SIEM platforms
Asked as “SIEM platform”, and as “security information and event management tool”, on behalf of a mid-market B2B company. 52 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
48%
Clear leader
48Microsoft Sentinel15Wazuh08ManageEngine Log36029others
48% of first choices, clear leader.
Since October 2026▲+10Since October 2026: 38% → 48%, +10 points. Inside the 11-point floor: within noise.Microsoft Sentinel held the lead, +10 points on 38%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Blumira25%Contested▼−9Since October 2026: 34% → 25%, −9 points. Inside the 11-point floor: within noise.Standing →Mid-market
Microsoft Sentinel48%Clear leader▲+10Since October 2026: 38% → 48%, +10 points. Inside the 11-point floor: within noise.This pageEnterpriseMicrosoft Sentinel47%Clear leader▲+6Since October 2026: 41% → 47%, +6 points. Inside the 11-point floor: within noise.Standing →
Blumira25%Contested▼−9Since October 2026: 34% → 25%, −9 points. Inside the 11-point floor: within noise.Standing →Mid-marketMicrosoft Sentinel48%Clear leader▲+10Since October 2026: 38% → 48%, +10 points. Inside the 11-point floor: within noise.This pageEnterpriseMicrosoft Sentinel47%Clear leader▲+6Since October 2026: 41% → 47%, +6 points. Inside the 11-point floor: within noise.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Microsoft Sentinel48%9%69endorsed leader▲+10Since October 2026: 38% → 48%, +10 points. Inside the 11-point floor: within noise.38% → 48%
Microsoft Sentinel48%9%69endorsed leader▲+10Since October 2026: 38% → 48%, +10 points. Inside the 11-point floor: within noise.38% → 48%02
Wazuh15%12%24accepted challenger▼−6Since October 2026: 21% → 15%, −6 points. Inside the 11-point floor: within noise.21% → 15%
Wazuh15%12%24accepted challenger▼−6Since October 2026: 21% → 15%, −6 points. Inside the 11-point floor: within noise.21% → 15%03
Rapid7 InsightIDR8%4%28accepted challenger▼−9Since October 2026: 17% → 8%, −9 points. Inside the 11-point floor: within noise.17% → 8%
Rapid7 InsightIDR8%4%28accepted challenger▼−9Since October 2026: 17% → 8%, −9 points. Inside the 11-point floor: within noise.17% → 8%04
ManageEngine Log3608%7%28accepted challenger▲+4Since October 2026: 4% → 8%, +4 points. Inside the 11-point floor: within noise.4% → 8%
ManageEngine Log3608%7%28accepted challenger▲+4Since October 2026: 4% → 8%, +4 points. Inside the 11-point floor: within noise.4% → 8%05
Exabeam6%11%27accepted challenger▲+6Since October 2026: 0% → 6%, +6 points. Inside the 11-point floor: within noise.0% → 6%
Exabeam6%11%27accepted challenger▲+6Since October 2026: 0% → 6%, +6 points. Inside the 11-point floor: within noise.0% → 6%06
Elastic Security4%3%39accepted challenger=heldSince October 2026: 4% → 4%, ±0 points. Inside the 11-point floor: within noise.4% → 4%
Elastic Security4%3%39accepted challenger=heldSince October 2026: 4% → 4%, ±0 points. Inside the 11-point floor: within noise.4% → 4%07
LogRhythm4%47%17criticized challenger▲+2Since October 2026: 2% → 4%, +2 points. Inside the 11-point floor: within noise.2% → 4%
LogRhythm4%47%17criticized challenger▲+2Since October 2026: 2% → 4%, +2 points. Inside the 11-point floor: within noise.2% → 4%08
Sumo Logic Cloud SIEM2%5%21accepted challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%
Sumo Logic Cloud SIEM2%5%21accepted challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%09
Splunk Enterprise Security2%50%56criticized challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
Splunk Enterprise Security2%50%56criticized challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%10
IBM QRadar2%53%34criticized challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
IBM QRadar2%53%34criticized challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%Show the five products at 0%, ordered by negative rate
15
SolarWinds Security Event Manager0%58%12criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%
SolarWinds Security Event Manager0%58%12criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%14
Securonix Unified Defense SIEM0%44%18criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Securonix Unified Defense SIEM0%44%18criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%11
CrowdStrike Falcon Next-Gen SIEM0%12%17accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
CrowdStrike Falcon Next-Gen SIEM0%12%17accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%13
Datadog Cloud SIEM0%8%13accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Datadog Cloud SIEM0%8%13accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%12
Google Security Operations Lab in the set0%0%14accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Google Security Operations Lab in the set0%0%14accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Google Security Operations is made by Google, whose model Gemini 3.5 Flash is in the set. On the four share prompts that model made it the first choice zero times of 4; the other thirteen models zero times of 52. Lab treatment is defined on the method page; the row is marked, not excluded.
