Gane Index

All indexesEvery index and its categories GTMMarketing, sales, customer and revenue operations software ITSecurity, IT operations, cloud, developer and data software HRHR, payroll, recruiting, performance and learning software FinanceAccounting, planning, spend, billing and treasury software

Claim your listing

Index › IT › Security operations › SIEM › Enterprise · November 2026 Edition

SIEM platforms for enterprise buyers

Name: AI model recommendations for siem platforms for enterprise buyers, November 2026 Edition
Creator: Gane
Published: 2026-11-01
License: https://creativecommons.org/licenses/by/4.0/

Asked as “SIEM platform”, and as “security information and event management tool”, on behalf of an enterprise B2B company. 53 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.

Standing · first-choice share

47%

Microsoft Sentinel

Clear leader

47Microsoft Sentinel25Splunk Enterprise Security08Exabeam21others

47% of first choices, clear leader.

Since October 2026▲+6Since October 2026: 41% → 47%, +6 points. Inside the 11-point floor: within noise.Microsoft Sentinel held the lead, +6 points on 41%, inside the 11-point floor.

ShowinginAll 136 categories →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Blumira25%Contested▼−9Since October 2026: 34% → 25%, −9 points. Inside the 11-point floor: within noise.Standing →Mid-market

Microsoft Sentinel48%Clear leader▲+10Since October 2026: 38% → 48%, +10 points. Inside the 11-point floor: within noise.Standing →Enterprise

Microsoft Sentinel47%Clear leader▲+6Since October 2026: 41% → 47%, +6 points. Inside the 11-point floor: within noise.This page

The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for an enterprise B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026

Microsoft Sentinel7%71endorsed leader▲+6Since October 2026: 41% → 47%, +6 points. Inside the 11-point floor: within noise.41% → 47%

Splunk Enterprise Security26%72criticized challenger▼−1Since October 2026: 26% → 25%, −1 point. Inside the 11-point floor: within noise.26% → 25%

Exabeam11%35accepted challenger▲+2Since October 2026: 6% → 8%, +2 points. Inside the 11-point floor: within noise.6% → 8%

IBM QRadar25%52criticized challenger=heldSince October 2026: 6% → 6%, ±0 points. Inside the 11-point floor: within noise.6% → 6%

Securonix Unified Defense SIEM19%27accepted challenger▲+2Since October 2026: 2% → 4%, +2 points. Inside the 11-point floor: within noise.2% → 4%

ManageEngine Log36012%17accepted challenger▲+4Since October 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise.0% → 4%

Google Security Operations Lab in the set4%28accepted challenger▼−7Since October 2026: 9% → 2%, −7 points. Inside the 11-point floor: within noise.9% → 2%

Palo Alto Networks Cortex XSIAM5%21accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%

Elastic Security24%29accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%

Rapid7 InsightIDR12%17accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%

Show the three products at 0%, ordered by negative rate

Sumo Logic Cloud SIEM40%15criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%

LogRhythm33%18criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%

CrowdStrike Falcon Next-Gen SIEM7%28accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%

The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.

Google Security Operations is made by Google, whose model Gemini 3.5 Flash is in the set. On the four share prompts that model made it the first choice zero times of 4; the other thirteen models one time of 52. Lab treatment is defined on the method page; the row is marked, not excluded.

For buyers

Build your shortlist

Head to head

Microsoft Sentinel vs Wazuh Microsoft Sentinel vs Rapid7 InsightIDR Microsoft Sentinel vs ManageEngine Log360

Head-to-head pages are published for mid-market buyers, so these open on mid-market figures, not enterprise.

All twenty-eight head-to-head pages: the top eight products, each against each

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default

Negative label rate →

Accepted challengerEndorsed leader

0%First-choice share → · lines at 30% share and 25% negative60%

Key

Microsoft Sentinel47%

Splunk Enterprise Security25%

Exabeam8%

IBM QRadar6%

Securonix Unified Defense SIEM4%

ManageEngine Log3604%

Google Security Operations2%

Palo Alto Networks Cortex XSIAM2%

Elastic Security2%

Rapid7 InsightIDR2%

CrowdStrike Falcon Next-Gen SIEM0%

LogRhythm0%

Sumo Logic Cloud SIEM0%

What they warned about

Seven of fourteen models held their first choice under the paraphrase. Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

