SIEM Vendors - Have you used or evaluated?

Security & GRC

Exabeam8%

Alienvault25%

Sophos22%

LinkAmerica4%

Splunk29%

Other10%

1104 PARTICIPANTS
6.2k viewscircle icon4 Upvotescircle icon31 Comments
Sort by:
Co-Founder in Services (non-Government)2 years ago

Why not have multi-selection? :) I worked with most and others. besides " LinkAmerica"

Director of IT in Education2 years ago

We have Microfocus SIEM

CIO in Finance (non-banking)3 years ago

I have experience using Elastic's SIEM,   it integrated well with the operational work we already doing in Elastic

Director of IT in Software4 years ago

Very happy with Azure Sentinel. Cost-effective, easy to implement and deploy, month-to-month subscription. Best of all, Microsoft is investing a lot in the security space so it will only get better with time.

Lightbulb on1
Director (CIO) of Technology & Privacy (CPO) in Healthcare and Biotech4 years ago

We've been pretty happy with Rapid7/InsightDR

Lightbulb on1

Content you might like

Is it common practice at your organization for the general counsel’s office to notify authorities when a security incident occurs?

Yes70%

No26%

Other (comment below)3%

View Results

Which tech conference do you intend to attend in person next year or have already participated in this year, and what motivated your choice?

Read More Comments

Has anyone drafted an SOW for a cloud-based SIEM with setup, migration, and maintenance? I’m working on a FedRAMP-authorized SIEM SOW, migrating from on-prem Splunk, covering data, searches, alerts, dashboards, and models.  Scope includes Environment Setup:  Cloud provisioning, configuration, testing. Connectors/Parsers: Custom data source integration. Content Development: Rules, use cases, threat feeds. Performance Tuning: Query/index optimization. Runbooks: Operational procedures. Also required: 24x7 support, maintenance, lifecycle and application management, role-based training, and documentation.  Must comply with NIST SP 800-53, CJIS, and FedRAMP Moderate+. Goal: Secure, scalable SIEM for rapid deployment. I may be missing elements, so suggestions are welcome. Please share redacted SOWs or tips if possible.

What do you believe is the main cause for insider attacks?

Lack of employee training/awareness37%

Insufficient data protection strategies or solutions38%

Data increasingly leaving the network perimeter via mobile devices and web access15%

Increasing number of devices with access to sensitive data8%

Other

View Results

How are you currently managing SIEM costs? Have you found effective ways to actually reduce storage costs for your SIEM?

Read More Comments