✳ Atlas Fold / SIEM

SIEM, unfolded.

Security information & event management

← All segments Read the field guide ↗Method & limitations ↗

Atlas Fold / SIEM / First edition

Security information & event management

Provisional editorial research based on public documentation, not tested effectiveness.

First edition · Reviewed 2026-09-21· Rubric 1.1

Six dimensions, each scored 0.0–5.0 in tenths. Gaps stay visible.

Comparable offerings and editions; exclude managed service comparisons.

Download JSON

Six dimensions, with gaps listed

Each row is one 0.0–5.0 dimension. Every assessed offering has a consistent color, shape, and number. Numbers identify offerings, not rank. Unknown scores are omitted.

Separate overlapping marks

Separated marks connect to their exact positions. Separation does not change scores.

Momentum: building history. Numbers identify offerings, not rank; lines between dimensions are profiles, not time.

A position is only half the story

Momentum

Building history

Baseline recorded 2026-09-21. A second comparable review is needed to show movement.

Own movement is the score change. Relative movement subtracts the median change of matched peers, excluding this offering. Dimensions stay separate.

Microsoft Sentinel· movement by dimension
Dimension	Own movement	Against peers
Operational maturity	Building history	Not available yetNo direction inferred
Shipped innovation	Building history	Not available yetNo direction inferred
Capability breadth	Building history	Not available yetNo direction inferred
Ecosystem & integration	Building history	Not available yetNo direction inferred
Governance & control	Building history	Not available yetNo direction inferred
Operator enablement	Building history	Not available yetNo direction inferred

History appears as a hollow earlier mark connected to the current solid mark in Unfold and Overview. Profile lines between dimensions do not show time. Numbers identify offerings, not rank.

Review history & what changed

The 2026-09-21 baseline incorporates the six-dimension review. Decimal calibration and research corrections are not product momentum. Unknowns stay unknown.

2026-09-21 · baseline · rubric 1.1 · Starting point; no movement inferred.

How momentum is calculated →

Documented scores

Microsoft Sentinel (medium confidence) has the highest documented score (5.0) for Operational maturity among assessed offerings in this comparison group.

Microsoft Sentinel (medium confidence) and Google Security Operations SIEM (medium confidence) are tied at documented score 3.0 for Shipped innovation among assessed offerings in this comparison group. No distinction is evidenced among the scored offerings. 1 offering remains unknown for this dimension.

Unknowns and gaps

Unknown is not low quality. Marks are omitted where a required score is unknown.

Microsoft Sentinel: no unknown dimensions.
Splunk Enterprise Security: Shipped innovation, Ecosystem & integration, Operator enablement
Google Security Operations SIEM: Ecosystem & integration, Governance & control

Scenario lens

A scenario highlights priorities and validation questions only. It does not rewrite scores or claim eligibility.

Selected evidence

Microsoft Sentinel · Microsoft

Microsoft Sentinel cloud SIEM (Microsoft Defender portal; remaining Azure portal support until 31 March 2027). Not Defender XDR as a whole, not Security Copilot, and not Microsoft Sentinel MCP or graph as the scored offering. · Assessed 2026-09-21 · Research preview

Operational maturity

Do current public docs describe a complete ingest-detect-investigate-incident loop as operator procedures, not marketing claims?

Documented-evidence stage of a shipped SIEM operating loop from collection through detection, investigation, and incident or case handling. Anchors describe presence of documented procedures, not observed quality or efficacy. A gap in public docs is unknown (null), not stage 0.

Documented cloud SIEM loop of connectors, KQL analytics rules, incidents, hunting, and automation rules. Ordinary baseline includes ASIM normalization and incident correlation. Data-lake tiering is preview and Fusion is unavailable on the evaluated Defender-portal path, so those are not scored as differentiation.

Score5.0 / 5.0medium confidence

Rationale and sources

The incident, hunting and automation loop is supplemented by Content hub lifecycle procedures, shipped Log Analytics retention settings, connector-health monitoring and scheduled/NRT rule execution and change audit. This completes anchor 5 as a documentation stage. Health support has connector-specific limits; preview lake workflows are excluded.