IBM QRadar

25%

13 of 52 labels negative · 12 of 14 models · 5 hard negative

“The SaaS edition has been withdrawn from sale... enterprises relying on QRadar's cloud offerings should plan migration strategies carefully.” Claude Haiku 4.5, negative prompt

Splunk Enterprise Security

26%

19 of 72 labels negative · 11 of 14 models · 3 hard negative

“What to Avoid for Predictability - Splunk Enterprise Security: ... often leads to unpredictable costs as data grows” Grok 4.20, budget prompt

LogRhythm

33%

6 of 18 labels negative · 6 of 14 models · 3 hard negative

“Management complexity, frequent stability issues (e.g., crashes, log loss in high-volume scenarios)” Grok 4.20, negative prompt

Elastic Security

24%

7 of 29 labels negative · 6 of 14 models · 2 hard negative

“Pure per-GB options like Elastic Security or Sumo Logic can balloon without strict governance.” Grok 4.20, budget prompt

What they cite

Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.

Sites the answers cite

78 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 890 links across 207 sites, every framing counted. Ranked by the number of answers carrying the site or page. 22 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.

exabeam.com

vendor site · Exabeam32 answers · 46 citations · 12 models

securityboulevard.com

26 answers · 32 citations · 10 models

techrepublic.com

26 answers · 26 citations · 9 models

manageengine.com

vendor site · ManageEngine25 answers · 27 citations · 11 models

splunk.com

vendor site · Splunk22 answers · 29 citations · 9 models

senseon.io

vendor site · SenseOn22 answers · 22 citations · 11 models

microsoft.com

vendor site · Microsoft18 answers · 35 citations · 7 models

paloaltonetworks.com

vendor site · Palo Alto Networks17 answers · 21 citations · 8 models

underdefense.com

vendor site · UnderDefense17 answers · 18 citations · 8 models

huntress.com

vendor site · Huntress15 answers · 16 citations · 8 models

expertinsights.com

14 answers · 14 citations · 8 models

crowdstrike.com

vendor site · CrowdStrike13 answers · 23 citations · 6 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

techrepublic.com/article/siem-tools

26 answers · 9 models

senseon.io/blog/5-best-siem-tools

22 answers · 11 models

underdefense.com/blog/siem-solutions-comparison

16 answers · 8 models

exabeam.com/explainers/siem-tools/siem-buyers-guide

14 answers · 7 models

expertinsights.com/security-operations/the-top-siem-solutions

13 answers · 8 models

manageengine.com/log-management/top-siem-tools.html

13 answers · 9 models

exabeam.com/explainers/agentic-ai/biggest-pain-points-of-traditional-siem-a…

12 answers · 8 models

start.paloaltonetworks.com/rs/531-OCS-018/images/PAN%20Reprint%20Omdia%20Un…

11 answers · 7 models

cipherssecurity.com/best-siem-tools-in-2026-compared

10 answers · 4 models

huntress.com/siem-guide/siem-tools

10 answers · 7 models

Search against answers

Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best siem platform”, “siem platform”, “siem platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.

Company and products	Share	Own site cited	Name searches, Google	AI search demand, est.	Organic visits	Paid search a month, est.	Google ads, last 30 days	Best Google position
Microsoft parent site Microsoft Sentinel 47%	47%	371	2,240,000	403,136
Splunk splunk.com Splunk Enterprise Security 25%	25%	187	40,500	6,832	892,906 company		120
Exabeam exabeam.com Exabeam 8%, Exabeam New-Scale 0%	8%	110	1,900	82	66,723		0	5
IBM parent site IBM QRadar 6%	6%	115	201,000	34,098
Securonix Unified Defense SIEM securonix.com	4%	48	20	0	3,571	$13	9
ManageEngine parent site ManageEngine Log360 4%	4%	139	8,100	675
Google Security Operations google.dev	2%	79	390	5	881,346		109
Palo Alto Networks parent site Palo Alto Networks Cortex XSIAM 2%	2%	86	40,500	1,088
Elastic elastic.co Elastic Security 2%	2%	124	74,000	34,672	208,306 company		105
Rapid7 parent site Rapid7 InsightIDR 2%	2%	88	14,800	798

Google's top ten for the three searches hold 21 sites; 3 of them are among the sites the models cited here (exabeam.com, manageengine.com, underdefense.com). The first result for “best siem platform” is gartner.com.