Head to head
All twenty-eight head-to-head pages: the top eight products, each against each
Microsoft Sentinel vs ExabeamMicrosoft Sentinel vs Elastic SecurityMicrosoft Sentinel vs LogRhythmMicrosoft Sentinel vs Sumo Logic Cloud SIEMWazuh vs Rapid7 InsightIDRWazuh vs ManageEngine Log360Wazuh vs ExabeamWazuh vs Elastic SecurityWazuh vs LogRhythmWazuh vs Sumo Logic Cloud SIEMRapid7 InsightIDR vs ManageEngine Log360Rapid7 InsightIDR vs ExabeamRapid7 InsightIDR vs Elastic SecurityRapid7 InsightIDR vs LogRhythmRapid7 InsightIDR vs Sumo Logic Cloud SIEMManageEngine Log360 vs ExabeamManageEngine Log360 vs Elastic SecurityManageEngine Log360 vs LogRhythmManageEngine Log360 vs Sumo Logic Cloud SIEMExabeam vs Elastic SecurityExabeam vs LogRhythmExabeam vs Sumo Logic Cloud SIEMElastic Security vs LogRhythmElastic Security vs Sumo Logic Cloud SIEMLogRhythm vs Sumo Logic Cloud SIEM
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
010203040506070809101112131415Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative60%
Key
01Microsoft Sentinel48%
Microsoft Sentinel48%02Wazuh15%
Wazuh15%03Rapid7 InsightIDR8%
Rapid7 InsightIDR8%04ManageEngine Log3608%
ManageEngine Log3608%05Exabeam6%
Exabeam6%06Elastic Security4%
Elastic Security4%07LogRhythm4%
LogRhythm4%08Sumo Logic Cloud SIEM2%
Sumo Logic Cloud SIEM2%09Splunk Enterprise Security2%
Splunk Enterprise Security2%10IBM QRadar2%
IBM QRadar2%11CrowdStrike Falcon Next-Gen SIEM0%
CrowdStrike Falcon Next-Gen SIEM0%12Google Security Operations0%
Google Security Operations0%13Datadog Cloud SIEM0%
Datadog Cloud SIEM0%14Securonix Unified Defense SIEM0%
Securonix Unified Defense SIEM0%15SolarWinds Security Event Manager0%
SolarWinds Security Event Manager0%What they warned about
Six of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash, Mistral Small, DeepSeek V4 Flash, Qwen 3.7 Flash, GLM 4.7 FlashX, MiniMax M2.5 and GPT-6 Luna changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
IBM QRadar53%
18 of 34 labels negative · 12 of 14 models · 5 hard negative
“don't treat QRadar SaaS as a fresh-buy option: Palo Alto Networks announced end-of-life dates for the acquired QRadar SaaS products” GPT-6 Luna, comparative prompt
Splunk Enterprise Security50%
28 of 56 labels negative · 10 of 14 models · 4 hard negative
“What to Avoid - Splunk Enterprise Security: While powerful, it's typically prohibitively expensive for mid-market” Kimi K2, direct prompt
Securonix Unified Defense SIEM44%
8 of 18 labels negative · 7 of 14 models · 6 hard negative
“Securonix - This platform has been described as "absolute trash" and has been criticized for its poor performance and lack of delivery.” Llama 4 Maverick, negative prompt
SolarWinds Security Event Manager58%
7 of 12 labels negative · 7 of 14 models · 6 hard negative
“SolarWinds - This platform has been involved in a major breach and has been criticized for its poor IT security practices.” Llama 4 Maverick, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