Constraints

Evaluated offering is Microsoft Sentinel cloud SIEM, not Microsoft Defender XDR, Security Copilot, or the Sentinel MCP/graph platform extras.
After 31 March 2027 Sentinel is documented as Defender-portal only; Azure portal remains documented until then.
Analytics-tier tables are required for analytics rules, hunting queries, parsers, playbooks, watchlists, and workbooks; lake-only tables do not run those SIEM features.
Fusion and Microsoft-security incident-creation rules are documented as unavailable after Defender-portal onboarding or Defender XDR incident integration.
Data-lake onboarding, graph, and some table-management experiences are documented with preview labels.
Playbooks are Azure Logic Apps with separate roles and resource-group permissions; they are not included merely by enabling Sentinel.
Connector support may be Microsoft, partner, or community; a connector listing is not evidence of complete parsing for every source version.
Connector-health tables cover supported connector types rather than every integration. Azure Lighthouse does not alone grant all customer connector deployment rights; GDAP and tenant-specific permissions may be required.

Sources

Threat detection in Microsoft Sentinel · documentation · Accessed 2026-09-21
Investigate Microsoft Sentinel incidents in the Azure portal · documentation · Accessed 2026-09-21
Automate threat response in Microsoft Sentinel with automation rules · documentation · Accessed 2026-09-21
Hunting capabilities in Microsoft Sentinel · documentation · Accessed 2026-09-21
Discover and manage Microsoft Sentinel out-of-the-box content · documentation · Accessed 2026-09-21
Configure data retention and archive · documentation · Accessed 2026-09-21
Monitor data connector health · documentation · Accessed 2026-09-21
Monitor analytics rule integrity and execution · documentation · Accessed 2026-09-21
Enable Microsoft Sentinel health and audit monitoring · documentation · Accessed 2026-09-21

0–5 rubric anchors

0 — Public documentation states that the offering does not provide a SIEM ingest-detect-investigate-incident operating loop.
1 — Documentation describes collecting security telemetry and searching stored events.
2 — Documentation describes scheduled or streaming detections that create alerts from queried telemetry.
3 — Documentation describes aggregating alerts into incidents or cases with assignment, status, and review of contributing events.
4 — Documentation describes operator workflows for grouping or enriching incidents, hunting related activity, and documented automation of incident handling under operator-defined conditions.
5 — Documentation describes the stage-4 loop plus SIEM content lifecycle, data-tier or retention operations, and health or audit of collection and detection execution as shipped operator procedures.

Assessed offerings inSIEM platforms. Unknown means not scored, not low quality.
Offering	Operational maturity	Shipped innovation	Capability breadth	Ecosystem & integration	Governance & control	Operator enablement
Microsoft Sentinel	5.0 (medium)	3.0 (medium)	5.0 (medium)	5.0 (medium)	4.0 (medium)	4.0 (medium)
Splunk Enterprise Security	3.0 (medium)	Unknown	3.0 (low)	Unknown	2.0 (medium)	Unknown
Google Security Operations SIEM	3.7 (medium)	3.0 (medium)	4.0 (medium)	Unknown	Unknown	3.0 (medium)

All comparison groups and evidence

Interactive controls require JavaScript. Every assessment remains available below, grouped by comparable scope.

SIEM platforms

Comparable offerings and editions; exclude managed service comparisons.

SIEM platforms · independent 0.0–5.0 scores; unknown is not zero.
Offering	Operational maturity	Shipped innovation	Capability breadth	Ecosystem & integration	Governance & control	Operator enablement
Microsoft Sentinel	5.0 (medium)	3.0 (medium)	5.0 (medium)	5.0 (medium)	4.0 (medium)	4.0 (medium)
Splunk Enterprise Security	3.0 (medium)	Unknown	3.0 (low)	Unknown	2.0 (medium)	Unknown
Google Security Operations SIEM	3.7 (medium)	3.0 (medium)	4.0 (medium)	Unknown	Unknown	3.0 (medium)

Microsoft Sentinel · Microsoft Sentinel cloud SIEM (Microsoft Defender portal; remaining Azure portal support until 31 March 2027). Not Defender XDR as a whole, not Security Copilot, and not Microsoft Sentinel MCP or graph as the scored offering.

