Report:

Magic Quadrant for Security Information and Event Management

Top Vendor Products for Security Information and Event Management in 2024

• Exabeam
• IBM
• Microsoft
• Securonix
• Splunk

Security Information and Event Management Vendor Product Comparisons 2024

• Devo - Visionary
  

  Pros:

  • SOC automation: Offloading manual work from SOC analysts, Devo DeepTrace builds threat traces of suspicious activity and attack chains via graph technology and attack tracing. This automates elements of data collection and interpretation and reduces overall effort required to create comprehensive incident reports.
  • Simple packaging: Devo offers three packages with increasing levels of analytics and automation: Intelligent SIEM Starter; Intelligent SIEM, with unlimited user and entity behavior analytics (UEBA) and security orchestration, analytics and reporting (SOAR); and Intelligent SIEM+, which adds Devo DeepTrace. Clients are able to choose based on needs and budget.
  • Scalability and accessibility: Devo's SIEM solution provides ease of data ingestion via an above-average number of out-of-the-box (OOTB) APIs and connectors.

  Cons:

  • Market presence: Devo continues to invest and expand its customer base; however, its visibility is still limited among SIEM buyers, both "greenfield" and more established.
  • Third-party data lake integrations: Although Devo's SIEM can integrate with third-party data lakes for querying, the number of integrations is limited compared to some competitors in the market.
  • SAP workloads: Organizations needing to protect SAP systems will not receive that capability OOTB. Devo depends on a third-party partnership with RHONDOS, which then allows customers to monitor the security and performance of their SAP environment.


• Elastic - Visionary
  

  Pros:

  • Query language: Elastic's query language, ES|QL, lends its strength to many SIEM uses, such as threat intelligence enrichment, incident analysis and threat hunting. Clients can build, save and schedule complex queries, and use the query performance tools to ensure that their queries run as anticipated and don't overconsume resources.
  • Flexible user interface (UI): Elastic's interface has a wide range of highly extensible features. Clients can customize dashboards and visualization by using a number of built-in options, or use the editor for extended flexibility. This strength will help clients seeking to create custom visualization and monitoring environments for specialized applications.
  • API and number of integrations: Elastic has made strong investments in an API strategy and has an above-average number of OOTB integrations. Clients can choose to pull data into Elastic via APIs for a wide range of cloud and application sources.

  Cons:

  • Advanced UEBA features: Elastic has OOTB UEBA functionality for common use cases. Advanced users will not find the same levels of customization available in UEBA as in other areas such as dashboarding and data processing.
  • OOTB compliance reports: Although Elastic's query functions can give a good view into data analysis, standardized reporting functions such as compliance objectives for PCI/DSS and GDPR are lacking compared to others in this research.
  • External endpoint detection and response (EDR) integrations: Elastic has no out-of-the-box bidirectional integrations with third-party EDR providers outside of its own EDR product. Some clients with existing investments in endpoint security technology may find Elastic's inclusion of its agent a drawback to the overall detection strategy.


• Exabeam - Leader
  

  Pros:

  • User interface: The Exabeam user interface capabilities strongly align with the needs of security analysts. An example is the strong out-of-the-box dashboards.
  • Live access to third-party data: Exabeam SIEM can display and process live data from third-party systems such as data lakes, enabling the platform to operate in a more decentralized fashion.
  • Risk-scoring features: Exabeam's SIEM dynamic scoring capabilities enable clients to take a user-driven view of security issues, linking discoveries together to get more effective scoring in real time, aiding alert suppression and prioritization.

  Cons:

  • Onboarding time: The Exabeam SIEM platform requires a higher-than-average amount of professional service days to configure environments — most of which are enterprise-sized — than other vendors' solutions evaluated as part of this research.
  • Enterprise customer focus: Exabeam predominantly focuses on the needs of enterprise customers. Smaller organizations should satisfy themselves that the approach and use-case focus is appropriate for their needs before purchasing.
  • Above-average cost: The Exabeam SIEM platform's above-average selling price should be noted by potential customers for whom price is the deciding factor.


