SIEM platforms for enterprise buyers
Asked as “SIEM platform”, and as “security information and event management tool”, on behalf of an enterprise B2B company. 47 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing · first-choice share
30%
Contested · Splunk Enterprise Security 28%
30Microsoft Sentinel28Splunk Enterprise Security15Palo Alto Networks Cortex XSIAM28others
30% of first choices, contested.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
Show the three products at 0%, ordered by negative rate
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Google Security Operations is made by Google, whose model Gemini 3.5 Flash is in the set. On the four share prompts that model made it the first choice zero times of 4; the other eleven models three times of 44. Lab treatment is defined on the method page; the row is marked, not excluded.
Head to head
Microsoft Sentinel vs Rapid7 InsightIDRMicrosoft Sentinel vs WazuhMicrosoft Sentinel vs Elastic Security
Head-to-head pages are published for mid-market buyers, so these open on mid-market figures, not enterprise.All twenty-one head-to-head pages: the top seven products, each against each
Microsoft Sentinel vs ManageEngine Log360Microsoft Sentinel vs BlumiraMicrosoft Sentinel vs LogRhythmRapid7 InsightIDR vs WazuhRapid7 InsightIDR vs Elastic SecurityRapid7 InsightIDR vs ManageEngine Log360Rapid7 InsightIDR vs BlumiraRapid7 InsightIDR vs LogRhythmWazuh vs Elastic SecurityWazuh vs ManageEngine Log360Wazuh vs BlumiraWazuh vs LogRhythmElastic Security vs ManageEngine Log360Elastic Security vs BlumiraElastic Security vs LogRhythmManageEngine Log360 vs BlumiraManageEngine Log360 vs LogRhythmBlumira vs LogRhythm
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Microsoft Sentinel30%
Microsoft Sentinel30%02Splunk Enterprise Security28%
Splunk Enterprise Security28%03Palo Alto Networks Cortex XSIAM15%
Palo Alto Networks Cortex XSIAM15%04Rapid7 InsightIDR11%
Rapid7 InsightIDR11%05Google Security Operations6%
Google Security Operations6%06Exabeam2%
Exabeam2%07IBM QRadar2%
IBM QRadar2%08Securonix Unified Defense SIEM2%
Securonix Unified Defense SIEM2%09Elastic Security0%
Elastic Security0%10CrowdStrike Falcon Next-Gen SIEM0%
CrowdStrike Falcon Next-Gen SIEM0%11LogRhythm0%
LogRhythm0%What they warned about
Four of twelve models held their first choice under the paraphrase. GPT-5.4 mini, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Splunk Enterprise Security38%
22 of 58 labels negative · 12 of 12 models · 4 hard negative
“Avoid if you need predictability: Traditional per-GB pricing models (like older Splunk pricing...” MiniMax M2.5, budget prompt
IBM QRadar35%
15 of 43 labels negative · 10 of 12 models · 4 hard negative
“Critical warning: IBM sold QRadar's SaaS business to Palo Alto Networks... reached end-of-life in April 2026” Kimi K2, negative prompt
Microsoft Sentinel26%
14 of 54 labels negative · 10 of 12 models · 2 hard negative
“Avoid if you need predictability... Microsoft Sentinel pay-as-you-go) can become unpredictable” MiniMax M2.5, budget prompt
LogRhythm64%
9 of 14 labels negative · 9 of 12 models · 8 hard negative
“Platforms to Strongly Avoid... LogRhythm: Frequently called out in user forums as lacking community support, documentation, and scalability” Grok 4.20, negative prompt
What they cite
Twelve of the twelve models returned a source list in this edition: four return the pages they cited and eight the search results they consulted.