Assessed 2026-09-21 · Research preview

Evaluated offering is Microsoft Sentinel cloud SIEM, not Microsoft Defender XDR, Security Copilot, or the Sentinel MCP/graph platform extras.
After 31 March 2027 Sentinel is documented as Defender-portal only; Azure portal remains documented until then.
Analytics-tier tables are required for analytics rules, hunting queries, parsers, playbooks, watchlists, and workbooks; lake-only tables do not run those SIEM features.
Fusion and Microsoft-security incident-creation rules are documented as unavailable after Defender-portal onboarding or Defender XDR incident integration.
Data-lake onboarding, graph, and some table-management experiences are documented with preview labels.
Playbooks are Azure Logic Apps with separate roles and resource-group permissions; they are not included merely by enabling Sentinel.
Connector support may be Microsoft, partner, or community; a connector listing is not evidence of complete parsing for every source version.
Connector-health tables cover supported connector types rather than every integration. Azure Lighthouse does not alone grant all customer connector deployment rights; GDAP and tenant-specific permissions may be required.

Operational maturity: 5.0 / 5.0 · medium confidence

Threat detection in Microsoft Sentinel · documentation · Accessed 2026-09-21
Investigate Microsoft Sentinel incidents in the Azure portal · documentation · Accessed 2026-09-21
Automate threat response in Microsoft Sentinel with automation rules · documentation · Accessed 2026-09-21
Hunting capabilities in Microsoft Sentinel · documentation · Accessed 2026-09-21
Discover and manage Microsoft Sentinel out-of-the-box content · documentation · Accessed 2026-09-21
Configure data retention and archive · documentation · Accessed 2026-09-21
Monitor data connector health · documentation · Accessed 2026-09-21
Monitor analytics rule integrity and execution · documentation · Accessed 2026-09-21
Enable Microsoft Sentinel health and audit monitoring · documentation · Accessed 2026-09-21

Shipped innovation: 3.0 / 5.0 · medium confidence

Fetched docs establish the ordinary current SIEM baseline: ASIM normalization, analytics-rule correlation of alerts into incidents, investigation, incident handling, and analytics-tier retention. No stage-4 novelty is claimed. Data-lake placement, KQL promotion jobs, and related table management are documented with preview labels and are excluded. Fusion multi-stage correlation is documented as unavailable after Defender-portal onboarding, which is the evaluated path. Copilot, MCP, and agentic-defense branding are not scored.

What is Microsoft Sentinel SIEM? · documentation · Accessed 2026-09-21
Threat detection in Microsoft Sentinel · documentation · Accessed 2026-09-21
Automate threat response in Microsoft Sentinel with automation rules · documentation · Accessed 2026-09-21
Normalization and the Advanced Security Information Model (ASIM) · documentation · Accessed 2026-09-21

Capability breadth: 5.0 / 5.0 · medium confidence

First- and third-party collection, hunting, entity context and threat-intelligence workflows are supplemented by scheduled and near-real-time detections, packaged Content hub content and shipped Log Analytics retention settings. These establish anchor 5. Legacy Fusion on the Defender portal and preview lake capabilities remain excluded.

Threat detection in Microsoft Sentinel · documentation · Accessed 2026-09-21
Microsoft Sentinel data connectors · documentation · Accessed 2026-09-21
Hunting capabilities in Microsoft Sentinel · documentation · Accessed 2026-09-21
Discover and manage Microsoft Sentinel out-of-the-box content · documentation · Accessed 2026-09-21
Configure data retention and archive · documentation · Accessed 2026-09-21

Ecosystem & integration: 5.0 / 5.0 · medium confidence

The connector/content hub, custom ingestion frameworks and ticket/response integrations are supplemented by published service-provider procedures for delegated customer workspaces and Defender portal access. Azure Lighthouse and GDAP have distinct requirements; delegated connector deployment is not assumed from Lighthouse alone. This establishes anchor 5 without changing product scope.

Governance & control: 4.0 / 5.0 · medium confidence

The non-lake Sentinel roles page documents Reader/Responder/Contributor and playbook roles, least-privilege guidance, explicit service-account permission on playbook resource groups, and resource-context or table-level RBAC for restricting workspace data. Incident activity records support the audit condition. Preview lake and unified-RBAC features are excluded.