• Fortinet - Challenger
  

  Pros:

  • Integration with broader Fortinet Security Fabric: Fortinet is a good choice for those widely invested in other Fortinet products. Fortinet Security Fabric enables the formation of a comprehensive security solution by integrating Fortinet products.
  • Built-in configuration management database (CMDB): Fortinet's centralized CMDB helps with IT infrastructure information discovery of devices, users and applications of organizations. Content filtering is also available.
  • Globally literate: Fortinet's global customer support coverage places sales teams and local support associates in every major geography. Its SIEM product set is also delivered in a larger number of native languages than its competitors.

  Cons:

  • External data lake integrations: Fortinet supports Elastic or Open Search as external data lake technologies.
  • Cloud platform adoption: Fewer customers have deployed Fortinet's SaaS platform, choosing the on-premises version, compared with other vendors in this research. FortiSIEM Cloud has near feature parity to the on-premises edition.
  • Coverage for monitoring cloud environments: FortiSIEM's cloud security coverage is not as strong as that of other competitors. The only cloud access security brokers (CASBs) supported are Fortinet's own FortiCASB product and Oracle CASB.


• Google - Visionary
  

  Pros:

  • Easy-to-use query interface: Chronicle query is good for both simple and advanced queries. It shows real-time data relationships, which is helpful for threat hunting or rapid investigations. Google is leveraging its well-known fast search capabilities to deliver rapid log analytics and query.
  • Capabilities: Chronicle's integrated SOAR allows for collaborative incident management functions under its Enterprise+ license. Chronicle also has native threat intelligence capabilities provided by Mandiant.
  • Flexible cost model: Chronicle allows per-user pricing with unlimited ingestion for the entire organization model, or an ingestion model.

  Cons:

  • SaaS-based solution: Chronicle is only available as a SaaS in Google Cloud Platform (GCP). Cloud self-hosted or on-premises options are unavailable.
  • Reporting: Chronicle has embedded reporting capabilities through its Looker reporting tool, but has no OOTB compliance content.
  • UEBA features: Chronicle's UEBA capabilities may be challenging to less advanced users who rely on OOTB content.


• Gurucul - Visionary
  

  Pros:

  • Behavioral detection capabilities: With extensive built-in intelligence and tuning capabilities, Gurucul's SIEM allows clients to build out custom advanced detections involving users, data and other objects.
  • Flexible and extensible architecture: Gurucul's multicloud architecture lets clients mix and match cloud data sources and back-end storage options, which may save the cost of data transport or duplication.
  • Risk profiling: Gurucul's risk profiling system automatically creates groups of like objects and scores them against baseline for simplified threat identification and automatic incident prioritization.

  Cons:

  • Built for advanced users: Gurucul's SIEM is more suited to larger and mature security buyers with complex use cases, who have time and experience.
  • SOAR integration: The SOAR capability on Gurucul lacks some of the advanced features of others, but is included as part of the core component.
  • Marketing execution: Gurucul has made strides in marketing, but the company and its solutions are still less visible in the SIEM market.


• Huawei - Niche Player
  

  Pros:

  • Expanded threat detection: HiSec Insight has a threat detection engine based on deep neural network algorithms and ML technology. Predefined playbooks and integrations are offered for automated threat handling.
  • Multisource data collection: Huawei has an extensive integrated product ecosystem to enable threat handling, as well as a number of APAC-region-specific integrations.
  • Advanced visualization capabilities: Huawei's threat knowledge graph-based inference analysis and visualized policy orchestration enable easy operation and management. Its Attack Path Visualization displays the entire attack transmission chain.

  Cons:

  • Common SaaS monitoring: Huawei does not offer integrations with Microsoft 365, Google Workspace, or applications from Workday, Salesforce or Box. Cloud infrastructure monitoring is not available outside of Huawei's own cloud.
  • Geographical presence: Huawei's customer base exists largely in China and the APAC region. Its presence is limited in EMEA and Latin America, and there is no customer presence or deployment infrastructure in North America.
  • Data lake integrations: Huawei supports only its own data lake technology, limiting clients' ability to expand and enrich detections and coverage.