Sites the answers cite
62 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 911 links across 226 sites, every framing counted. Ranked by the number of answers carrying the site or page.
vendor site · UnderDefense52 answers · 67 citations · 11 models
vendor site · Palo Alto Networks33 answers · 36 citations · 11 models
21 answers · 26 citations · 8 models
18 answers · 28 citations · 7 models
vendor site · Exabeam18 answers · 24 citations · 8 models
vendor site · Splunk18 answers · 20 citations · 8 models
vendor site · ManageEngine17 answers · 19 citations · 8 models
17 answers · 17 citations · 7 models
16 answers · 16 citations · 8 models
vendor site · Rapid714 answers · 14 citations · 7 models
13 answers · 15 citations · 9 models
vendor site · Microsoft13 answers · 14 citations · 8 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
48 answers · 11 models
31 answers · 11 models
17 answers · 7 models
16 answers · 6 models
16 answers · 8 models
14 answers · 7 models
14 answers · 7 models
14 answers · 6 models
13 answers · 6 models
12 answers · 6 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best siem platform”, “siem platform”, “siem platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft parent site Microsoft Sentinel 30% | 30% | 371 | 2,240,000 | 403,136 | ||||
| Splunk splunk.com Splunk Enterprise Security 28% | 28% | 187 | 40,500 | 6,832 | 892,906 company | 120 | ||
| Palo Alto Networks parent site Palo Alto Networks Cortex XSIAM 15% | 15% | 86 | 40,500 | 1,088 | ||||
| Rapid7 parent site Rapid7 InsightIDR 11% | 11% | 88 | 14,800 | 798 | ||||
| Google Security Operations google.dev | 6% | 79 | 390 | 5 | 881,346 | 109 | ||
| Blumira blumira.com | 4% | 108 | 1,300 | 12 | 8,060 | 10 | ||
| Exabeam exabeam.com | 2% | 110 | 1,900 | 82 | 66,723 | 0 | 5 | |
| IBM parent site IBM QRadar 2% | 2% | 115 | 201,000 | 34,098 | ||||
| Securonix Unified Defense SIEM securonix.com | 2% | 48 | 20 | 0 | 3,571 | $13 | 9 | |
| Elastic elastic.co Elastic Security 0% | 0% | 124 | 74,000 | 34,672 | 208,306 company | 105 |
Google's top ten for the three searches hold 21 sites; 4 of them are among the sites the models cited here (exabeam.com, gartner.com, manageengine.com, underdefense.com). The first result for “best siem platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best SIEM platform for an enterprise B2B company?”Paraphrase“Which security information and event management tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade SIEM platforms and how do they differ?”Budget-constrained“What is the best SIEM platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a SIEM platform. What should we look at?”Negative“Which SIEM platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceagainst: Splunk Enterprise Securityno first choiceHeldagainst: OpenText ArcSight, Splunk Enterprise Securityno first choiceagainst: Splunk Enterprise SecurityBlumira, Rapid7 InsightIDRagainst: Microsoft Sentinelno first choiceagainst: IBM QRadar, Splunk Enterprise Security
Four alternatives
Elastic Security, IBM QRadar, Microsoft Sentinel, Sumo Logic Cloud SIEMGPT-5.4 miniMicrosoft Sentinel, Splunk Enterprise SecurityMicrosoft SentinelChangedMicrosoft Sentinel, Splunk Enterprise SecurityMicrosoft Sentinelagainst: IBM QRadar, Splunk Enterprise Securityno first choiceagainst: Devo, Elastic Security, Exabeam, Huawei, IBM QRadar, LogRhythm, Logpoint, Logz.io, ManageEngine Log360, Microsoft Sentinel, NetWitness, OpenText ArcSight, QAX, Rapid7 InsightIDR, Securonix Unified Defense SIEM, Sumo Logic Cloud SIEM, Venustech
One alternative
Google Security OperationsTwo alternatives
Elastic Security, Splunk Enterprise SecurityThree alternatives
Elastic Security, Google Security Operations, IBM QRadarOne alternative
Google Security OperationsGemini 3.5 FlashMicrosoft SentinelMicrosoft SentinelHeldagainst: Splunk Enterprise SecuritySplunk Enterprise SecurityPalo Alto Networks Cortex XSIAMagainst: Microsoft Sentinel, Splunk Enterprise Securityno first choiceagainst: Elastic Security, IBM QRadar, LogRhythm, Microsoft Sentinel, OpenText ArcSight, Splunk Enterprise Security
