# SIEM platforms: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "SIEM platform" and as "security information and event management tool", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/siem-platforms/2026-11

**Standing:** Microsoft Sentinel leads with 48% of first choices; verdict clear leader. 52 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Microsoft Sentinel](https://www.gane.ai/index/it/vendors/microsoft-sentinel/index.md) | 48% | 9% | 69 |
| 2 | [Wazuh](https://www.gane.ai/index/it/vendors/wazuh/index.md) | 15% | 12% | 24 |
| 3 | [Rapid7 InsightIDR](https://www.gane.ai/index/it/vendors/rapid7-insightidr/index.md) | 8% | 4% | 28 |
| 4 | [ManageEngine Log360](https://www.gane.ai/index/it/vendors/manageengine-log360/index.md) | 8% | 7% | 28 |
| 5 | [Exabeam](https://www.gane.ai/index/it/vendors/exabeam/index.md) | 6% | 11% | 27 |
| 6 | [Elastic Security](https://www.gane.ai/index/it/vendors/elastic-security/index.md) | 4% | 3% | 39 |
| 7 | [LogRhythm](https://www.gane.ai/index/it/vendors/logrhythm/index.md) | 4% | 47% | 17 |
| 8 | [Sumo Logic Cloud SIEM](https://www.gane.ai/index/it/vendors/sumo-logic-cloud-siem/index.md) | 2% | 5% | 21 |
| 10 | [Splunk Enterprise Security](https://www.gane.ai/index/it/vendors/splunk-enterprise-security/index.md) | 2% | 50% | 56 |
| 11 | [IBM QRadar](https://www.gane.ai/index/it/vendors/ibm-qradar/index.md) | 2% | 53% | 34 |
| 12 | [CrowdStrike Falcon Next-Gen SIEM](https://www.gane.ai/index/it/vendors/crowdstrike-falcon-next-gen-siem/index.md) | 0% | 12% | 17 |
| 13 | [Google Security Operations](https://www.gane.ai/index/it/vendors/google-security-operations/index.md) | 0% | 0% | 14 |

Rank is by share of first choices among all 75 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Rapid7 InsightIDR; alternatives FortiSIEM, ManageEngine Log360, Microsoft Sentinel
- GPT-5.4 mini: Microsoft Sentinel; alternatives Google Security Operations, Splunk Enterprise Security
- Gemini 3.5 Flash: Rapid7 InsightIDR; alternatives Arctic Wolf, Blumira, CrowdStrike Falcon Next-Gen SIEM, Expel
- Perplexity Sonar: Microsoft Sentinel; alternatives CrowdStrike Falcon Next-Gen SIEM, Elastic Security, ManageEngine Log360, Rapid7 InsightIDR
- Grok 4.20: Microsoft Sentinel; alternatives Exabeam, ManageEngine Log360, Rapid7 InsightIDR
- Mistral Small: Exabeam, IBM QRadar; alternatives AlienVault USM Anywhere, SolarWinds Security Event Manager
- DeepSeek V4 Flash: Exabeam, LogRhythm, Microsoft Sentinel; alternatives ManageEngine Log360, Rapid7 InsightIDR
- Llama 4 Maverick: Microsoft Sentinel; alternatives EventSentry, ManageEngine Log360, Sumo Logic Cloud SIEM
- Qwen 3.7 Flash: ManageEngine Log360; alternatives LogRhythm, Microsoft Sentinel
- Kimi K2: Microsoft Sentinel; alternatives Datadog Cloud SIEM, Elastic Security, Rapid7 InsightIDR
- GLM 4.7 FlashX: Microsoft Sentinel, Splunk Enterprise Security; alternatives Cybriant, Exabeam, Huntress Managed SIEM, ManageEngine Log360
- MiniMax M2.5: Microsoft Sentinel, Rapid7 InsightIDR; alternatives CrowdStrike Falcon Next-Gen SIEM, ManageEngine Log360, Splunk Enterprise Security
- GPT-6 Luna: Rapid7 InsightIDR; alternatives Elastic Security, Microsoft Sentinel
- Muse Glimmer 30B: Microsoft Sentinel; alternatives Elastic Security, ManageEngine Log360, Rapid7 InsightIDR, Sumo Logic Cloud SIEM

