Gane Index
All indexesEvery index and its categoriesGTMMarketing, sales, customer and revenue operations softwareITSecurity, IT operations, cloud, developer and data softwareHRHR, payroll, recruiting, performance and learning softwareFinanceAccounting, planning, spend, billing and treasury software
Claim your listing
November 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index › IT › Security operations › SIEM › Small business · November 2026 Edition

SIEM platforms for small business buyers

Asked as “SIEM platform”, and as “security information and event management tool”, on behalf of a small B2B company. 53 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
25%
Blumira
Contested · ManageEngine Log360 23%
25Blumira23ManageEngine Log36021Wazuh32others

25% of first choices, contested.

Since October 2026▼−9Since October 2026: 34% → 25%, −9 points. Inside the 11-point floor: within noise.Blumira held the lead, −9 points on 34%, inside the 11-point floor.
ShowinginAll 136 categories in the November 2026 Edition →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessBlumira25%Contested▼−9Since October 2026: 34% → 25%, −9 points. Inside the 11-point floor: within noise.This pageMid-marketMicrosoft Sentinel48%Clear leader▲+10Since October 2026: 38% → 48%, +10 points. Inside the 11-point floor: within noise.Standing →EnterpriseMicrosoft Sentinel47%Clear leader▲+6Since October 2026: 41% → 47%, +6 points. Inside the 11-point floor: within noise.Standing →

The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Blumira25%0%38accepted challenger▼−9Since October 2026: 34% → 25%, −9 points. Inside the 11-point floor: within noise.34% → 25%
02ManageEngine Log36023%0%32accepted challenger▲+9Since October 2026: 14% → 23%, +9 points. Inside the 11-point floor: within noise.14% → 23%
03Wazuh21%22%46accepted challenger▲+11Since October 2026: 10% → 21%, +11 points. Inside the 11-point floor: within noise.10% → 21%
04Microsoft Sentinel8%8%71accepted challenger▼−14Since October 2026: 22% → 8%, −14 points. Past the 11-point floor: movement.22% → 8%
05Huntress Managed SIEM8%0%20accepted challenger▲+3Since October 2026: 5% → 8%, +3 points. Inside the 11-point floor: within noise.5% → 8%
06Sumo Logic Cloud SIEM6%25%16criticized challenger▲+3Since October 2026: 3% → 6%, +3 points. Inside the 11-point floor: within noise.3% → 6%
07Elastic Security4%35%37criticized challenger▲+1Since October 2026: 3% → 4%, +1 point. Inside the 11-point floor: within noise.3% → 4%
08Rapid7 InsightIDR2%0%13accepted challenger▼−1Since October 2026: 3% → 2%, −1 point. Inside the 11-point floor: within noise.3% → 2%
09Logmanager2%0%14accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
Show the five products at 0%, ordered by negative rate
14Splunk Enterprise Security0%85%47criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
13IBM QRadar0%76%25criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
12SolarWinds Security Event Manager0%44%16criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
11Datadog Cloud SIEM0%25%16criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
10Graylog Security0%19%16accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%

The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
Microsoft Sentinel vs WazuhMicrosoft Sentinel vs Rapid7 InsightIDRMicrosoft Sentinel vs ManageEngine Log360
Head-to-head pages are published for mid-market buyers, so these open on mid-market figures, not small business.
All twenty-eight head-to-head pages: the top eight products, each against each
Microsoft Sentinel vs ExabeamMicrosoft Sentinel vs Elastic SecurityMicrosoft Sentinel vs LogRhythmMicrosoft Sentinel vs Sumo Logic Cloud SIEMWazuh vs Rapid7 InsightIDRWazuh vs ManageEngine Log360Wazuh vs ExabeamWazuh vs Elastic SecurityWazuh vs LogRhythmWazuh vs Sumo Logic Cloud SIEMRapid7 InsightIDR vs ManageEngine Log360Rapid7 InsightIDR vs ExabeamRapid7 InsightIDR vs Elastic SecurityRapid7 InsightIDR vs LogRhythmRapid7 InsightIDR vs Sumo Logic Cloud SIEMManageEngine Log360 vs ExabeamManageEngine Log360 vs Elastic SecurityManageEngine Log360 vs LogRhythmManageEngine Log360 vs Sumo Logic Cloud SIEMExabeam vs Elastic SecurityExabeam vs LogRhythmExabeam vs Sumo Logic Cloud SIEMElastic Security vs LogRhythmElastic Security vs Sumo Logic Cloud SIEMLogRhythm vs Sumo Logic Cloud SIEM