Four alternatives
CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, Palo Alto Networks Cortex XSIAM, Splunk Enterprise SecurityTwo alternatives
Google Security Operations, Palo Alto Networks Cortex XSIAMFive alternatives
Exabeam, Google Security Operations, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Securonix Unified Defense SIEMThree alternatives
Blumira, Exabeam, Securonix Unified Defense SIEMPerplexity SonarMicrosoft Sentinel, Splunk Enterprise SecurityPalo Alto Networks Cortex XSIAM, Splunk Enterprise SecurityChangedno first choiceRapid7 InsightIDRagainst: Microsoft Sentinel, Palo Alto Networks Cortex XSIAMno first choiceagainst: Elastic Security, IBM QRadar, LogRhythm, Splunk Enterprise Security
Three alternatives
Exabeam, IBM QRadar, Securonix Unified Defense SIEMOne alternative
Microsoft SentinelTwo alternatives
Google Security Operations, ManageEngine Log360Grok 4.20Microsoft Sentinel, Splunk Enterprise SecuritySplunk Enterprise SecurityChangedno first choiceRapid7 InsightIDRagainst: Elastic Security, IBM QRadar, ManageEngine Log360, Microsoft Sentinel, Splunk Enterprise Securityno first choiceagainst: Devo, FortiSIEM, Huawei HiSec Insight, IBM QRadar, LogRhythm, Microsoft Sentinel, Rapid7 InsightIDR, Securonix Unified Defense SIEM, Splunk Enterprise Security
Four alternatives
CrowdStrike Falcon LogScale, Elastic Security, Google Security Operations, IBM QRadarFour alternatives
CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Microsoft Sentinel, Palo Alto Networks Cortex XSIAMOne alternative
Palo Alto Networks Cortex XSIAMFive alternatives
Exabeam, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Rapid7 InsightIDR, Splunk Enterprise SecurityMistral SmallPalo Alto Networks Cortex XSIAM, Splunk Enterprise SecurityPalo Alto Networks Cortex XSIAMChangedSplunk Enterprise SecurityPalo Alto Networks Cortex XSIAM, Rapid7 InsightIDR, Securonix Unified Defense SIEMno first choiceagainst: LogRhythm, Microsoft Sentinel, Securonix Unified Defense SIEM, Splunk Enterprise Security
Two alternatives
CrowdStrike Falcon Next-Gen SIEM, Rapid7 InsightIDRThree alternatives
CrowdStrike Falcon, NetWitness, Splunk Enterprise SecurityFour alternatives
Exabeam, IBM QRadar, Microsoft Sentinel, Securonix Unified Defense SIEMDeepSeek V4 FlashMicrosoft SentinelSplunk Enterprise SecurityChangedno first choiceagainst: IBM QRadarGoogle Security Operationsagainst: Datadog Cloud SIEM, IBM QRadar, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Splunk Enterprise Securityno first choiceagainst: Elastic Security, Splunk Enterprise Securityagainst: FortiSIEM, IBM QRadar, LogRhythm, OpenText ArcSight, Securonix Unified Defense SIEM, Splunk Enterprise Security
Four alternatives
CrowdStrike Falcon Next-Gen SIEM, IBM QRadar, Palo Alto Networks Cortex XSIAM, Splunk Enterprise SecurityFour alternatives
Exabeam, IBM QRadar, Microsoft Sentinel, Securonix Unified Defense SIEMOne alternative
ExabeamLlama 4 MaverickPalo Alto Networks Cortex XSIAMSplunk Enterprise SecurityChangedno first choiceRapid7 InsightIDRno first choiceagainst: LogRhythm, Securonix Unified Defense SIEM, Splunk Enterprise Security
Three alternatives
CrowdStrike Falcon Next-Gen SIEM, Rapid7 InsightIDR, Splunk Enterprise SecurityQwen 3.7 FlashMicrosoft Sentinel, Splunk Enterprise SecurityMicrosoft SentinelChangedno first choicePalo Alto Networks Cortex XSIAMagainst: Google Security Operations, Splunk Enterprise Securityno first choiceagainst: Amazon GuardDuty, ELK Stack, Elasticsearch, IBM QRadar, Logpoint, ManageEngine Log360, Microsoft Defender for Cloud, OpenText ArcSight, SolarWinds Security Event Manager, Wazuh
Three alternatives
Exabeam, IBM QRadar, WazuhThree alternatives
Google Security Operations, IBM QRadar, Splunk Enterprise SecurityFour alternatives
IBM QRadar, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Splunk Enterprise SecurityTwo alternatives
IBM QRadar, Microsoft SentinelKimi K2Splunk Enterprise SecuritySplunk Enterprise SecurityHeldno first choiceGoogle Security Operationsagainst: Microsoft Sentinel, Splunk Enterprise SecurityMicrosoft Sentinelagainst: IBM QRadar, LogRhythm, Microsoft Sentinel, Securonix Unified Defense SIEM, Splunk Enterprise Security