73 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 743 links across 183 sites, every framing counted. Ranked by the number of answers carrying the site or page. 22 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Exabeam25 answers · 33 citations · 12 models
25 answers · 25 citations · 10 models
19 answers · 22 citations · 9 models
vendor site · ManageEngine18 answers · 23 citations · 10 models
18 answers · 18 citations · 7 models
vendor site · Microsoft17 answers · 30 citations · 7 models
16 answers · 34 citations · 9 models
vendor site · SenseOn16 answers · 16 citations · 11 models
vendor site · UnderDefense12 answers · 13 citations · 6 models
vendor site · Huntress12 answers · 12 citations · 8 models
vendor site · Palo Alto Networks11 answers · 11 citations · 7 models
vendor site · G210 answers · 14 citations · 6 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
25 answers · 10 models
15 answers · 7 models
15 answers · 10 models
14 answers · 8 models
11 answers · 7 models
10 answers · 5 models
10 answers · 8 models
10 answers · 4 models
9 answers · 7 models
9 answers · 5 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best siem platform”, “siem platform”, “siem platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Microsoft parent site Microsoft Sentinel 48% | 48% | 371 | 2,240,000 | 403,136 | ||||
| Wazuh wazuh.com | 15% | 118 | 9,900 | 446 | 7,214 | 3 | ||
| Exabeam exabeam.com Exabeam 6%, LogRhythm 4% | 10% | 110 | 1,900 | 82 | 66,723 | 0 | 5 | |
| Rapid7 parent site Rapid7 InsightIDR 8% | 8% | 88 | 14,800 | 798 | ||||
| ManageEngine parent site ManageEngine Log360 8% | 8% | 139 | 8,100 | 675 | ||||
| Elastic elastic.co Elastic Security 4%, Elastic Stack 0% | 4% | 154 | 74,000 | 34,672 | 208,306 company | 105 | ||
| Sumo Logic Cloud SIEM sumologic.com | 2% | 46 | 40 | 1 | 82,749 | $4,123 | 55 | |
| Security Onion securityonion.net | 2% | 41 | 3,600 | 209 | 2,016 | |||
| Splunk splunk.com Splunk Enterprise Security 2% | 2% | 187 | 40,500 | 6,832 | 892,906 company | 120 | ||
| IBM parent site IBM QRadar 2% | 2% | 115 | 201,000 | 34,098 |
Google's top ten for the three searches hold 21 sites; 4 of them are among the sites the models cited here (exabeam.com, manageengine.com, reddit.com, underdefense.com). The first result for “best siem platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best SIEM platform for a mid-market B2B company?”Paraphrase“Which security information and event management tool would you recommend to a mid-sized B2B company?”Comparative“What are the top SIEM platforms and how do they differ?”Budget-constrained“What is the best SIEM platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a SIEM platform. What should we look at?”Negative“Which SIEM platforms should I avoid or be cautious about?”