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
G10
11
12
13
14
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Blumira25%
02ManageEngine Log36023%
03Wazuh21%
04Microsoft Sentinel8%
05Huntress Managed SIEM8%
06Sumo Logic Cloud SIEM6%
07Elastic Security4%
08Rapid7 InsightIDR2%
09Logmanager2%
10Graylog Security0%
11Datadog Cloud SIEM0%
12SolarWinds Security Event Manager0%
13IBM QRadar0%
14Splunk Enterprise Security0%

What they warned about

Five of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash, Perplexity Sonar, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, MiniMax M2.5 and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Splunk Enterprise Security
85%
40 of 47 labels negative · 13 of 14 models · 19 hard negative
“Splunk is notorious for its high cost (especially indexed data ingestion) and complexity... expensive "white elephant."” Qwen 3.7 Flash, negative prompt
IBM QRadar
76%
19 of 25 labels negative · 11 of 14 models · 14 hard negative
“It is resource-intensive, difficult to configure, and significantly overpriced for companies with minimal logging needs” Qwen 3.7 Flash, negative prompt
Wazuh
22%
10 of 46 labels negative · 8 of 14 models
“they are not "free" operationally. They require Linux, deployment, tuning, upgrades, storage, backup, and alert-triage expertise” Perplexity Sonar, negative prompt
Securonix Unified Defense SIEM
88%
7 of 8 labels negative · 7 of 14 models · 7 hard negative
“Verdict: Avoid entirely unless you have a large, dedicated security engineering team and no other options.” DeepSeek V4 Flash, negative prompt

What they cite

Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.

Sites the answers cite

71 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 729 links across 155 sites, every framing counted. Ranked by the number of answers carrying the site or page. 22 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.

utmstack.com
vendor site · UTMStack34 answers · 35 citations · 10 models
softwareadvice.com
33 answers · 35 citations · 9 models
techrepublic.com
29 answers · 29 citations · 9 models
capterra.com
27 answers · 34 citations · 11 models
reddit.com
26 answers · 53 citations · 10 models
microsoft.com
vendor site · Microsoft16 answers · 27 citations · 7 models
siemcostcalculator.com
15 answers · 19 citations · 7 models
blumira.com
vendor site · Blumira14 answers · 30 citations · 5 models
g2.com
vendor site · G214 answers · 19 citations · 9 models
logmanager.com
vendor site · Logmanager14 answers · 14 citations · 8 models
securityboulevard.com
13 answers · 17 citations · 8 models
senseon.io
vendor site · SenseOn13 answers · 13 citations · 9 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

softwareadvice.com/siem/small-business
31 answers · 9 models
techrepublic.com/article/siem-tools
29 answers · 9 models
utmstack.com/siem-for-small-business
27 answers · 9 models
capterra.com/siem-software/s/small-businesses
24 answers · 11 models
logmanager.com/blog/siem-for-small-businesses
13 answers · 8 models
reddit.com/r/cybersecurity/comments/1b80zza/best_siem_solution_for_small_co…
13 answers · 8 models
senseon.io/blog/5-best-siem-tools
13 answers · 9 models
gane.ai/index/it/security/siem-platforms/smb
12 answers · 6 models
siemcostcalculator.com/siem-cost-by-size
11 answers · 6 models
spotsaas.com/list/security-information-and-event-management--siem--software…
11 answers · 7 models