Four alternatives
Exabeam, IBM QRadar, Microsoft Sentinel, Palo Alto Networks Cortex XSIAMTwo alternatives
IBM QRadar, Microsoft SentinelOne alternative
Rapid7 InsightIDRTwo alternatives
IBM QRadar, Splunk Enterprise SecurityGLM 4.7 FlashXSplunk Enterprise SecuritySplunk Enterprise SecurityHeldagainst: IBM QRadarMicrosoft Sentinel, Splunk Enterprise SecurityBlumiraagainst: IBM QRadar, Microsoft Sentinel, Splunk Enterprise Securityno first choiceagainst: IBM QRadar Cloud, QRadar SOAR, and QRadar Log Insights
Four alternatives
Exabeam, IBM QRadar, ManageEngine Log360, Microsoft SentinelTwo alternatives
Microsoft Sentinel, Palo Alto Networks Cortex XSIAMEight alternatives
CrowdStrike Falcon LogScale, Elastic Security, Exabeam, Google Security Operations, IBM QRadar, Palo Alto Networks Cortex XSIAM, Securonix Unified Defense SIEM, Sumo Logic Cloud SIEMTwo alternatives
Google Security Operations, Rapid7 InsightIDRMiniMax M2.5Microsoft SentinelIBM QRadar, Microsoft SentinelChangedno first choiceagainst: IBM QRadarExabeam, Google Security Operationsagainst: Microsoft Sentinel, Splunk Enterprise SecurityMicrosoft Sentinelagainst: LogRhythm, Microsoft Sentinel, Securonix Unified Defense SIEM, Splunk Enterprise Security
Five alternatives
Elastic Security, Exabeam, IBM QRadar, Securonix Unified Defense SIEM, Splunk Enterprise SecurityTwo alternatives
Securonix Unified Defense SIEM, Splunk Enterprise SecurityOne alternative
BlumiraTwo alternatives
Elastic Security, Splunk Enterprise SecurityBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Seventy-two rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 09:09 | no | 0 | 4 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 08:49 | yes | 3 | 7 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 08:59 | yes | 13 | 24 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-09-17 08:21 | yes | 19 | 6 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 09:09 | yes | 31 | 15 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 08:45 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 08:21 | yes | 10 | 13 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 08:50 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 08:47 | no | 0 | 40 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 08:47 | yes | 10 | 29 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 08:52 | yes | 22 | 53 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 09:07 | no | 0 | 12 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 08:42 | no | 0 | 5 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 08:52 | yes | 3 | 6 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 09:11 | yes | 14 | 27 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-09-17 08:18 | yes | 20 | 7 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 08:20 | yes | 19 | 9 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 08:27 | yes | 5 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 08:54 | yes | 14 | 13 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 08:51 | yes | 5 | 3 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 08:37 | no | 0 | 37 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 08:55 | yes | 15 | 27 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 08:33 | yes | 20 | 87 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 08:53 | yes | 5 | 31 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 08:55 | yes | 9 | 9 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 08:28 | yes | 3 | 8 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 08:38 | yes | 18 | 27 s |
| Comparative | Perplexity Sonar | sonar | 2026-09-17 08:43 | yes | 20 | 10 s |
