# SIEM platforms: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "SIEM platform" and as "security information and event management tool", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/siem-platforms/2026-10

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/siem-platforms/index.md

**Standing:** Microsoft Sentinel leads with 38% of first choices; verdict contested. 52 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Microsoft Sentinel](https://www.gane.ai/index/it/vendors/microsoft-sentinel/index.md) | 38% | 13% | 62 |
| 2 | [Wazuh](https://www.gane.ai/index/it/vendors/wazuh/index.md) | 21% | 24% | 21 |
| 3 | [Rapid7 InsightIDR](https://www.gane.ai/index/it/vendors/rapid7-insightidr/index.md) | 17% | 6% | 34 |
| 4 | [Elastic Security](https://www.gane.ai/index/it/vendors/elastic-security/index.md) | 4% | 8% | 38 |
| 5 | [ManageEngine Log360](https://www.gane.ai/index/it/vendors/manageengine-log360/index.md) | 4% | 0% | 16 |
| 6 | [Sumo Logic Cloud SIEM](https://www.gane.ai/index/it/vendors/sumo-logic-cloud-siem/index.md) | 4% | 6% | 16 |
| 11 | [LogRhythm](https://www.gane.ai/index/it/vendors/logrhythm/index.md) | 2% | 42% | 24 |
| 12 | [Exabeam](https://www.gane.ai/index/it/vendors/exabeam/index.md) | 0% | 4% | 24 |
| 13 | [Google Security Operations](https://www.gane.ai/index/it/vendors/google-security-operations/index.md) | 0% | 0% | 17 |
| 14 | [CrowdStrike Falcon Next-Gen SIEM](https://www.gane.ai/index/it/vendors/crowdstrike-falcon-next-gen-siem/index.md) | 0% | 8% | 13 |
| 15 | [Palo Alto Networks Cortex XSIAM](https://www.gane.ai/index/it/vendors/palo-alto-networks-cortex-xsiam/index.md) | 0% | 8% | 12 |
| 16 | [Graylog Security](https://www.gane.ai/index/it/vendors/graylog-security/index.md) | 0% | 23% | 13 |

Rank is by share of first choices among all 60 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Rapid7 InsightIDR; alternatives LogRhythm, ManageEngine Log360, Microsoft Sentinel
- GPT-5.4 mini: Microsoft Sentinel; alternatives Google Security Operations, Splunk Enterprise Security
- Gemini 3.5 Flash: Blumira; alternatives Huntress Managed SIEM, Microsoft Sentinel, Rapid7 InsightIDR
- Perplexity Sonar: Rapid7 InsightIDR; alternatives LogRhythm, ManageEngine Log360, Stellar Cyber Next-Gen SIEM
- Grok 4.20: Microsoft Sentinel; alternatives LogRhythm NextGen, Rapid7 InsightIDR
- Mistral Small: Microsoft Sentinel; alternatives Exabeam, LogRhythm, Sumo Logic Cloud SIEM
- DeepSeek V4 Flash: Microsoft Sentinel, Rapid7 InsightIDR; alternatives CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Google Security Operations, Stellar Cyber Next-Gen SIEM
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: LogRhythm; alternatives ManageEngine Log360, Microsoft Sentinel, Rapid7 InsightIDR, Sumo Logic Cloud SIEM
- Kimi K2: Microsoft Sentinel; alternatives LogRhythm, Sumo Logic Cloud SIEM
- GLM 4.7 FlashX: Microsoft Sentinel; alternatives Elastic Security, FortiSIEM, ManageEngine Log360, Rapid7 InsightIDR
- MiniMax M2.5: Microsoft Sentinel; alternatives Exabeam, LogRhythm
- GPT-6 Luna: Microsoft Sentinel; alternatives Google Security Operations, Rapid7 InsightIDR
- Muse Glimmer 30B: Rapid7 InsightIDR, Sumo Logic Cloud SIEM; alternatives Elastic Security, ManageEngine Log360, Securonix Unified Defense SIEM

## Sources the answers cite

76 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- exabeam.com: 34 answers, 47 citations
- underdefense.com: 34 answers, 47 citations
- paloaltonetworks.com: 31 answers, 34 citations
- manageengine.com: 26 answers, 29 citations
- xoomar.com: 19 answers, 28 citations
- expertinsights.com: 19 answers, 20 citations
- kaseya.com: 18 answers, 18 citations
- sentinelone.com: 17 answers, 30 citations

Pages named in the most answers:

- https://underdefense.com/blog/siem-solutions-comparison (30 answers)
- https://paloaltonetworks.com/cyberpedia/siem-tools-comparison (28 answers)
- https://manageengine.com/log-management/top-siem-tools.html (20 answers)
- https://xoomar.com/blog/roundup/best-siem-tools-enterprises (19 answers)
- https://expertinsights.com/security-operations/the-top-siem-solutions (18 answers)
- https://exabeam.com/explainers/siem-tools/siem-buyers-guide (18 answers)
- https://kaseya.com/blog/best-siem-tools (18 answers)
- https://subrosacyber.com/blog/best-siem-reddit (16 answers)
- https://comparitech.com/net-admin/best-next-gen-siem (14 answers)
- https://dnsstuff.com/siem-tools (14 answers)

## Warned against

- Splunk Enterprise Security: 27 of 55 labels negative. "A Note on Avoiding: While Splunk is the industry leader, it is often the wrong choice for mid-sized companies due to licensing complexity." (Qwen 3.7 Flash, paraphrase prompt)
- IBM QRadar: 14 of 31 labels negative. "The *specific* platforms most flagged for poor execution are Securonix, ArcSight (for new builds), and QRadar (due to cost/complexity)." (DeepSeek V4 Flash, negative prompt)
- LogRhythm: 10 of 24 labels negative. "Another platform that users advise staying away from, citing concerns about both performance and usability." (Mistral Small, negative prompt)
- Securonix Unified Defense SIEM: 7 of 15 labels negative. "Frequently called out as one of the worst in user forums... Delivery and reliability issues make it a "deal killer" for many." (Grok 4.20, negative prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Microsoft Sentinel at 39%.

- Rapid7 InsightIDR: 22% to 16%, −6. Inside the floor by 5 points · rank 2 → 3 of 54.
- Microsoft Sentinel: 41% to 39%, −2. Inside the floor by 9 points · rank 1 of 54, unchanged.
- Wazuh: 18% to 20%, +2. Inside the floor by 9 points · rank 3 → 2 of 54.
- Sumo Logic Cloud SIEM: 0% to 2%, +2. Inside the floor by 9 points · rank 9 → 7 of 54.
- Elastic Security: 6% to 5%, −1. Inside the floor by 10 points · rank 4 of 54, unchanged.
- ManageEngine Log360: 4% to 5%, +1. Inside the floor by 10 points · rank 5 of 54, unchanged.
- Blumira: 4% to 5%, +1. Inside the floor by 10 points · rank 6 of 54, unchanged.
- LogRhythm: 2% to 2%, ±0. Inside the floor by 11 points · rank 8 → 11 of 54.
- Exabeam: 0% to 0%, ±0. Inside the floor by 11 points · rank 13 → 12 of 54.
- Google Security Operations: 0% to 0%, ±0. Inside the floor by 11 points · rank 10 → 13 of 54.
- CrowdStrike Falcon Next-Gen SIEM: 0% to 0%, ±0. Inside the floor by 11 points · rank 12 → 14 of 54.
- Palo Alto Networks Cortex XSIAM: 0% to 0%, ±0. Inside the floor by 11 points · rank 11 → 15 of 54.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.