Search against answers

Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best siem platform”, “siem platform”, “siem platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
Company and productsShareOwn site citedName searches, GoogleAI search demand, est.Organic visitsPaid search a month, est.Google ads, last 30 days
Blumira blumira.com25%1081,300128,06010
ManageEngine parent site
ManageEngine Log360 23%		23%1398,100675
Wazuh wazuh.com21%1189,9004467,2143
Microsoft parent site
Microsoft Sentinel 8%		8%3712,240,000403,136
Huntress huntress.com
Huntress Managed SIEM 8%		8%2433,1004,338352,368 company$15,522120
Sumo Logic Cloud SIEM sumologic.com6%4640182,749$4,12355
Elastic elastic.co
Elastic Security 4%		4%12474,00034,672208,306 company105
Rapid7 parent site
Rapid7 InsightIDR 2%		2%8814,800798
Logmanager logmanager.com2%33
AlienVault OSSIM alienvault.com2%511,662

Google's top ten for the three searches hold 21 sites; 1 of them are among the sites the models cited here (reddit.com). The first result for “best siem platform” is gartner.com.

How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHide
ModelDirect“What is the best SIEM platform for a small B2B company?”Paraphrase“Which security information and event management tool would you recommend to a small business that sells to other businesses?”Comparative“What are the top SIEM platforms for a small team and how do they differ?”Budget-constrained“What is the best SIEM platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a SIEM platform. What should we look at?”Negative“Which SIEM platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5Blumira
Four alternativesElastic Security, Microsoft Sentinel, Rapid7 InsightIDR, Wazuh
WazuhChanged
Three alternativesGraylog Security, Microsoft Sentinel, Splunk Enterprise Security
against: Elastic StackBlumira
Four alternativesGraylog Security, Hunters AI-Driven SIEM, Rapid7 InsightIDR, Wazuh
Wazuh
Four alternativesElastic Security, Graylog Security, Microsoft Sentinel, Splunk Enterprise Security
no first choiceagainst: ELK Stack, Graylog Security, OpenSearch, Splunk Enterprise Security, Wazuh
GPT-5.4 miniMicrosoft Sentinel
One alternativeElastic Security
against: Splunk Enterprise SecurityMicrosoft SentinelHeld
Two alternativesElastic Security, Wazuh
against: Splunk Enterprise SecurityMicrosoft Sentinel
Two alternativesElastic Security, IBM QRadar
against: Google Security Operations, Splunk Enterprise SecurityWazuh
One alternativeBlumira
against: Elastic Security Serverless, Microsoft Sentinelno first choiceagainst: Google Security Operations, IBM QRadar, LogRhythm SIEM, Palo Alto Networks Cortex XSIAM, Splunk Enterprise Security
Gemini 3.5 FlashBlumira
Four alternativesDatadog Cloud SIEM, Microsoft Sentinel, Rapid7 InsightIDR, Wazuh
Huntress Managed SIEMChanged
Four alternativesBlumira, Datadog Cloud SIEM, Microsoft Sentinel, Wazuh
against: Splunk Enterprise SecurityBlumira
Four alternativesDatadog Cloud SIEM, Microsoft Sentinel, Rapid7 InsightIDR, Wazuh
against: IBM QRadar, Splunk Enterprise SecurityBlumira, Wazuh
Two alternativesHuntress Managed SIEM, Microsoft Sentinel
Blumira
Five alternativesArctic Wolf, Blackpoint Cyber, Huntress Managed SIEM, Microsoft Sentinel, Red Canary
against: Datadog Cloud SIEM, IBM QRadar, Microsoft Sentinel, OpenText ArcSight, Raw ELK Stack, Security Onion, Splunk Enterprise Security, Sumo Logic Cloud SIEM, Wazuh
Perplexity SonarRapid7 InsightIDR
Two alternativesHuntress Managed SIEM, Microsoft Sentinel
against: Google Security Operations, Palo Alto Networks Cortex XSIAM, Splunk Enterprise SecurityManageEngine Log360Changed
Four alternativesEventSentry, Huntress Managed SIEM, Logmanager, Microsoft Sentinel
against: IBM QRadar, Splunk Enterprise SecurityHuntress Managed SIEM, Rapid7 InsightIDR
Three alternativesElastic Security, Microsoft Sentinel, Wazuh
against: Splunk Enterprise SecurityBlumira
Three alternativesHuntress Managed SIEM, Microsoft Sentinel, Rapid7 InsightIDR
against: Wazuhno first choiceagainst: CrowdStrike Falcon Next-Gen SIEM, Datadog Cloud SIEM, Devo, Elastic Security, Exabeam, Google Security Operations, Graylog Security, IBM QRadar, Microsoft Sentinel, Securonix Unified Defense SIEM, Splunk Enterprise Security, Sumo Logic Cloud SIEM, Wazuh
Grok 4.20ManageEngine Log360
Three alternativesMicrosoft Sentinel, SentinelOne, UTMStack