| Comparative | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 08:40 | yes | 31 | 18 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 08:48 | yes | 13 | 12 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 08:52 | yes | 17 | 21 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 08:18 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 09:01 | yes | 9 | 31 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 08:17 | yes | 13 | 50 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 08:42 | yes | 17 | 250 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 08:50 | yes | 25 | 58 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 08:27 | yes | 16 | 9 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 09:11 | yes | 4 | 9 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 09:09 | yes | 27 | 34 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-09-17 09:02 | yes | 18 | 6 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 08:35 | yes | 24 | 14 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 09:03 | yes | 10 | 7 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 08:49 | yes | 17 | 18 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 08:54 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 08:44 | yes | 5 | 50 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 08:55 | yes | 10 | 29 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 08:40 | yes | 27 | 281 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 09:13 | yes | 9 | 33 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 08:37 | yes | 18 | 13 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 09:02 | no | 0 | 10 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 08:28 | no | 0 | 16 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-09-17 09:06 | yes | 20 | 8 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 08:31 | yes | 19 | 11 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 09:03 | no | 0 | 10 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 08:43 | yes | 27 | 30 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 08:49 | yes | 5 | 4 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 08:42 | no | 0 | 44 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 08:39 | yes | 15 | 28 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 08:36 | yes | 23 | 223 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 09:12 | yes | 19 | 34 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 08:23 | yes | 18 | 10 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 08:35 | yes | 5 | 7 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 08:53 | yes | 12 | 25 s |
| Negative framing | Perplexity Sonar | sonar | 2026-09-17 08:41 | yes | 20 | 7 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.1-fast-non-reasoning via vertex (asked for grok-4.20-non-reasoning; the API answered as this version) | 2026-09-17 08:47 | yes | 23 | 13 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 08:54 | yes | 5 | 6 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 08:36 | yes | 28 | 46 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 08:45 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 08:44 | no | 0 | 62 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 08:52 | yes | 18 | 47 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 08:18 | yes | 29 | 122 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 08:37 | yes | 12 | 34 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
ArcSight read as OpenText ArcSight
Cortex XSIAM read as Palo Alto Networks Cortex XSIAM
Datadog read as Datadog Cloud SIEM
Elastic read as Elastic Security
Exabeam Fusion read as Exabeam
Fortinet read as FortiSIEM
Google Chronicle read as Google Security Operations
Google Chronicle (Security Operations) read as Google Security Operations
Google SecOps read as Google Security Operations
ManageEngine read as ManageEngine Log360
OpenText read as OpenText ArcSight
Rapid7 read as Rapid7 InsightIDR
Securonix read as Securonix Unified Defense SIEM
SolarWinds read as SolarWinds Security Event Manager
Splunk read as Splunk Enterprise Security
Splunk Cloud Platform read as Splunk Enterprise Security
Splunk Enterprise / Splunk Cloud (Cisco) read as Splunk Enterprise Security
Sumo Logic read as Sumo Logic Cloud SIEM
Unresolved, counted raw
Bloo
Huawei HiSec Insight
IBM QRadar Cloud, QRadar SOAR, and QRadar Log Insights
IBM\u2019s QRadar SaaS
QAX
Venustech
Discontinued, still offered
No shut-down product was recommended here.