Roles and permissions in the Microsoft Sentinel platform · documentation · Accessed 2026-09-21
Investigate Microsoft Sentinel incidents in the Azure portal · documentation · Accessed 2026-09-21
Automate threat response in Microsoft Sentinel with automation rules · documentation · Accessed 2026-09-21

Operator enablement: 4.0 / 5.0 · medium confidence

Rule authoring/export, incident and hunting workflows, Content hub installation and connector setup establish anchor 4. The new health and retention procedures strengthen operator guidance, but this review does not establish the complete anchor-5 operator task checklist across the evaluated Defender-portal scope and connector set.

Threat detection in Microsoft Sentinel · documentation · Accessed 2026-09-21
Investigate Microsoft Sentinel incidents in the Azure portal · documentation · Accessed 2026-09-21
Microsoft Sentinel data connectors · documentation · Accessed 2026-09-21
Automate threat response in Microsoft Sentinel with automation rules · documentation · Accessed 2026-09-21
Hunting capabilities in Microsoft Sentinel · documentation · Accessed 2026-09-21
Discover and manage Microsoft Sentinel out-of-the-box content · documentation · Accessed 2026-09-21
Monitor data connector health · documentation · Accessed 2026-09-21
Monitor analytics rule integrity and execution · documentation · Accessed 2026-09-21
Configure data retention and archive · documentation · Accessed 2026-09-21

Splunk Enterprise Security · Splunk Enterprise Security 8 Essentials (SIEM/TDIR on Splunk Cloud Platform or Splunk Enterprise). Not Splunk Enterprise Security Premier (native SOAR, UEBA, Attack Analyzer), not Splunk Observability, and not standalone Splunk SOAR.

Captured Essentials feature pages describe detections and investigation capabilities. Full ES 8 operating and permission procedures did not fetch, so affected research stages remain unknown; broader Splunk-platform capabilities are not assumed.

Assessed 2026-09-21 · Research preview

Evaluated edition is Enterprise Security 8 Essentials, not Premier and not the full Splunk portfolio.
Product FAQ states Essentials includes SIEM, AI Assistant where available, and Detection Studio; Premier adds native SOAR, UEBA, and Automated Threat Analysis.
ES 8 terminology (findings, analyst queue, detections) replaces notables and incident review; older ES 7 docs on docs.splunk.com redirect to help.splunk.com and specific 7.3.2 topics returned 'does not exist'.
help.splunk.com deep articles did not return full bodies to web_fetch (Heretto portal error); several scores rest on search snippets plus marketing feature pages.
Adaptive Response is documented as a foundation before Splunk SOAR; it is not evidence that Essentials includes SOAR case management.
Cisco ownership does not establish shared entitlement with other Cisco products.
ES roles documentation warns that trusted authenticated users can reach certain core Splunk resources outside ES controls. Analyst queues organize work; they do not enforce data-access separation.

Operational maturity: 3.0 / 5.0 · medium confidence

Full ES 8 detection-authoring and queue procedures now establish findings, investigation context, ownership and status handling within the Essentials SIEM scope. This closes the initial operating-loop evidence gap at anchor 3. A complete scoped enrichment, related hunting and conditional incident-automation procedure is not established for anchor 4; Premier SOAR is excluded.

Shipped innovation: Unknown · low confidence

Feature pages and help snippets support risk correlation, finding aggregation and investigation as established SIEM workflows. This pass did not fully establish the normalization and retention conditions in the baseline anchor for the selected edition, so the stage remains unknown. No novel workflow is inferred from risk-based alerting or AI branding.

Splunk Enterprise Security product page · product · Accessed 2026-09-21
Splunk Enterprise Security Essentials features · product · Accessed 2026-09-21
Use detections to search for threats in Splunk Enterprise Security · documentation · Accessed 2026-09-21
Using entity risk scores for detections in Splunk Enterprise Security · documentation · Accessed 2026-09-21

Capability breadth: 3.0 / 5.0 · low confidence

Essentials documentation describes SIEM detections, dashboards (security posture, incident review, risk analysis), MITRE mapping, threat intelligence management, Detection Studio, and adaptive response. Hunting-style asset investigator and security-domain dashboards are listed on the features page. Stage 4 is not claimed for this edition: first-party plus third-party collection is assumed via the Splunk platform rather than an ES-specific connector catalog in the fetched pages, and UEBA is Premier.