against: AT&T Cybersecurity, AlienVault USM, Splunk Cloud or Splunk Enterprise SecurityManageEngine Log360Held
Three alternativesDatadog Cloud SIEM, Microsoft Sentinel, UTMStack
Microsoft Sentinel
Four alternativesCrowdStrike Falcon Next-Gen SIEM, Elastic Security, Huntress Managed SIEM, ManageEngine Log360
against: Datadog Cloud SIEM, IBM QRadar, LogRhythm, NetWitness, Palo Alto Networks Cortex XSIAM, Splunk Enterprise SecurityWazuh
Two alternativesManageEngine Log360, Microsoft Sentinel
against: CrowdStrike Falcon, IBM QRadar, OSSIM, Splunk Enterprise SecurityManageEngine Log360
Six alternativesAlienVault OSSIM, CrowdStrike Falcon, Datadog Cloud SIEM, Huntress Managed SIEM, Microsoft Sentinel, SolarWinds Security Event Manager
against: ELK Stack, Exabeam, LogRhythm, Splunk Enterprise Security, Wazuhagainst: Elastic Security, IBM QRadar, LogRhythm, OpenText ArcSight, SolarWinds Security Event Manager, Splunk Enterprise Security
Mistral SmallBlumira, Logmanager
Three alternativesManageEngine Log360, SolarWinds Security Event Manager, UTMStack
Microsoft Sentinel, Sumo Logic Cloud SIEMChanged
Two alternativesElastic Security, Logmanager
ManageEngine Log360
Three alternativesExabeam, Graylog Security, Microsoft Sentinel
against: Splunk Enterprise SecurityElastic Security, Sumo Logic Cloud SIEM
Two alternativesLogmanager, Microsoft Sentinel
no first choiceagainst: Devo, IBM QRadar, LogRhythm, Securonix Unified Defense SIEM, SolarWinds Security Event Manager
DeepSeek V4 FlashBlumira
Three alternativesManageEngine Log360, Microsoft Sentinel, Wazuh
ManageEngine Log360Changed
Three alternativesBlumira, Microsoft Sentinel, Wazuh
against: Splunk Enterprise SecurityBlumira, Microsoft Sentinel
Three alternativesManageEngine Log360, Sumo Logic Cloud SIEM, Wazuh
against: Elastic Security, Splunk Enterprise SecurityWazuh
Three alternativesBlumira, ManageEngine Log360, SolarWinds Security Event Manager
against: Elastic SecurityBlumira, Huntress Managed SIEM
Three alternativesElastic Security, Microsoft Sentinel, Wazuh
against: IBM QRadar, Palo Alto Networks Cortex XSIAM, Splunk Enterprise Security, Sumo Logic Cloud SIEMagainst: Devo, Elastic Security, IBM QRadar, LogRhythm, Securonix Unified Defense SIEM, Splunk Enterprise Security
Llama 4 Maverickno first choiceManageEngine Log360Changed
Four alternativesBlumira, Elastic Security, Heimdal, Logmanager
no first choiceSumo Logic Cloud SIEM
Two alternativesElastic Security, Microsoft Sentinel
no first choiceagainst: Checkmk, Devo, Securonix Unified Defense SIEM, SolarWinds Security Event Manager
Qwen 3.7 FlashManageEngine Log360
Three alternativesBlumira, Microsoft Sentinel, UTMStack
against: Splunk Enterprise Security, WazuhBlumiraChanged
Two alternativesManageEngine Log360, Microsoft Sentinel
Microsoft Sentinel
Three alternativesElastic Security, Graylog Security, Wazuh
against: Splunk Enterprise SecurityWazuh
Three alternativesGraylog Security, ManageEngine EventLog Analyzer, Microsoft Sentinel
Microsoft Defender for Endpoint
Six alternativesAzure Sentinel, Coralogix, CrowdStrike Falcon, Datadog Cloud SIEM, Exabeam, Sumo Logic Cloud SIEM
against: ELK Stack, Splunk Enterprise Securityagainst: Devo, Elastic Security, IBM QRadar, Securonix Unified Defense SIEM, SolarWinds Security Event Manager, Splunk Enterprise Security
Kimi K2Blumira
Two alternativesManageEngine Log360, Microsoft Sentinel
against: Elastic Security, IBM QRadar, Splunk Enterprise SecurityBlumiraHeld
Two alternativesHuntress Managed SIEM, Microsoft Sentinel
against: Datadog Cloud SIEM, SentinelOne AI SIEM, Splunk Enterprise SecurityBlumira, Microsoft Sentinel
Two alternativesRapid7 InsightIDR, Wazuh
against: Splunk Enterprise SecurityWazuh
Three alternativesBlumira, Datadog Cloud SIEM, Microsoft Sentinel
no first choice
Five alternativesDatadog Cloud SIEM, Huntress Managed SIEM, Logmanager, ManageEngine Log360, Microsoft Sentinel
against: ELK Stack, Elastic Security, Graylog Security, IBM QRadar, LogRhythm, OpenSearch, OpenText ArcSight, Securonix Unified Defense SIEM, Splunk Enterprise Security, Wazuh
GLM 4.7 FlashXManageEngine Log360
Two alternativesCrowdStrike Falcon Next‑Gen SIEM, Datadog Cloud SIEM
ManageEngine Log360Held
Two alternativesLogmanager, SolarWinds Security Event Manager
against: Microsoft SentinelMicrosoft Sentinel
Four alternativesLogRhythm, Logmanager, ManageEngine Log360, Sumo Logic Cloud SIEM