Claude Haiku 4.5Rapid7 InsightIDRno first choiceChangedno first choiceSumo Logic Cloud SIEMno first choicenothing named
Three alternatives
FortiSIEM, ManageEngine Log360, Microsoft SentinelThree alternatives
Blumira, Microsoft Sentinel, SolarWinds Security Event ManagerGPT-5.4 miniMicrosoft SentinelMicrosoft SentinelHeldno first choiceMicrosoft Sentinel, Wazuhno first choicenothing named
Two alternatives
Google Security Operations, Splunk Enterprise SecurityThree alternatives
Elastic Security, IBM QRadar, Splunk Enterprise SecurityOne alternative
Elastic SecurityGemini 3.5 FlashRapid7 InsightIDRagainst: IBM QRadar, Splunk Enterprise SecurityMicrosoft SentinelChangedno first choiceWazuhno first choiceagainst: Amazon CloudWatch, IBM QRadar, Microsoft Sentinel, OpenText ArcSight, Self-Managed ELK Stack, Splunk Enterprise Security, Wazuh
Eight alternatives
Arctic Wolf, Blumira, CrowdStrike Falcon Next-Gen SIEM, Expel, Huntress Managed SIEM, Microsoft Sentinel, Red Canary, Sumo Logic Cloud SIEMFive alternatives
Blumira, Datadog Cloud SIEM, Rapid7 InsightIDR, Sumo Logic Cloud SIEM, WazuhSeven alternatives
Elastic Security, Exabeam, Google Security Operations, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Securonix Unified Defense SIEM, Splunk Enterprise SecurityFour alternatives
Blumira, Huntress Managed SIEM, Microsoft Sentinel, Security OnionTen alternatives
Arctic Wolf, Blumira, Datadog Cloud SIEM, Expel, Logz.io, Microsoft Sentinel, Panther, Rapid7 InsightIDR, Red Canary, Sumo Logic Cloud SIEMPerplexity SonarMicrosoft Sentinelagainst: Splunk Enterprise SecurityMicrosoft SentinelHeldMicrosoft SentinelManageEngine Log360no first choiceagainst: CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Exabeam, IBM QRadar, LogRhythm, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Rapid7 InsightIDR, Securonix Unified Defense SIEM, SentinelOne, Splunk Enterprise Security, Sumo Logic Cloud SIEM, Wazuh
Four alternatives
CrowdStrike Falcon Next-Gen SIEM, Elastic Security, ManageEngine Log360, Rapid7 InsightIDRFive alternatives
Google Security Operations, Logmanager, ManageEngine Log360, SolarWinds Security Event Manager, Splunk Enterprise SecurityNine alternatives
CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Exabeam, ManageEngine Log360, Palo Alto Networks Cortex XSIAM, Rapid7 InsightIDR, Securonix Unified Defense, Splunk Enterprise Security, WazuhFour alternatives
Microsoft Sentinel, Rapid7 InsightIDR, Sumo Logic Cloud SIEM, WazuhGrok 4.20Microsoft Sentinelagainst: IBM QRadar, NetWitness, Splunk Enterprise Security, TrellixMicrosoft SentinelHeldagainst: CrowdStrike Falcon Next-Gen SIEM, Exabeam, Splunk Enterprise Securityno first choiceManageEngine Log360against: AT&T USM, CrowdStrike Falcon, Splunk Enterprise SecurityMicrosoft Sentinelagainst: IBM QRadar, Splunk Enterprise Securityagainst: Devo, Microsoft Sentinel, Nitro, Securonix Unified Defense SIEM, SolarWinds Security Event Manager, Splunk Enterprise Security
Three alternatives
Exabeam, ManageEngine Log360, Rapid7 InsightIDRTwo alternatives
ManageEngine Log360, Rapid7 InsightIDRThree alternatives
Elastic Security, SolarWinds Security Event Manager, WazuhFour alternatives
Elastic Security, Exabeam, Securonix Unified Defense SIEM, Sumo Logic Cloud SIEMMistral SmallExabeam, IBM QRadaragainst: Splunk Enterprise SecurityExabeamChangedagainst: Splunk Enterprise Securityno first choiceElastic Security, Microsoft Sentinelno first choiceagainst: Devo, IBM QRadar, LogRhythm, Micro Focus ArcSight, Securonix Unified Defense SIEM, SolarWinds Security Event Manager, Splunk Enterprise Security
Two alternatives
AlienVault USM Anywhere, SolarWinds Security Event ManagerThree alternatives
FortiSIEM, Microsoft Sentinel, Rapid7 InsightIDRThree alternatives
Blumira, Graylog Security, WazuhDeepSeek V4 FlashExabeam, LogRhythm, Microsoft Sentinelagainst: Splunk Enterprise SecurityMicrosoft SentinelChangedagainst: Splunk Enterprise SecuritySplunk Enterprise Securityagainst: LogRhythmWazuhagainst: Splunk Enterprise SecurityMicrosoft Sentinelagainst: IBM QRadar, LogRhythm, ManageEngine Log360, Splunk Enterprise Securityagainst: Devo, Graylog Security, IBM QRadar, LogRhythm, ManageEngine Log360, Microsoft Sentinel, OpenText ArcSight, Securonix Unified Defense SIEM, SolarWinds Security Event Manager, Splunk Enterprise Security