Splunk Enterprise Security product page · product · Accessed 2026-09-21
Splunk Enterprise Security Essentials features · product · Accessed 2026-09-21

Ecosystem & integration: Unknown · low confidence

Stage 3 requires a connector or parser catalog and bundled content that pairs sources with detections. Fetched product and features pages and the docs.splunk.com landing do not provide that catalog; CIM documentation redirected and was not fetched. Third-party syslog/CEF/API ingest is implied by Splunk-platform marketing copy and is not treated as a fully supported stage-2 procedure. The gap is unknown, not stage 0.

Governance & control: 2.0 / 5.0 · medium confidence

The full roles table now establishes distinct read, analyst handling and administrative configuration roles. Queue membership is a workflow view, not a data-access boundary. Operator-audit coverage and scoped automation permissions are not fully established for anchor 3; the roles guide also warns of core-resource access outside ES controls.

Users and roles for Splunk Enterprise Security · documentation · Accessed 2026-09-21
Manage analyst workflows using the analyst queue in Splunk Enterprise Security · documentation · Accessed 2026-09-21

Operator enablement: Unknown · low confidence

Full detection-authoring and queue procedures now establish rule creation and triage. A complete current hunting procedure for the Essentials scope was not captured, so all conditions of anchor 3 remain unverified. Product feature lists do not fill that gap.

Splunk Enterprise Security Essentials features · product · Accessed 2026-09-21
Use detections to search for threats in Splunk Enterprise Security · documentation · Accessed 2026-09-21
Manage analyst workflows using the analyst queue in Splunk Enterprise Security · documentation · Accessed 2026-09-21

Google Security Operations SIEM · Google Security Operations Standard package, SIEM focus with included base SOAR; Pre-GA enhanced Cases excluded

Standard documents normalized ingestion, detection and search, and includes base SOAR. The legacy case workflow supports analyst assignment and event review; enhanced Pre-GA Cases is excluded. Package-wide permission boundaries remain an evidence gap.

Assessed 2026-09-21 · Research preview

Standard includes base SOAR; excluded or unverified workflows are evidence gaps, not claims of product absence.
Pre-GA enhanced Cases and composite detections are not evidence of generally available workflow stages.
Verify package entitlements and SIEM/SOAR access boundaries together; data RBAC on SIEM alone does not establish all case visibility rules.
Parser coverage and retention requirements need source-specific validation.

Operational maturity: 3.7 / 5.0 · medium confidence

Legacy case ownership, status and alert review establish stage 3. Current UDM hunting procedures add 0.3 and Standard-included conditional playbook handling adds 0.4. Incident enrichment beyond initial grouping is not established in this pass, so the score is 3.7. Enhanced Cases and Enterprise-only capabilities are excluded.

Detection rules overview · documentation · Accessed 2026-09-21
Google SecOps packages overview · documentation · Accessed 2026-09-21
Google SecOps legacy investigation and case management · documentation · Accessed 2026-09-21
Understand search · documentation · Accessed 2026-09-21
Playbook and automation overview · documentation · Accessed 2026-09-21

Shipped innovation: 3.0 / 5.0 · medium confidence

UDM normalization, rules, investigation/search, the included legacy case workflow and Standard retention establish the ordinary current SIEM baseline. This is not a novelty claim. Pre-GA composite detections and enhanced Cases are excluded.

UDM overview · documentation · Accessed 2026-09-21
Detection rules overview · documentation · Accessed 2026-09-21
Understand search · documentation · Accessed 2026-09-21
Google SecOps packages overview · documentation · Accessed 2026-09-21
Google SecOps legacy investigation and case management · documentation · Accessed 2026-09-21

Capability breadth: 4.0 / 5.0 · medium confidence

The Standard scope documents third-party ingestion, normalized UDM events across endpoint/network/identity domains, YARA-L detection, search, investigative entity context and threat-intelligence matching. Curated detections, UEBA and Gemini in higher packages do not support this score.

Google Security Operations SIEM platform overview · documentation · Accessed 2026-09-21
UDM overview · documentation · Accessed 2026-09-21
Detection rules overview · documentation · Accessed 2026-09-21
Google SecOps packages overview · documentation · Accessed 2026-09-21
Single and multiple event rules in YARA-L · documentation · Accessed 2026-09-21

Ecosystem & integration: Unknown · low confidence

Standard includes base SOAR and an integration catalog, and SIEM ingestion/parsers are documented. The current package table inconsistently lists a subset of curated rules while separately excluding Google Curated Detections for Standard. This review cannot establish the required scoped source-to-detection content pairing at anchor 3; the evidence gap remains unknown.