• IBM - Leader
  

  Pros:

  • Extensive security business and presence: IBM has the global reach required to deliver its products, support and services in every major geographic region.
  • Integration across IBM security: IBM offers a wide range of optional, tightly integrated add-on solutions and service offerings to complement and support QRadar SIEM. Additional capabilities include network security, vulnerability assessment, ASM, customized threat intelligence reports, data protection, its compliance automation reporting tool (CART) and MDR services.
  • Native exposure context data: QRadar has native capabilities to enrich assets with exposure data, allowing users to easily react preventatively to threat detections. Add-on capabilities expand this to include continuous automated testing through Randori Recon.

  Cons:

  • Pricing complexity: Although IBM has made some adjustments on its licensing and pricing schemes, QRadar still has several different pricing options that may present a complex set of choices for potential and current customers.
  • Sales and customer support: Due to IBM's size and the number of products it offers, customers may experience challenges engaging and obtaining timely responses on bids. Organizations should confirm with the sales team how the relationship and process will support their requirements.
  • Prebuilt SOAR integrations and playbooks: Organizations that lack SOAR expertise will want to confirm that needed integrations and playbooks are available OOTB and plan accordingly.


• Logpoint - Niche Player
  

  Pros:

  • Simple licensing models: Logpoint's employee-based model allows for simplification of many of the planning and sizing variables, making their SIEM pricing predictable. A one-seat SOAR license is included.
  • Dashboard customization: Logpoint allows clients to set up a variety of roles and usages for the product. Organizations will find Logpoint's extensible UI supports custom monitoring.
  • Scalability and accessibility: Logpoint's SIEM solution provides ease of storage for security data with an above-average number of native analytics available OOTB that support the speed and ease of detection.

  Cons:

  • Geographical presence: Logpoint's customer base and sales exist largely in Europe. Its presence is limited in North America and APAC. Customers should ensure that the sales and support options will meet their needs in their local area; this includes local compliance requirements.
  • UEBA abilities: Logpoint does not include the ability to create customized UEBA models. Advanced users will not be able to create extended new user and entity behavior analytics for themselves.
  • Threat intelligence: Logpoint's lack of an internal threat intelligence feed requires the use of a third-party or open-source threat intelligence platform (TIP) for integration in detection content. Threat enrichment SOAR playbooks are a roadmap item.


• LogRhythm - Niche Player
  

  Pros:

  • Compliance reporting: LogRhythm's platforms have a higher-than-average number of supported compliance standards and reports for those clients needing to implement compliance and security reporting.
  • On-premises solution: LogRhythm's roadmaps show that it has a long-term commitment to improving the on-premises SIEM alongside LogRhythm Axon development.
  • Global coverage: LogRhythm has invested in a global sales force in every major geography, so the number of days needed to bring its solution online is well below the average among vendors in this research.

  Cons:

  • LogRhythm Axon solution: LogRhythm Axon is a separate product line from LogRhythm SIEM and Cloud SIEM, and their respective capabilities differ. Potential buyers should compare capabilities and roadmap when evaluating LogRhythm's products.
  • Cloud strategy: LogRhythm maintains two cloud-hosted product lines. With LogRhythm Axon being the newer, cloud-native solution, current and prospective users of LogRhythm Cloud should validate LogRhythm's long-term commitment to this offering.
  • Capabilities: LogRhythm SIEM does not support a chat facility, or importing rules using Sigma or Yara, which may be important to some users.


• Logz.io - Niche Player
  

  Pros:

  • Intelligent storage: Logz.io allows data to be moved between multiple storage tiers to optimize resources and minimize related costs. Amazon S3 is utilized for cold storage to further enable cost management.
  • Language support: Logz.io supports the highest number of languages among vendors in this research, enabling global SOCs to work in their native language.
  • Observability tooling: The Logz.io platform can integrate metrics and tracing telemetry. Combined sources of data simplify the data collection and costs into one provider.