Two alternatives
ManageEngine Log360, Rapid7 InsightIDRTwo alternatives
ManageEngine Log360, Rapid7 InsightIDRFive alternatives
Elastic Security, Exabeam, IBM QRadar, Microsoft Sentinel, Securonix Unified Defense SIEMTwo alternatives
Elastic Security, Microsoft SentinelThree alternatives
CrowdStrike Falcon Next-Gen SIEM, Exabeam, Rapid7 InsightIDRLlama 4 MaverickMicrosoft SentinelMicrosoft SentinelHeldSecuronix Unified Defense SIEMManageEngine Log360no first choiceagainst: IBM QRadar, Securonix Unified Defense SIEM, SolarWinds Security Event Manager
Three alternatives
EventSentry, ManageEngine Log360, Sumo Logic Cloud SIEMFour alternatives
ManageEngine Log360, Rapid7 InsightIDR, Stellar Cyber Next-Gen SIEM, WazuhTwo alternatives
Huntress Managed SIEM, Microsoft SentinelTwo alternatives
Microsoft Sentinel, WazuhQwen 3.7 FlashManageEngine Log360against: Splunk Enterprise SecurityMicrosoft SentinelChangedagainst: IBM QRadar, OpenText ArcSightSplunk Enterprise SecurityElastic Security, Wazuhno first choiceagainst: Devo, IBM QRadar, LogRhythm, OpenText ArcSight, Securonix Unified Defense SIEM, SolarWinds Security Event Manager, Splunk Enterprise Security
Two alternatives
LogRhythm, Microsoft SentinelThree alternatives
Datadog Cloud SIEM, Trend Vision One, WazuhFive alternatives
Elastic Security, Exabeam, IBM QRadar, Microsoft Sentinel, WazuhThree alternatives
ManageEngine Log360, Microsoft Sentinel, Sumo Logic Cloud SIEMKimi K2Microsoft Sentinelagainst: IBM QRadar, NetWitness, Splunk Enterprise SecurityMicrosoft SentinelHeldagainst: Splunk Enterprise Securityno first choiceWazuhno first choiceagainst: Exabeam & LogRhythm, IBM QRadar, Microsoft Sentinel, Splunk Enterprise Security
Three alternatives
Datadog Cloud SIEM, Elastic Security, Rapid7 InsightIDRTwo alternatives
Rapid7 InsightIDR, SentinelOne Singularity AI SIEMFour alternatives
AlienVault OSSIM, Graylog Security, Microsoft Sentinel, Security OnionGLM 4.7 FlashXMicrosoft Sentinel, Splunk Enterprise SecurityLogRhythmChangedMicrosoft Sentinel, Splunk Enterprise SecurityWazuhagainst: SolarWinds Security Event Managerno first choiceagainst: IBM QRadar, early Splunk Enterprise, legacy ArcSight
Five alternatives
Cybriant, Exabeam, Huntress Managed SIEM, ManageEngine Log360, Sumo Logic Cloud SIEMTwo alternatives
Microsoft Sentinel, Splunk Enterprise SecurityThree alternatives
Exabeam, IBM QRadar, Securonix Unified Defense SIEMFour alternatives
Blumira, Elastic Security, Logz.io, Prelude SIEMMiniMax M2.5Microsoft Sentinel, Rapid7 InsightIDRMicrosoft SentinelChangedagainst: Splunk Enterprise Securityno first choiceSecurity Onion, Wazuhno first choiceagainst: Datadog Cloud SIEM, Elasticsearch, Graylog Security, HP ArcSight, IBM QRadar, RSA ECAT, SolarWinds Security Event Manager, Splunk Enterprise Security, Wazuh
Three alternatives
CrowdStrike Falcon Next-Gen SIEM, ManageEngine Log360, Splunk Enterprise SecurityThree alternatives
Elastic Security, Exabeam, ManageEngine Log360Two alternatives
ManageEngine EventLog Analyzer, Microsoft SentinelGPT-6 LunaRapid7 InsightIDRMicrosoft SentinelChangedno first choiceagainst: IBM QRadarWazuhno first choiceagainst: Exabeam, IBM QRadar SaaS, LogRhythm, Microsoft Sentinel, Splunk Enterprise Security
Two alternatives
Elastic Security, Microsoft SentinelOne alternative
Google Security OperationsSeven alternatives
CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Google Security Operations, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Rapid7 InsightIDR, Splunk Enterprise SecurityOne alternative
Microsoft SentinelMuse Glimmer 30BMicrosoft Sentinelagainst: IBM QRadar, Securonix Unified Defense SIEM, Splunk Enterprise SecurityMicrosoft SentinelHeldMicrosoft Sentinel, Splunk Enterprise SecurityMicrosoft Sentinelagainst: AlienVault USM, HP ArchSight, IBM QRadar, LogRhythm, SolarWinds LEMno first choiceagainst: Devo, IBM Security QRadar Suite - Cloud-Native SIEM SaaS, Securonix Unified Defense SIEM, Splunk Enterprise Security, Symantec