Google Security Operations SIEM platform overview · documentation · Accessed 2026-09-21
Google SecOps packages overview · documentation · Accessed 2026-09-21
Check data ingestion health · documentation · Accessed 2026-09-21

Governance & control: Unknown · low confidence

The data-RBAC guide explicitly warns that SIEM scopes do not automatically protect SOAR data and documents additional case/search exceptions. Feature IAM alone does not establish the complete Standard SIEM-plus-base-SOAR governance path; scoped role/audit mapping remains unverified. No cross-workflow control is inferred from SIEM RBAC.

Data RBAC impact on features overview · documentation · Accessed 2026-09-21
Configure feature access · documentation · Accessed 2026-09-21

Operator enablement: 3.0 / 5.0 · medium confidence

Rules, UDM search and investigation procedures support a documented authoring and analyst workflow. The captured evidence does not establish every lifecycle and dashboard condition for stage 4.

Detection rules overview · documentation · Accessed 2026-09-21
Understand search · documentation · Accessed 2026-09-21
Check data ingestion health · documentation · Accessed 2026-09-21
Single and multiple event rules in YARA-L · documentation · Accessed 2026-09-21

Not yet assessed

Unknown is explicitly not low quality. These catalog offerings have no Atlas Fold scores.

Elastic Security · Elastic
Falcon Next-Gen SIEM · CrowdStrike
Cortex XSIAM · Palo Alto Networks
Exabeam New-Scale / LogRhythm SIEM · Exabeam
Unified Defense SIEM · Securonix
IBM QRadar SIEM · IBM
OpenText Enterprise Security Manager · OpenText
FortiSIEM · Fortinet
SIEM (InsightIDR) · Rapid7
Logpoint SIEM · Logpoint
Graylog Security · Graylog
Wazuh · Wazuh Inc.

Research notes

Cohort siem-platforms compares SIEM platform offerings and named editions only. Managed detection and response, MSSP operating models, and SOAR-only products are out of cohort scope even when a vendor sells them alongside SIEM.

Anchors are documented-evidence stages, not observed product quality, efficacy, or completeness. Stage 0 is only for affirmative documented absence of the scoped capability. Missing public docs, failed fetches, gated docs, or preview/Pre-GA-only procedures are unknown (null), never zero.

Shipped innovation stage 3 is the ordinary current SIEM baseline: ingest with normalization, risk or correlation, investigation, incident or case handling, and retention. Stage 4 requires a genuinely different shipped operator workflow beyond that baseline. Preview, Pre-GA, edition-unavailable paths, AI branding, and unique-market-first claims are excluded from stage 4+. Undifferentiated ordinary SIEM work is scored 3 with no novelty claim, or null if the full baseline is not documented.

This edition researches Microsoft Sentinel, Splunk Enterprise Security and Google Security Operations. Other field-guide offerings remain unassessed. Coverage is a research sample, not evidence of market leadership.

ibm-qradar remains unassessed as the continuing IBM self-managed QRadar SIEM. Retired QRadar cloud / QRadar SaaS is not treated as a live cloud SIEM pilot. Palo Alto Networks acquisition of QRadar SaaS assets does not make Cortex XSIAM a scored substitute in this file.

Google SecOps Standard includes base SOAR. Reviewed legacy case procedures support the baseline case workflow; package-wide permissions and connector/content pairing remain gaps. Enhanced Cases is Pre-GA and excluded.

Scope limitation: Microsoft publishes both a Sentinel SIEM and a Sentinel 'platform' (data lake, graph, MCP). Conservative interpretation: score cloud SIEM incident/automation procedures; do not score MCP, Security Copilot, agentic defense, preview data-lake management, or Fusion (unavailable after Defender-portal onboarding) as innovation.

Detailed Splunk Enterprise Security 8 procedure pages were inaccessible during review. Product pages and available search excerpts support limited, low-confidence judgments; unsupported control and integration details remain unknown.

Confidence is at most medium because this is public-documentation research, not a lab or customer-tenant assessment. Splunk cells use low confidence because inference from snippets and product pages is material.