  Cons:

  • Out-of-the-box detection and compliance: The number of correlations, analytics and reports available OOTB for standard use cases, compliance requirements and standards is lower than the average among vendors in this Magic Quadrant.
  • SOAR capabilities: Lack of any inbuilt SOAR features requires acquisition of a supported third-party SOAR, which will increase costs and complexity for architecture, integration and workflow for incidents.
  • Advanced analytics capabilities: Logz.io lacks advanced capabilities such as advanced analytics, supervised ML and deep learning analytics. These are required to build out extended detection and correlate extremely large sets of data and logs.


• ManageEngine - Niche Player
  

  Pros:

  • Expanded reporting engine: ManageEngine's reporting engine is comprehensive, supporting numerous compliance-framework-focused outputs and alerting based on compliance violations.
  • Global presence: ManageEngine has the global reach required to deliver its products, sales, support and services in every geographic region.
  • Native SOAR capabilities: ManageEngine for response and workflow automation is included with the base license.

  Cons:

  • Advanced SOAR capabilities: ManageEngine's native SOAR does not support features such as playbook testing and playbook sharing.
  • Compatibility with third-party data lakes: ManageEngine's product does not support recalling data from third-party external data sources, including external data lakes.
  • Community app store: ManageEngine lacks an app store where its customers can share workflows, custom detections and parsers.


• Microsoft - Leader
  

  Pros:

  • Highly integrated ecosystem: Microsoft Sentinel has native integration with broader Microsoft security offerings: CASB, identity, endpoint, network, operational technology (OT) security, and UEBA and SOAR tools. The onboarding process for supported data sources is simplified with the help of codeless connectors and data normalization capabilities built directly into the Microsoft platform.
  • Customizable solution: Microsoft Sentinel customers can build and customize ML-based threat detection models by leveraging native integration with Azure Synapse (a paid add-on), along with OOTB templates. The Microsoft Sentinel threat intelligence dashboard provides a fully customizable canvas for reporting on the health and performance of TI.
  • MITRE ATT&CK coverage: Microsoft Sentinel offers strong MITRE ATT&CK coverage built around the entire Microsoft security toolset. Strong coverage enables analysts to understand what the next steps of an attack may be.

  Cons:

  • Reliance on Azure capabilities: Sentinel runs within the Azure ecosystem and relies on other Azure services for various functionalities. The learning curve can be steep without familiarity with Azure workflows and UIs.
  • OOTB compliance reporting: Microsoft Sentinel has comparatively limited OOTB compliance reporting.
  • Deployment: Sentinel is available only as a SaaS product hosted in Microsoft Azure. Cloud self-hosted or on-premises options are unavailable.


• NetWitness - Niche Player
  

  Pros:

  • Vendor portfolio: NetWitness is a multicapability platform that will appeal to SOCs that want a single vendor for modern SOC instrumentation, including integrated SIEM, UEBA, SOAR, EDR and network threat analytics.
  • Global presence: NetWitness has the global reach required (via direct and partner channels) to deliver its products, support and services in every geographic region.
  • Simple deployments: NetWitness's number of days needed to bring its SIEM solution online is lower than average among vendors in this research, showing that the system can easily be taken from install to usable in a short time.

  Cons:

  • SaaS adoption: Fewer customers have deployed NetWitness's SaaS platform, compared with other vendors included in this research. Most customers opt for its on-premises version.
  • UEBA customization: When compared to other vendors in this Magic Quadrant, NetWitness has a limited number of customizations in UEBA, making it harder for customers to build custom use cases.
  • Out-of-the-box reporting features: Reporting for standard compliance requirements and standards is lower than average when compared to other vendors in this research.


• Odyssey - Niche Player
  

  Pros:

  • Third-party app marketplace: In 2022, Odyssey released a marketplace to provide an improved user experience for integrating detection content and other third-party security controls into its SIEM solution.
  • Extensive product ecosystem: Odyssey offers a number of integrated capabilities, including EDR, vulnerability assessment, UEBA, security orchestration, automation and response, and identity and access management.
  • Quantity of correlation rules: Odyssey offers a large number of correlation rules OOTB when compared to other SIEM vendors in this research. Organizations with a diverse and complex environment should factor this into their assessment.