Four alternatives
Elastic Security, ManageEngine Log360, Rapid7 InsightIDR, Sumo Logic Cloud SIEMThree alternatives
ManageEngine Log360, Rapid7 InsightIDR, Splunk Enterprise SecuritySix alternatives
CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Exabeam, IBM QRadar, Rapid7 InsightIDR, Sumo Logic Cloud SIEMFour alternatives
Security Onion, Sumo Logic Cloud SIEM, UTMStack Community, WazuhBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 14:57 | yes | 10 | 9 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 10:08 | yes | 4 | 6 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 11:53 | yes | 10 | 25 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 17:32 | yes | 10 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:51 | yes | 5 | 11 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 13:07 | yes | 5 | 5 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 16:06 | yes | 23 | 61 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 19:19 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 10:33 | yes | 15 | 72 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 08:51 | yes | 14 | 26 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 17:47 | yes | 14 | 37 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 15:30 | yes | 5 | 18 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 18:36 | yes | 3 | 12 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 18:11 | yes | 14 | 20 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 09:25 | no | 0 | 5 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 10:14 | yes | 5 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 11:28 | no | 0 | 15 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 15:10 | yes | 10 | 4 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:27 | yes | 5 | 9 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 10:49 | yes | 5 | 6 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 18:34 | yes | 24 | 31 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 13:46 | yes | 5 | 3 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 14:47 | no | 0 | 39 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 11:54 | yes | 20 | 38 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:37 | yes | 15 | 23 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 09:58 | yes | 14 | 48 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 10:56 | yes | 2 | 12 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 13:08 | yes | 13 | 18 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 10:44 | yes | 16 | 11 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 12:14 | yes | 7 | 9 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 19:24 | yes | 5 | 21 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 16:27 | yes | 10 | 7 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 14:30 | yes | 5 | 14 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 10:11 | yes | 5 | 5 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 16:31 | yes | 25 | 57 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:55 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 09:34 | no | 0 | 36 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 16:56 | yes | 5 | 14 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:21 | yes | 22 | 62 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 10:33 | yes | 5 | 45 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:56 | yes | 8 | 29 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 17:47 | yes | 14 | 28 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 18:30 | yes | 9 | 6 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 18:24 | yes | 3 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 17:33 | yes | 8 | 20 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 19:23 | yes | 10 | 3 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:07 | yes | 5 | 10 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 09:08 | yes | 5 | 5 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 18:37 | yes | 24 | 37 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 18:07 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 11:36 | yes | 10 | 30 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 09:14 | yes | 15 | 25 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 19:14 | yes | 24 | 37 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 11:01 | yes | 5 | 42 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 12:16 | yes | 2 | 8 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 15:01 | yes | 15 | 20 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 11:05 | no | 0 | 5 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 11:08 | no | 0 | 8 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 13:41 | no | 0 | 20 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 10:43 | yes | 10 | 6 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:34 | yes | 5 | 14 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 09:42 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 11:19 | yes | 23 | 30 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:13 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 12:33 | yes | 5 | 31 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 18:02 | yes | 10 | 79 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 10:53 | yes | 14 | 81 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 16:42 | yes | 15 | 35 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 17:43 | yes | 2 | 16 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 15:28 | no | 0 | 1 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 11:25 | no | 0 | 4 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 11:08 | yes | 5 | 6 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 12:40 | yes | 9 | 22 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 12:07 | yes | 10 | 4 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:03 | yes | 5 | 11 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 16:58 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 16:59 | yes | 24 | 38 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 16:46 | yes | 7 | 4 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 19:25 | yes | 5 | 29 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 12:10 | yes | 9 | 60 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 13:14 | yes | 24 | 35 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 17:47 | no | 0 | 31 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 18:02 | yes | 4 | 19 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 10:05 | yes | 20 | 28 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
ArcSight read as OpenText ArcSight
ArcSight (by OpenText) read as OpenText ArcSight
Cortex XSIAM read as Palo Alto Networks Cortex XSIAM
Datadog read as Datadog Cloud SIEM
Datadog Security read as Datadog Cloud SIEM
Elastic read as Elastic Security
Exabeam Fusion read as Exabeam
Fortinet read as FortiSIEM
Google read as Google Security Operations
Google Chronicle read as Google Security Operations
Google Cloud read as Google Security Operations
Google SecOps read as Google Security Operations
Graylog read as Graylog Security
Graylog Open read as Graylog Security
Huntress read as Huntress Managed SIEM
IBM read as IBM QRadar
ManageEngine read as ManageEngine Log360
Rapid7 read as Rapid7 InsightIDR
Securonix read as Securonix Unified Defense SIEM
SolarWinds read as SolarWinds Security Event Manager
Splunk read as Splunk Enterprise Security
Splunk Cloud read as Splunk Enterprise Security
Stellar Cyber read as Stellar Cyber Next-Gen SIEM
Sumo Logic read as Sumo Logic Cloud SIEM
Unresolved, counted raw
AT&T USM
AlienVault
AlienVault USM Anywhere
Cybriant
HP ArchSight
IBM Security QRadar Suite - Cloud-Native SIEM SaaS
Nitro (post-McAfee acquisition)
Palo Alto's Cortex XSIAM
RSA ECAT (Envision)
Securonix Unified Defense
SolarWinds LEM
UTMStack Community
UTMStack Managed
early Splunk Enterprise
legacy ArcSight
Discontinued, still offered
No shut-down product was recommended here.