Elasticsearch, Kibana, Beats/Elastic Agent).

License: LicenseRef-Elastic-2.0 (source-available) · Kind: web · Deploy: native, docker, k8s · SSO: none

Website

Elastic Security Platinum

Elastic Security Platinum is the commercial tier of Elastic Security that adds machine learning anomaly detection, endpoint protection (Elastic Defend), cross-cluster search, SSO/OIDC authentication, and advanced response actions to the fre…

License: Proprietary (proprietary) · Kind: web · Deploy: native, docker, k8s · SSO: none

Website

Exabeam

Exabeam is a next-generation SIEM platform known for its advanced User and Entity Behavior Analytics (UEBA) capabilities.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Google Chronicle

Google Chronicle (now part of Google Security Operations) is a cloud-native security analytics platform built on Google’s infrastructure that provides petabyte-scale security data retention, sub-second search across months of data, and auto…

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

Grafana Loki (Security Use)

Grafana Loki is a horizontally scalable, highly available log aggregation system designed to be cost-effective and operationally simple.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: none

Website · Source

Graylog Open Source

Graylog is an open-source log management platform designed for collecting, indexing, and analyzing log data from any source.

License: SSPL-1.0 (source-available) · Kind: web · Deploy: native, docker · SSO: none

Website

Graylog Security

Graylog Security is the commercial SIEM tier of the Graylog platform that adds anomaly detection, security-specific content, correlation engine, compliance reporting, and OIDC/SAML authentication to Graylog’s strong log management foundatio…

License: Proprietary (proprietary) · Kind: web · Deploy: native, docker · SSO: none

Website

Hayabusa

Hayabusa is a fast, open-source Windows event log (EVTX) analyzer written in Rust by Yamato Security, applying 4,000+ Sigma-based rules mapped to MITRE ATT&CK for threat hunting and forensics.

License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Hunters

Hunters is a cloud-native SOC (Security Operations Center) platform that automates threat detection, investigation, and response across the entire security stack.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

IBM QRadar

IBM QRadar is an enterprise SIEM platform providing log management, network flow analysis, vulnerability assessment correlation, and advanced threat detection.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas, appliance · SSO: none

Website

LogRhythm

LogRhythm is an enterprise SIEM platform that combines log management, network and endpoint monitoring, UEBA, and SOAR capabilities into an integrated security operations platform.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Matano

Matano is an open-source serverless security data lake platform designed for AWS. It enables security teams to collect, normalize, and analyze petabyte- scale security logs using a detection-as-code approach.

License: Apache-2.0 (OSS) · Kind: web · Deploy: saas, native · SSO: none

Website · Source

Microsoft Sentinel

Microsoft Sentinel is Azure’s cloud-native SIEM and SOAR platform that provides intelligent security analytics across the enterprise.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

MozDef

MozDef (Mozilla Defense Platform) is an open-source security incident management and automation platform developed by Mozilla’s Enterprise Information Security team.

License: MPL-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

OpenSearch Security Analytics

OpenSearch Security Analytics is a security plugin built into OpenSearch that provides SIEM-like detection, correlation, and alerting capabilities directly within the OpenSearch platform.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker, k8s · SSO: OIDC

Website · Source

OSSEC

OSSEC (Open Source Security Event Correlator) is a host-based intrusion detection system (HIDS) that provides log analysis, file integrity monitoring, rootkit detection, active response, and real-time alerting.

License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

OSSIM / AlienVault Open Source

OSSIM (Open Source Security Information Management) is an open-source SIEM platform originally developed by AlienVault, now maintained by AT&T Cybersecurity.

License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Panther

Panther is a cloud-native SIEM platform built around the detection-as-code paradigm, where all detection rules are written in Python and managed through Git version control workflows.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML

Website

Rapid7 InsightIDR

Rapid7 InsightIDR is a cloud SIEM platform that combines log search, UEBA, network traffic analysis, endpoint detection, and deception technology into a unified threat detection and response solution.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Security Onion

Security Onion is a comprehensive open-source network security monitoring (NSM) and SIEM platform that combines full packet capture, network-based and host-based intrusion detection, log management, and case management into a single distrib…

License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Securonix

Securonix is a cloud-native SIEM platform built around User and Entity Behavior Analytics (UEBA) as a core capability rather than an add-on.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

Sigma

Sigma is an open, vendor-agnostic YAML format for log-based security detection rules, with a community rule repository and the pySigma framework to convert rules to many SIEM query languages.

License: LicenseRef-DRL-1.1 (source-available) · Kind: web · Deploy: saas · SSO: none

Website · Source

Splunk Enterprise Security

Splunk Enterprise Security (ES) is the market- leading commercial SIEM platform, providing comprehensive security monitoring, advanced threat detection, incident investigation, and compliance reporting.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Stellar Cyber

Stellar Cyber is an Open XDR platform designed specifically for security teams and MSSPs that need to detect and respond to threats across their entire attack surface.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Sumo Logic

Sumo Logic is a cloud-native log analytics and SIEM platform that provides real-time security monitoring, threat detection, and compliance reporting as a SaaS service.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML

Website

TheHive

TheHive is a SOC incident-response case-management platform. TheHive 5 is proprietary freemium (ex-AGPL); the companion Cortex engine stays AGPL-3.0.

License: Proprietary (proprietary) · Kind: web · Deploy: native, docker, saas · SSO: none

Website · Source

Velociraptor

Velociraptor is an open-source digital forensics and incident response (DFIR) tool focused on endpoint visibility and artifact collection at scale.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: OIDC

Website · Source

Wazuh

Wazuh is a comprehensive open-source security platform that provides unified XDR and SIEM capabilities.

License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: SAML

Website · Source