against: Splunk Enterprise SecurityElastic Security, Wazuh
Three alternativesManageEngine Log360, SolarWinds Security Event Manager, Sumo Logic Cloud SIEM
ManageEngine Log360
Two alternativesElastic Security, Microsoft Sentinel
against: Google Security Operations, IBM QRadar, LogRhythm, NetWitness, SolarWinds Security Event Manager, Splunk Enterprise Security
MiniMax M2.5ManageEngine Log360
Two alternativesMicrosoft Sentinel, UTMStack
against: Splunk Enterprise SecurityMicrosoft SentinelChanged
Five alternativesAT&T Cybersecurity / AlienVault USM, Alert Logic Managed Detection & Response, Expel, Rapid7 InsightIDR, Wazuh
Microsoft Sentinel
Three alternativesCrowdStrike Falcon Next-Gen SIEM, ManageEngine Log360, Rapid7 InsightIDR
AlienVault OSSIM
Two alternativesManageEngine Log360, Microsoft Sentinel
no first choiceagainst: Security Onion, Wazuhagainst: Devo, Elastic Security, IBM QRadar, Securonix Unified Defense SIEM, SolarWinds Security Event Manager, Splunk Enterprise Security
GPT-6 LunaHuntress Managed SIEM
Two alternativesMicrosoft Sentinel, Rapid7 InsightIDR with MDR
Huntress Managed SIEMHeld
One alternativeMicrosoft Sentinel
Blumira, Rapid7 InsightIDR
Two alternativesElastic Security, Microsoft Sentinel
against: Google Security Operations, Splunk Enterprise SecurityWazuh
Two alternativesBlumira, Microsoft Sentinel
no first choiceagainst: Elastic Security, self-managed, IBM QRadar SaaS, Microsoft Sentinel, Splunk Enterprise Security
Muse Glimmer 30BManageEngine Log360
Five alternativesBlumira, Logmanager, Microsoft Sentinel, UTMStack, Wazuh
against: Elastic Security, Splunk QRadarBlumiraChanged
Two alternativesMicrosoft Sentinel, Wazuh
against: Elastic Security, IBM QRadar, Splunk Enterprise SecurityMicrosoft Sentinel
Five alternativesElastic Security, Graylog Security, Logmanager, ManageEngine Log360, Wazuh
against: Splunk Enterprise SecurityWazuh
Five alternativesElastic Stack, Graylog Security, Logmanager, ManageEngine Log360, UTMStack
against: Splunk Enterprise SecurityBlumira
One alternativeMicrosoft Sentinel
against: Elastic Security, IBM QRadar, Splunk Enterprise Security, Wazuhagainst: Azure Sentinel, Elastic Security, Grayl, IBM QRadar, Microsoft Sentinel, SolarWinds Security Event Manager, Splunk Enterprise Security, Sumo Logic Cloud SIEM, Wazuh
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-11-01 12:47yes108 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-11-01 14:48yes35 s
Direct recommendationGemini 3.5 Flashgemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version)2026-11-01 13:54no014 s
Direct recommendationPerplexity Sonarsonar2026-11-01 10:52yes104 s
Direct recommendationGrok 4.20spacexai/grok-4.20-non-reasoning via xai2026-11-01 19:02yes510 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-11-01 13:05yes55 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-11-01 09:07yes1819 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-11-01 18:45yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-11-01 13:54yes530 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-11-01 16:18yes1549 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-11-01 16:44yes1326 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-11-01 11:41yes522 s
Direct recommendationGPT-6 Lunagpt-6-luna2026-11-01 09:03yes313 s
Direct recommendationMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-11-01 12:13yes1118 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-11-01 18:12no05 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-11-01 19:31no02 s
ParaphraseGemini 3.5 Flashgemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version)2026-11-01 14:17yes622 s
ParaphrasePerplexity Sonarsonar2026-11-01 10:02yes104 s
ParaphraseGrok 4.20spacexai/grok-4.20-non-reasoning via xai2026-11-01 17:12yes57 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-11-01 17:55yes55 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-11-01 17:17yes2238 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-11-01 10:49yes53 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-11-01 16:38yes525 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-11-01 08:56yes2022 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-11-01 12:04yes1849 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-11-01 18:28no074 s
ParaphraseGPT-6 Lunagpt-6-luna2026-11-01 15:41yes213 s
ParaphraseMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-11-01 15:11yes2228 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-11-01 13:57yes1010 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-11-01 13:27yes48 s
ComparativeGemini 3.5 Flashgemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version)2026-11-01 13:44yes824 s
ComparativePerplexity Sonarsonar2026-11-01 14:17yes105 s
ComparativeGrok 4.20spacexai/grok-4.20-non-reasoning via xai2026-11-01 14:18yes515 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-11-01 12:28yes57 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-11-01 11:30yes2531 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-11-01 09:58yes52 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-11-01 19:21no029 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-11-01 15:49yes1523 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-11-01 17:33yes25224 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-11-01 09:11yes1050 s
ComparativeGPT-6 Lunagpt-6-luna2026-11-01 17:29yes619 s
ComparativeMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-11-01 10:43yes1422 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-11-01 08:58no05 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-11-01 09:13yes35 s
Budget constrainedGemini 3.5 Flashgemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version)2026-11-01 16:29yes422 s
Budget constrainedPerplexity Sonarsonar2026-11-01 14:03yes103 s
Budget constrainedGrok 4.20spacexai/grok-4.20-non-reasoning via xai2026-11-01 15:40yes536 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-11-01 11:48yes54 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-11-01 14:26yes2423 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-11-01 09:16yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-11-01 09:39no029 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-11-01 12:08yes1530 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-11-01 11:12yes2461 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-11-01 19:02yes522 s
Budget constrainedGPT-6 Lunagpt-6-luna2026-11-01 18:53yes310 s
Budget constrainedMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-11-01 10:18yes1422 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-11-01 15:51no06 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-11-01 17:37no07 s
Scale constrainedGemini 3.5 Flashgemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version)2026-11-01 11:03no013 s
Scale constrainedPerplexity Sonarsonar2026-11-01 11:10yes109 s
Scale constrainedGrok 4.20spacexai/grok-4.20-non-reasoning via xai2026-11-01 18:52yes1515 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-11-01 16:46no08 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-11-01 19:33yes2450 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-11-01 17:04yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-11-01 18:20yes530 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-11-01 16:29yes1522 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-11-01 11:27yes927 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-11-01 16:34no014 s
Scale constrainedGPT-6 Lunagpt-6-luna2026-11-01 19:42yes318 s
Scale constrainedMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-11-01 19:27yes1524 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-11-01 12:04yes179 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-11-01 10:42yes56 s
Negative framingGemini 3.5 Flashgemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version)2026-11-01 18:46no016 s
Negative framingPerplexity Sonarsonar2026-11-01 15:27yes105 s
Negative framingGrok 4.20spacexai/grok-4.20-non-reasoning via xai2026-11-01 18:18yes510 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-11-01 15:20yes86 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-11-01 11:48yes2534 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-11-01 12:10yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-11-01 17:59yes536 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-11-01 08:54yes2058 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-11-01 15:15yes1557 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-11-01 10:42yes838 s
Negative framingGPT-6 Lunagpt-6-luna2026-11-01 10:46yes425 s
Negative framingMuse Glimmer 30Bmeta/muse-glimmer-30b via togetherai2026-11-01 12:45yes1424 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