How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ShowHide

ModelDirect“What is the best SIEM platform for an enterprise B2B company?”Paraphrase“Which security information and event management tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade SIEM platforms and how do they differ?”Budget-constrained“What is the best SIEM platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a SIEM platform. What should we look at?”Negative“Which SIEM platforms should a large enterprise avoid or be cautious about?”

Claude Haiku 4.5Splunk Enterprise Security

Three alternatives

IBM QRadar, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM

Splunk Enterprise SecurityHeld

Four alternatives

CrowdStrike Falcon Next-Gen SIEM, IBM QRadar, Microsoft Sentinel, Securonix Unified Defense SIEM

no first choiceGoogle Security Operations

Two alternatives

Blumira, Splunk Enterprise Security

no first choiceagainst: FortiSIEM, IBM QRadar, Microsoft Sentinel, Splunk Enterprise Security, Sumo Logic Cloud SIEM

GPT-5.4 miniMicrosoft Sentinel

Two alternatives

IBM QRadar, Splunk Enterprise Security

Microsoft SentinelHeld

Two alternatives

IBM QRadar, Splunk Enterprise Security

no first choiceMicrosoft Sentinel

One alternative

Splunk Enterprise Security

against: CrowdStrike Falcon Next-Gen SIEMno first choiceagainst: Microsoft Sentinel, Splunk Enterprise Security

Gemini 3.5 FlashMicrosoft Sentinel

Four alternatives

Cisco Splunk Enterprise Security, CrowdStrike Falcon Next-Gen SIEM, Google Cloud SecOps, Palo Alto Networks Cortex XSIAM

Microsoft SentinelHeld

Four alternatives

CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, Palo Alto Networks Cortex XSIAM, Splunk Enterprise Security

Microsoft Sentinel

Five alternatives

CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, Palo Alto Networks Cortex XSIEM, Securonix Unified Defense SIEM, Splunk Enterprise Security

Securonix Unified Defense SIEM

Three alternatives

Elastic Security, Exabeam, Microsoft Sentinel

no first choiceagainst: AT&T Cybersecurity / AlienVault USM, Elastic Security, Exabeam, IBM QRadar, LogRhythm, Logstash, OpenSearch, OpenText ArcSight, Splunk Enterprise Security, Wazuh

Perplexity SonarMicrosoft Sentinel

Six alternatives

CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, ManageEngine Log360, Palo Alto Networks Cortex XSIAM, Rapid7 InsightIDR, Splunk Enterprise Security

Microsoft SentinelHeld

Three alternatives

Google Security Operations, IBM QRadar, Splunk Enterprise Security

against: Elastic SecurityMicrosoft Sentinel

Seven alternatives

CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Google Security Operations, IBM QRadar, Palo Alto Networks Cortex XSIAM, Securonix Unified Defense SIEM, Splunk Enterprise Security

Rapid7 InsightIDR

Three alternatives

Coralogix Cloud SIEM, Google Security Operations, Microsoft Sentinel

against: Splunk Enterprise Securityno first choiceagainst: CrowdStrike Falcon Next-Gen SIEM, Exabeam, FortiSIEM, Graylog Security, IBM QRadar, ManageEngine Log360, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Rapid7 InsightIDR, Securonix Unified Defense SIEM, SentinelOne, Splunk Enterprise Security, Sumo Logic Cloud SIEM, Wazuh

Grok 4.20Splunk Enterprise Security

Four alternatives

CrowdStrike Falcon Next-Gen SIEM, Elastic Security, IBM QRadar, Microsoft Sentinel

against: NetWitnessSplunk Enterprise SecurityHeld

Four alternatives

CrowdStrike Falcon Next-Gen SIEM, Exabeam, IBM QRadar, Microsoft Sentinel

Microsoft Sentinel, Splunk Enterprise Security

Six alternatives

CrowdStrike Falcon LogScale, Elastic Security, Exabeam, Google Security Operations, IBM QRadar, Palo Alto Networks Cortex XSIAM

Microsoft Sentinel

Four alternatives

Blumira, Google Security Operations, Logpoint, ManageEngine Log360

against: Elastic Security, Splunk Enterprise Security, Sumo Logic Cloud SIEMMicrosoft Sentinel

Five alternatives

CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Exabeam, Splunk Enterprise Security, Sumo Logic Cloud SIEM

against: IBM QRadaragainst: AlienVault USM, Elastic Security, Graylog Security, IBM QRadar, LogRhythm, Micro Focus, OpenText ArcSight, Rapid7 InsightIDR, Splunk Enterprise Security, Sumo Logic Cloud SIEM