## Sources the answers cite

73 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- exabeam.com: 25 answers, 33 citations
- techrepublic.com: 25 answers, 25 citations
- securityboulevard.com: 19 answers, 22 citations
- manageengine.com: 18 answers, 23 citations
- aimultiple.com: 18 answers, 18 citations
- microsoft.com: 17 answers, 30 citations
- reddit.com: 16 answers, 34 citations
- senseon.io: 16 answers, 16 citations

Pages named in the most answers:

- https://techrepublic.com/article/siem-tools (25 answers)
- https://aimultiple.com/siem-tools (15 answers)
- https://senseon.io/blog/5-best-siem-tools (15 answers)
- https://manageengine.com/log-management/top-siem-tools.html (14 answers)
- https://exabeam.com/explainers/siem-tools/siem-buyers-guide (11 answers)
- https://axis-intelligence.com/best-siem-tools-tested-and-ranked (10 answers)
- https://huntress.com/siem-guide/siem-tools (10 answers)
- https://start.paloaltonetworks.com/rs/531-OCS-018/images/PAN%20Reprint%20Omdia%20Universe%20Next-Generation%20SIEM%20Solutions%20(NG-SIEM),%202024%E2%80%9325.pdf?version=0 (10 answers)
- https://getapp.com/security-software/siem/org/mid-size-business (9 answers)
- https://microsoft.com/en/security/pricing/microsoft-sentinel (9 answers)

## Warned against

- IBM QRadar: 18 of 34 labels negative. "don't treat QRadar SaaS as a fresh-buy option: Palo Alto Networks announced end-of-life dates for the acquired QRadar SaaS products" (GPT-6 Luna, comparative prompt)
- Splunk Enterprise Security: 28 of 56 labels negative. "What to Avoid - Splunk Enterprise Security: While powerful, it's typically prohibitively expensive for mid-market" (Kimi K2, direct prompt)
- Securonix Unified Defense SIEM: 8 of 18 labels negative. "Securonix - This platform has been described as "absolute trash" and has been criticized for its poor performance and lack of delivery." (Llama 4 Maverick, negative prompt)
- SolarWinds Security Event Manager: 7 of 12 labels negative. "SolarWinds - This platform has been involved in a major breach and has been criticized for its poor IT security practices." (Llama 4 Maverick, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Microsoft Sentinel at 48%.

- Microsoft Sentinel: 38% to 48%, +10. Inside the floor by 1 point · rank 1 of 75, unchanged.
- Rapid7 InsightIDR: 17% to 8%, −9. Inside the floor by 2 points · rank 3 of 75, unchanged.
- Wazuh: 21% to 15%, −6. Inside the floor by 5 points · rank 2 of 75, unchanged.
- Exabeam: 0% to 6%, +6. Inside the floor by 5 points · rank 12 → 5 of 75.
- ManageEngine Log360: 4% to 8%, +4. Inside the floor by 7 points · rank 5 → 4 of 75.
- LogRhythm: 2% to 4%, +2. Inside the floor by 9 points · rank 11 → 7 of 75.
- Sumo Logic Cloud SIEM: 4% to 2%, −2. Inside the floor by 9 points · rank 6 → 8 of 75.
- Splunk Enterprise Security: 0% to 2%, +2. Inside the floor by 9 points · rank 59 → 10 of 75.
- IBM QRadar: 0% to 2%, +2. Inside the floor by 9 points · rank 58 → 11 of 75.
- SolarWinds Security Event Manager: 2% to 0%, −2. Inside the floor by 9 points · rank 9 → 75 of 75.
- Elastic Security: 4% to 4%, ±0. Inside the floor by 11 points · rank 4 → 6 of 75.
- CrowdStrike Falcon Next-Gen SIEM: 0% to 0%, ±0. Inside the floor by 11 points · rank 14 → 12 of 75.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.