Rubric 1.1 adds evidence-backed tenths only for supported components of the next maturity anchor. The same criterion weights apply to every offering in this comparison group. Uncredited components are not established by this review, not proven absent. Innovation scores remain unchanged: ordinary baseline workflows do not earn decimal novelty credit.

All six dimensions were re-reviewed for the 2026-09-21 momentum baseline. Additional source-backed anchor and evidence-gap corrections are documented in docs/research/2026-09-21-momentum-baseline-b.md. These are baseline research corrections, not measured vendor progress; historical comparisons require later comparable review snapshots.

How to read these scores

Scores use tenths from 0.0 to 5.0 against published anchors. Fractional scores credit documented requirements toward the next anchor; the inspector exposes the calculation. Equal evidence can still produce a tie. Null means unknown and is never treated as zero. Views never average or blend dimensions into an overall winner. Cohort membership is the only comparison boundary.

What this edition covers.

First edition · reviewed 2026-09-21 · rubric 1.1. Historical movement will require later dated assessments; no trajectory is inferred from this snapshot.

Cohort siem-platforms compares SIEM platform offerings and named editions only. Managed detection and response, MSSP operating models, and SOAR-only products are out of cohort scope even when a vendor sells them alongside SIEM.
Anchors are documented-evidence stages, not observed product quality, efficacy, or completeness. Stage 0 is only for affirmative documented absence of the scoped capability. Missing public docs, failed fetches, gated docs, or preview/Pre-GA-only procedures are unknown (null), never zero.
Shipped innovation stage 3 is the ordinary current SIEM baseline: ingest with normalization, risk or correlation, investigation, incident or case handling, and retention. Stage 4 requires a genuinely different shipped operator workflow beyond that baseline. Preview, Pre-GA, edition-unavailable paths, AI branding, and unique-market-first claims are excluded from stage 4+. Undifferentiated ordinary SIEM work is scored 3 with no novelty claim, or null if the full baseline is not documented.
This edition researches Microsoft Sentinel, Splunk Enterprise Security and Google Security Operations. Other field-guide offerings remain unassessed. Coverage is a research sample, not evidence of market leadership.
ibm-qradar remains unassessed as the continuing IBM self-managed QRadar SIEM. Retired QRadar cloud / QRadar SaaS is not treated as a live cloud SIEM pilot. Palo Alto Networks acquisition of QRadar SaaS assets does not make Cortex XSIAM a scored substitute in this file.
Google SecOps Standard includes base SOAR. Reviewed legacy case procedures support the baseline case workflow; package-wide permissions and connector/content pairing remain gaps. Enhanced Cases is Pre-GA and excluded.
Scope limitation: Microsoft publishes both a Sentinel SIEM and a Sentinel 'platform' (data lake, graph, MCP). Conservative interpretation: score cloud SIEM incident/automation procedures; do not score MCP, Security Copilot, agentic defense, preview data-lake management, or Fusion (unavailable after Defender-portal onboarding) as innovation.
Detailed Splunk Enterprise Security 8 procedure pages were inaccessible during review. Product pages and available search excerpts support limited, low-confidence judgments; unsupported control and integration details remain unknown.
Confidence is at most medium because this is public-documentation research, not a lab or customer-tenant assessment. Splunk cells use low confidence because inference from snippets and product pages is material.
Rubric 1.1 adds evidence-backed tenths only for supported components of the next maturity anchor. The same criterion weights apply to every offering in this comparison group. Uncredited components are not established by this review, not proven absent. Innovation scores remain unchanged: ordinary baseline workflows do not earn decimal novelty credit.
All six dimensions were re-reviewed for the 2026-09-21 momentum baseline. Additional source-backed anchor and evidence-gap corrections are documented in docs/research/2026-09-21-momentum-baseline-b.md. These are baseline research corrections, not measured vendor progress; historical comparisons require later comparable review snapshots.

SIEM platforms

Comparable offerings and editions; exclude managed service comparisons.

Browse every product profile ↗Download research & sources ↓

SIEM, unfolded.

Security information & event management

Six dimensions, with gaps listed

Missing evidence for this view

Momentum

Documented scores

Unknowns and gaps

Scenario lens

Rationale and sources

How this score is built

Constraints

Sources

0–5 rubric anchors

Not yet assessed

What this edition covers.

SIEM platforms

Find your next idea.