  Cons:

  • Third-party SOAR integration: Odyssey's SIEM solution does not support bidirectional integration with third-party SOAR platforms; therefore, organizations with already-deployed SOAR technology must ensure Odyssey's native SOAR capability meets workflow automation requirements.
  • Europe-centric availability: The majority of Odyssey's salesforce is based in the EMEA region, with a very small percentage in North America and APAC. For clients with global requirements, lack of understanding of local market requirements and restrictions can lead to poor experience from a sales and support perspective.
  • Advanced customization and some common modern SIEM features: Odyssey has lower-than-average abilities in data science model/algorithm creation and API integration development features compared with its peers in this research. It may not support mature organizations with a dynamic set of threat detection, data manipulation and reporting requirements. In addition, it does not support federated searching.


• OpenText - Visionary
  

  Pros:

  • Threat intelligence platform capabilities: A basic TIP solution is included with ArcSight SIEM. It provides MISP open-source intelligence to all ArcSight buyers at no additional cost. Customers can upgrade to advanced threat intelligence, which provides premium threat intelligence feeds.
  • SOAR included with SIEM: ArcSight ESM includes SOAR capability at no additional charge for this feature. Users can leverage a graphical canvas to create workflows or leverage a code-based development interface for more complex playbook creation.
  • MITRE ATT&CK mapping: OpenText's platform offers a more extensive mapping of detection content to the MITRE ATT&CK framework. This supports understanding attack coverage, and provides guidance on available coverage content.

  Cons:

  • UEBA model creation learning curve: Predictive Model Markup Language (PMML) is used to create models, which can take time to master for those that have not used it before or are not from a data science background.
  • Compatibility with third-party data storage: ArcSight does not support searching data from third-party storage, although it does support dashboarding and reporting.
  • Implementation time: On average, OpenText has a greater number of professional service days used to implement the solution than most other vendors in this research. This indicates a high level of complexity to get the solution running.


• QAX - Niche Player
  

  Pros:

  • Cost-effective: QAX has a simple and flexible pricing model, and its average selling price was lower than most other vendors in this Magic Quadrant.
  • Managed detection and response service: MDR is available directly from QAX at an additional cost. This provides a single source for customers who want access to the SIEM product and need service support for detection and response for all of the QAX solutions.
  • User interface: QAX's interface can customize dashboards and visualization by using built-in options or an editor for extended flexibility.

  Cons:

  • APAC-centric: QAX predominantly serves customers in one region: APAC. From a sales and support perspective, lack of understanding of local market requirements and restrictions outside of APAC can lead to poor experience for customers with a global footprint.
  • Data lake integrations: QAX supports region-specific commercial data lake technologies only.
  • SaaS adoption: Compared to its peers in this research, fewer customers than average have deployed its SaaS platform, choosing the on-premises version instead. This may be due to local regional requirements.


• Rapid7 - Challenger
  

  Pros:

  • Managed detection and response service: MDR is available directly from Rapid7 at an additional cost. It represents a single source for customers who want access to the SIEM product and need service support for detection and response.
  • Small and midsize business: With a higher than average number of SMB clients compared to other vendors evaluated in this research, Rapid7 has a model that supports SMB security needs to get SIEM programs working.
  • Wide range of integrated capabilities: Rapid7 offers a core SIEM with many security capabilities, including InsightVM, which provides vulnerability management; and InsightIDR, which has EDR, UEBA and network detection and response (NDR) capabilities that are highly integrated for a single experience for SOC operators.

  Cons:

  • Compatibility with third-party data storage: Rapid7's SIEM product does not support recalling data from third-party storage. This may lead to added costs and increased regulatory needs.
  • Advanced customization capabilities: InsightIDR lacks more advanced capabilities, such as advanced analytics (e.g., supervised ML and custom deep-learning analytics).
  • SaaS only: InsightIDR is only available as a SaaS solution.