Mistral SmallMicrosoft Sentinel

Four alternatives

FortiSIEM, ManageEngine Log360, NetWitness, Splunk Enterprise Security

Exabeam, IBM QRadarChanged

Three alternatives

CrowdStrike Falcon Next-Gen SIEM, NetWitness, Splunk Enterprise Security

IBM QRadar, Splunk Enterprise Security

Three alternatives

Exabeam, Microsoft Sentinel, Securonix Unified Defense SIEM

ManageEngine Log360, Palo Alto Networks Cortex XSIAM

One alternative

Microsoft Sentinel

no first choiceagainst: IBM QRadar, SolarWinds Security Event Manager

DeepSeek V4 FlashMicrosoft Sentinel

Four alternatives

CrowdStrike Falcon Next-Gen SIEM, IBM QRadar, Rapid7 InsightIDR, Splunk Enterprise Security

Splunk Enterprise SecurityChanged

Two alternatives

IBM QRadar, Microsoft Sentinel

Microsoft Sentinel, Splunk Enterprise Security

Four alternatives

CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, IBM QRadar, Securonix Unified Defense SIEM

Exabeam

Three alternatives

Blumira, ManageEngine Log360, Securonix Unified Defense SIEM

against: Microsoft Sentinelno first choiceagainst: IBM QRadar, LogRhythm, McAfee Enterprise Security Manager, OpenText ArcSight, Securonix Unified Defense SIEM

Llama 4 MaverickMicrosoft Sentinel

Four alternatives

FortiSIEM, ManageEngine Log360, NetWitness, Splunk Enterprise Security

no first choiceChangedno first choiceManageEngine Log360no first choiceagainst: IBM QRadar, SolarWinds Security Event Manager

Qwen 3.7 FlashSplunk Enterprise Security

Four alternatives

CrowdStrike Falcon SIEM, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Rapid7 InsightIDR

Microsoft SentinelChanged

Two alternatives

Exabeam, Splunk Enterprise Security

Microsoft Sentinel, Splunk Enterprise Security

Three alternatives

Datadog Cloud SIEM, Elastic Security, IBM QRadar

IBM QRadar

One alternative

ManageEngine Log360

against: Microsoft Sentinel, Splunk Enterprise Securityno first choice

Three alternatives

Datadog Cloud SIEM, Exabeam, Microsoft Sentinel

against: Splunk Enterprise Security, Wazuhagainst: Devo, Elasticsearch, IBM QRadar, LogRhythm, Security Onion, Securonix Unified Defense SIEM, SolarWinds Security Event Manager, Sumo Logic Cloud SIEM

Kimi K2Microsoft Sentinel, Splunk Enterprise Security

Three alternatives

CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, IBM QRadar

Splunk Enterprise SecurityChanged

Three alternatives

CrowdStrike Falcon Next-Gen SIEM, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM

Splunk Enterprise Security

Five alternatives

CrowdStrike Falcon Next-Gen SIEM, Exabeam, IBM QRadar, LogRhythm SIEM, Microsoft Sentinel

Microsoft Sentinel

Two alternatives

Blumira, Rapid7 InsightIDR

against: Splunk Enterprise Securityno first choice

Six alternatives

CrowdStrike Falcon LogScale, Devo, Elastic Security, Exabeam New-Scale, Microsoft Sentinel, Splunk Enterprise Security

against: Exabeam, IBM QRadar, LogRhythm, OpenText ArcSight, Securonix Unified Defense SIEM, Splunk Enterprise Security

GLM 4.7 FlashXSplunk Enterprise Security

Four alternatives

Exabeam, IBM QRadar, LogRhythm SIEM, Microsoft Sentinel

Microsoft Sentinel, Splunk Enterprise SecurityChanged

Two alternatives

CrowdStrike Falcon Next-Gen SIEM, IBM QRadar

no first choiceElastic Security

One alternative

Microsoft Sentinel

against: Splunk Enterprise Securityno first choiceagainst: Check Point Maestro, Elastic Security, IBM QRadar, ManageEngine Log360, SolarWinds Security Event Manager, Wazuh

MiniMax M2.5Exabeam, IBM QRadar

Three alternatives

CrowdStrike Falcon Next-Gen SIEM, Microsoft Sentinel, Splunk Enterprise Security

Microsoft Sentinel, Splunk Enterprise SecurityChanged

One alternative

IBM QRadar

no first choiceExabeam, Securonix Unified Defense SIEM

Two alternatives

IBM QRadar, Microsoft Sentinel

against: AT&T Cybersecurity, Elastic Security, Splunk Enterprise SecurityMicrosoft Sentinel