ShowHide
Category-scoped readings
ArcSight read as OpenText ArcSight
ArcSight (Micro Focus) read as OpenText ArcSight
Cortex XSIAM read as Palo Alto Networks Cortex XSIAM
Datadog read as Datadog Cloud SIEM
ELK read as ELK Stack
ELK (Elastic) read as ELK Stack
Elastic read as Elastic Security
Elastic (ELK Stack) read as Elastic Security
Elastic Cloud read as Elastic Security
Exabeam Fusion read as Exabeam
Graylog read as Graylog Security
Graylog Open read as Graylog Security
Huntress read as Huntress Managed SIEM
IBM read as IBM QRadar
Rapid7 Incident Command read as Rapid7 InsightIDR
Securonix read as Securonix Unified Defense SIEM
Securonix (SASE) read as Securonix Unified Defense SIEM
SolarWinds read as SolarWinds Security Event Manager
SolarWinds (Log Analytics / Network Traffic Analyzer) read as SolarWinds Security Event Manager
SolarWinds (SIEM/LEM modules) read as SolarWinds Security Event Manager
Solarwinds read as SolarWinds Security Event Manager
Splunk read as Splunk Enterprise Security
Splunk (Enterprise / Cloud) read as Splunk Enterprise Security
Splunk (Essentials) read as Splunk Enterprise Security
Splunk (including Splunk Enterprise Security) read as Splunk Enterprise Security
Splunk (or Splunk Cloud) read as Splunk Enterprise Security
Splunk Cloud read as Splunk Enterprise Security
Splunk Cloud Platform read as Splunk Enterprise Security
Splunk Enterprise read as Splunk Enterprise Security
Splunk Free read as Splunk Enterprise Security
Sumo Logic read as Sumo Logic Cloud SIEM
Unresolved, counted raw
Alert Logic Managed Detection & Response (MDR)
Alien OSSIM
CrowdStrike Falcon Next‑Gen SIEM
Elastic Security Serverless
Elastic Security, self-managed
Falcon Next-Gen SIEM
Fortinet FortiAnalyzer
Grayl
Hunters AI-Driven SIEM
Juniper Secure Analytics
Perch (ConnectWise)
Rapid7 InsightIDR with MDR
Raw ELK Stack
Seceon OTM Platform
SentinelOne AI SIEM
Splunk Cloud or Splunk Enterprise Security
Splunk QRadar
Discontinued, still offered
No shut-down product was recommended here.

Also in security operations

The other categories of this function, with the leader in each.
← Awareness trainingSOAR →