• Securonix - Leader
  

  Pros:

  • Third-party data lake access: Unified Defense SIEM is able to query and display live data from third-party systems such as data lakes (e.g., Snowflake and Databricks), enabling the platform to operate in a more decentralized fashion.
  • Leveraging digital risk protection data: Securonix partners with threat intelligence and digital risk protection service vendors to embed darknet and social media monitoring intelligence to feed into its TIP and Autonomous Threat Sweeper for enhanced alert enrichment and prioritization of threats.
  • Health and use-case effectiveness of SIEM: Securonix provides users insights via a dashboard into operational metrics, KPIs and benchmarks to help improve the effectiveness of the SIEM's configuration and threat detection content (such as identifying missing data sources, correlation rules and analytics modules for critical use cases).

  Cons:

  • FedRAMP certification: Although Snowflake, the back end of Securonix's log management capability, is FedRAMP-certified, Securonix is not.
  • License model: Securonix uses a consumption-based model that considers EPS instead of the now common ingest-based model. Users should validate the licensing model as part of their evaluation.
  • Deployment: Professional services are not required, but Securonix has a higher than average number of professional services days for deployment into cloud environments.


• Splunk - Leader
  

  Pros:

  • Overall observability: The Splunk platform can integrate security, IT, application and other data sources. This, coupled with its federated search and analytics capabilities across third-party data stores, is a strength for clients seeking to build highly enriched queries and alerts.
  • Extensive integration: Splunk's integration of SOAR enhances a wide range of common SIEM use cases. Clients wanting quick time to production automation for common SIEM operational functions will find Splunk's library of playbooks a strength.
  • User interface: Splunk's UI and dashboard provide significant customization. Clients requiring custom animations and visualization for specialized monitoring, such as OT or financial systems, will find the UI editor an overall strength.

  Cons:

  • Pricing: Splunk has a higher-than-average cost compared to other vendors evaluated in this research. With increasing demands to log everything, prospective clients should evaluate the costs versus security value of the data.
  • Complexity and expertise: With a higher-than-average number of days of professional services needed to implement Splunk, clients need to ensure that they have the needed staffing or outsourced providers to see value from the tool.
  • Regional sales support: The majority of Splunk's salesforce is based in North America. Sales support may be limited or delivered via value-added resellers outside of North America.


• Sumo Logic - Challenger
  

  Pros:

  • MITRE ATT&CK support: Users are able to track coverage based on out-of-the-box rules that enable users to understand coverage.
  • Model-building assistance: Sumo Logic has a feature called Insight Trainer that builds models via investigated insights to suggest tuning recommendations and severity adjustments on rules.
  • FedRAMP certification: Sumo Logic Cloud SIEM Enterprise is one of the few SIEM solutions in the market that is FedRAMP-certified as a Moderate Impact system.

  Cons:

  • Regional sales support: The majority of Sumo Logic's sales force is based in North America. Potential buyers should ensure the sales force understands regional requirements.
  • Searching across distributed data stores: Organizations requiring search capabilities across logs and other data distributed across multiple external and non-native data stores may need to confirm these are available from Sumo Logic.
  • OOTB compliance reports: Sumo Logic does not have the breadth of compliance reports and dashboards OOTB when compared to other vendors in this research.


• Venustech - Niche Player
  

  Pros:

  • Advanced analytics capabilities: Venustech's advanced capabilities, supervised ML and UEBA are able to support a more advanced security team.
  • Threat detection, investigation and response capability: Venustech offers a core SIEM with a multitude of security capabilities including EDR and NDR. All of these capabilities offer a single experience for SOC operators.
  • Simple SaaS license model: Licensing based on base price standard, premium, enterprise, or number of managed hosts ensures that security teams do not have any unexpected costs.

  Cons:

  • UI translation: Some advanced features have not been translated into English. Prospective clients should require an estimated release date on necessary features.
  • APAC-centric: Venustech predominantly serves customers in one region: APAC. From a sales and support perspective, lack of understanding of local market requirements and restrictions can lead to poor experience for prospective clients with presence outside of this region.
  • Large enterprise focus: The majority of Venustech clients are midsize and large enterprises.

Reference

• Gartner, Magic Quadrant for Security Information and Event Management, 8 May 2024, ID G00780705

View Market Definition
View Vendor Movements