Three alternatives

Exabeam, IBM QRadar, Securonix Unified Defense SIEM

against: Splunk Enterprise Securityagainst: Devo, Google Security Operations, McAfee Nitro, Securonix Unified Defense SIEM

GPT-6 LunaMicrosoft Sentinel

Three alternatives

CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, Splunk Enterprise Security

Microsoft SentinelHeld

Two alternatives

Google Security Operations, Splunk Enterprise Security

no first choice

Seven alternatives

CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Exabeam New-Scale SIEM, Google Security Operations, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Splunk Enterprise Security

against: IBM QRadarMicrosoft Sentinel

One alternative

Google Security Operations

against: Splunk Enterprise Securityno first choiceagainst: IBM QRadar SaaS, Splunk Enterprise Security, Trellix

Muse Glimmer 30BMicrosoft Sentinel, Splunk Enterprise Security

Three alternatives

Google Security Operations, IBM QRadar, NetWitness

Microsoft Sentinel, Splunk Enterprise SecurityHeld

One alternative

NetWitness

Splunk Enterprise Security

Eight alternatives

CrowdStrike, Elastic Security, Exabeam, Google Security Operations, IBM QRadar, Microsoft Sentinel, Palo Alto Networks, Securonix Unified Defense SIEM

Microsoft Sentinel

Six alternatives

Exabeam, Google Chronicle Backstory, Huntress Managed SIEM, LogRhythm, Rapid7 InsightIDR, Securonix Unified Defense SIEM

against: Devo, FortiSIEM, IBM QRadar, OpenText ArcSight, Splunk Enterprise Security, SumoMicrosoft Sentinel

Three alternatives

CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, Palo Alto Networks Cortex XSIAM

against: Elastic Security, Splunk Enterprise Security, Sumo Logic Cloud SIEMagainst: Exabeam, IBM QRadar SaaS, LogRhythm, Splunk Enterprise Security

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.

Eighty-four rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 08:51	yes	10	9 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 12:21	yes	4	6 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 10:12	yes	7	20 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-11-01 17:15	yes	10	4 s
Direct recommendation	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 16:25	yes	5	12 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 17:36	yes	5	4 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 11:22	yes	23	19 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 15:44	yes	5	3 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 12:38	yes	5	25 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 11:15	yes	20	50 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 10:37	yes	9	41 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 11:19	yes	5	30 s
Direct recommendation	GPT-6 Luna	`gpt-6-luna`	2026-11-01 13:48	yes	4	14 s
Direct recommendation	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 19:27	yes	15	25 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 10:54	yes	17	10 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 10:54	yes	3	5 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 16:38	yes	10	25 s
Paraphrase	Perplexity Sonar	`sonar`	2026-11-01 17:33	yes	10	4 s
Paraphrase	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 19:01	yes	5	10 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 19:31	yes	5	7 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 11:28	yes	19	28 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 19:06	yes	5	3 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 11:51	yes	5	33 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 18:26	yes	15	47 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 19:43	yes	15	27 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 11:23	no	0	14 s
Paraphrase	GPT-6 Luna	`gpt-6-luna`	2026-11-01 14:00	yes	4	15 s
Paraphrase	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 18:07	yes	14	18 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 08:56	yes	14	10 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 11:04	yes	5	9 s
Comparative	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 18:33	yes	8	23 s
Comparative	Perplexity Sonar	`sonar`	2026-11-01 09:03	yes	10	7 s
Comparative	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 17:58	yes	5	15 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 18:17	yes	5	7 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 16:58	yes	24	52 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 16:04	yes	5	3 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 10:16	yes	15	29 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 09:49	yes	14	38 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 16:33	yes	24	48 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 13:14	yes	10	43 s
Comparative	GPT-6 Luna	`gpt-6-luna`	2026-11-01 12:47	yes	10	27 s
Comparative	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 16:38	yes	15	29 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 19:02	yes	18	9 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 13:12	yes	4	5 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 19:19	yes	12	24 s
Budget constrained	Perplexity Sonar	`sonar`	2026-11-01 15:32	yes	10	4 s
Budget constrained	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 19:15	yes	11	14 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 12:42	yes	5	4 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 11:24	yes	23	34 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 15:49	yes	5	3 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 10:40	yes	10	54 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 13:17	yes	18	24 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 08:53	yes	23	38 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 15:13	no	0	87 s
Budget constrained	GPT-6 Luna	`gpt-6-luna`	2026-11-01 19:33	yes	4	11 s
Budget constrained	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 12:50	yes	11	25 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 16:52	no	0	6 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 15:32	yes	3	11 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 15:00	no	0	21 s
Scale constrained	Perplexity Sonar	`sonar`	2026-11-01 14:56	yes	10	9 s
Scale constrained	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 15:07	yes	8	22 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 16:07	no	0	9 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 18:07	yes	25	59 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 16:43	yes	5	3 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 19:14	no	0	36 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 18:21	yes	20	57 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 11:41	yes	24	139 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 13:55	yes	10	44 s
Scale constrained	GPT-6 Luna	`gpt-6-luna`	2026-11-01 10:05	yes	4	23 s
Scale constrained	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 17:25	yes	14	25 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-11-01 14:00	yes	19	10 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-11-01 14:48	yes	5	8 s
Negative framing	Gemini 3.5 Flash	`gemini-3.6-flash` (asked for `gemini-3.5-flash`; the API answered as this version)	2026-11-01 12:17	yes	14	23 s
Negative framing	Perplexity Sonar	`sonar`	2026-11-01 11:44	yes	10	4 s
Negative framing	Grok 4.20	`spacexai/grok-4.20-non-reasoning via xai`	2026-11-01 14:13	yes	9	15 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-11-01 12:18	yes	5	7 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-11-01 14:51	yes	25	43 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-11-01 08:44	yes	5	3 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-11-01 16:23	yes	15	42 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-11-01 09:13	yes	24	66 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-11-01 11:33	yes	24	96 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-11-01 15:40	yes	11	62 s
Negative framing	GPT-6 Luna	`gpt-6-luna`	2026-11-01 19:13	yes	4	19 s
Negative framing	Muse Glimmer 30B	`meta/muse-glimmer-30b via togetherai`	2026-11-01 17:34	yes	25	36 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

ShowHide

Category-scoped readings

ArcSight read as OpenText ArcSight

ArcSight (OpenText) read as OpenText ArcSight

ArcSight (now OpenText) read as OpenText ArcSight

Cortex XSIAM read as Palo Alto Networks Cortex XSIAM

Datadog read as Datadog Cloud SIEM

Datadog Security read as Datadog Cloud SIEM

Elastic read as Elastic Security

Elastic Cloud read as Elastic Security

Exabeam Fusion read as Exabeam

Fortinet read as FortiSIEM

Google read as Google Security Operations

Google Chronicle read as Google Security Operations

Google Chronicle (now part of Mandiant) read as Google Security Operations

Google Cloud read as Google Security Operations

Google SecOps read as Google Security Operations

Google SecOps (Chronicle) read as Google Security Operations

Google SecOps (formerly Chronicle) read as Google Security Operations

Graylog read as Graylog Security

Huntress read as Huntress Managed SIEM

IBM read as IBM QRadar

ManageEngine read as ManageEngine Log360

Microsoft read as Microsoft Sentinel

OpenText read as OpenText ArcSight

Rapid7 read as Rapid7 InsightIDR

Rapid7 Incident Command read as Rapid7 InsightIDR

Securonix read as Securonix Unified Defense SIEM

SolarWinds read as SolarWinds Security Event Manager

Splunk read as Splunk Enterprise Security

Splunk Cloud read as Splunk Enterprise Security

Stellar Cyber read as Stellar Cyber Next-Gen SIEM

Sumo Logic read as Sumo Logic Cloud SIEM

Unresolved, counted raw

Check Point Maestro

Cisco Splunk Enterprise Security (ES)

Coralogix Cloud SIEM

CrowdStrike Falcon SIEM

Devo Technology

Exabeam New-Scale

Exabeam New-Scale SIEM

Google Chronicle Backstory

McAfee Enterprise Security Manager (Nitro/SIEM)

McAfee Nitro

Palo Alto Networks Cortex XSIEM

QAX

QRadar on-premises

Sumo

guardsix

Discontinued, still offered

No shut-down product was recommended here.

SIEM platforms for enterprise buyers

By buyer segment

The standing

Recommended versus criticized

What they warned about

What they cite

Sites the answers cite

Pages the answers cite

Search against answers

How they answered

The record

Normalization in this category

Also in security operations