The job to be done
Reconstruct a suspicious sequence across identity, endpoints, applications, and cloud activity.
Security information and event management brings security records together so analysts can search history, correlate activity and investigate alerts. Start with a question, such as whether an unusual sign-in led to privileged access, then identify the events needed to answer it. Collection alone does not establish detection coverage. A working SIEM needs reliable parsing, useful rules, people who investigate results and a retention plan. Cloud services, self-managed systems and integrated security platforms distribute those responsibilities differently.
What goes in
- Authentication and audit logs
- Endpoint and network events
- Asset, identity, and business context
What should come out
- Detections and investigation timelines
- Searchable evidence and saved queries
- Cases and escalation to response workflows
Inside the segment
These capabilities answer different questions. Use the distinction to define the work before assembling a shortlist.
Cloud SIEM
Use a provider-operated analytics service with connected local and cloud sources.
Boundary: Collectors, source permissions, detection ownership and retention choices still require customer attention.
Self-managed SIEM
Run collection, storage and analytics in infrastructure controlled by your organization.
Boundary: Upgrades, capacity, backup and resilience become part of the operating plan.
Behavior analytics
Build entity context to investigate unusual user or asset behavior.
Boundary: Unusual activity is a lead for investigation, not proof of malicious intent.
Converged platforms
Combine SIEM with adjacent detection and response capabilities in one portfolio.
Boundary: Check actual editions and integrations rather than assuming every advertised module is included.
How the work flows
Choose a question
Define a concrete investigation and the people responsible for answering it.
Collect and normalize
Connect approved sources, check timestamps and map fields needed by the investigation.
Build a detection
Write or adapt a rule, document its assumptions and test benign events that resemble the trigger.
Investigate a case
Use source records and asset context to explain the alert and record uncertainty.
Retain and improve
Preserve evidence, measure noise and update rules when systems or business processes change.
The environment changes the question
Use these scenarios to adapt the evaluation to your organization. They describe operational concerns, not a determination of compliance.
Finance ↗
Investigate a synthetic privileged sign-in followed by access to a fictional payment administration system.
Evaluate: Preserve who approved access and which actions occurred without copying real customer records into the exercise.
Utilities ↗
Trace a simulated remote maintenance session crossing the boundary between business systems and an operations support host.
Evaluate: Coordinate response decisions with operations staff and keep safety systems outside automatic containment.
Manufacturing ↗
Follow a fictional supplier account accessing a test engineering workstation before a scheduled production change.
Evaluate: Check support dependencies, maintenance windows and the operational effect of disabling the account or host.
Healthcare ↗
Investigate synthetic access to a training clinical application from an unusual workstation.
Evaluate: Use fabricated patient data and involve clinical operations before testing disruptive response actions.
What drives the operating cost
- Ingested data volume, filtering decisions and the way the provider measures consumption.
- Retention tiers, archive retrieval and query compute across expected investigation windows.
- Collectors, infrastructure, detection engineering, migration work and ongoing analyst effort.
- Optional analytics, automation and endpoint modules plus support and training.
Questions worth asking
- Can the required sources arrive on time, with usable identity and timestamps?
- What is the full cost of ingestion, retention, search, and supporting infrastructure?
- Can an analyst reproduce a conclusion and export the evidence?
Common assumptions to check
More collected logs always mean better security.
Collection helps only when the records support investigation, detection or evidence needs and remain understandable.
A SIEM is the security operations center.
The SIEM is a tool; the operations center also needs people, responsibilities and response procedures.
APPLY THE IDEA / EVALUATION PLAN
Make the outcome observable.
Send a known benign sign-in sequence and a synthetic suspicious sequence. Measure ingestion delay, field quality, rule behavior, and analyst effort.
Replay fabricated records
Show that source timestamps, user identities and expected event fields survive normalization.
Test a documented rule
Capture the triggering events, alert, analyst decision and an intentionally benign comparison.
Exercise loss and recovery
Pause a lab source, demonstrate health monitoring, restore it and account for missing events.
Verify an exit path
Export a sample case and retained records into documented formats another analyst can inspect.
Use synthetic data and an authorized test environment. Record scope, product edition, permissions, results, and recovery behavior.
Vendors & products
15 profilesAn editorial selection of relevant offerings, with documented scope and practical evaluation questions. Atlas Fold provides a separate provisional documentation assessment for selected offerings; inclusion in this directory is not a ranking.
Microsoft / Cloud SIEM
Microsoft Sentinel
This profile covers Sentinel analytics and investigation. Data tiers, automation and adjacent Microsoft security products have their own configuration and commercial boundaries; a Microsoft environment alone does not establish that every source or feature is included.
Cisco / SIEM and security analytics
Splunk Enterprise Security
This is the Enterprise Security offering, not every Splunk observability or automation product. Essentials and Premier packaging differ; confirm which analytics, case management and response capabilities belong to the proposed edition.
Google / Alphabet / Cloud SIEM
Google Security Operations SIEM
This profile covers the SIEM portion of Google Security Operations, formerly associated with the Chronicle name. SOAR and other suite capabilities need their own scope and entitlement checks; a connector listing does not guarantee complete parsing for every source version.
Elastic / SIEM and search analytics
Elastic Security
This page covers the SIEM use case, with Elastic Defend covered separately as an endpoint offering. Cloud and self-managed deployments divide infrastructure responsibilities differently, and advanced security capabilities vary by subscription.
CrowdStrike / Cloud SIEM and platform analytics
Falcon Next-Gen SIEM
This profile concerns the SIEM offering, not the full Falcon endpoint or managed-service portfolio. Third-party parsing, retention and automation need explicit validation; buying a platform does not automatically license all of its modules.
Palo Alto Networks / Converged SIEM and security operations
Cortex XSIAM
The product crosses SIEM, XDR and automation categories. This profile does not imply that every Cortex component is included or that all existing tools can be replaced; migration and module scope depend on the actual agreement and deployment.
Exabeam / Cloud and self-hosted SIEM portfolio
Exabeam New-Scale / LogRhythm SIEM
This portfolio page deliberately distinguishes the offerings rather than treating their names as interchangeable editions of one installation. Merger history does not prove that integrations, licenses or migration paths are identical.
Securonix / Cloud SIEM and behavior analytics
Unified Defense SIEM
This page covers the SIEM offering and its investigation context. Automation, threat intelligence and AI-assisted capabilities should be evaluated within the proposed package; advertised assistance is not evidence that an autonomous decision is correct.
IBM / Self-managed SIEM
IBM QRadar SIEM
Do not confuse this product with the acquired QRadar SaaS portfolio. Analytics extensions and other IBM capabilities have separate compatibility and entitlement requirements; an offense still needs investigation before it supports a response decision.
OpenText / Enterprise SIEM and correlation
OpenText Enterprise Security Manager
This profile covers Enterprise Security Manager. Log analytics, automation and other OpenText security products should be scoped separately; a familiar portfolio name does not establish which components or licenses are part of a deployment.
Fortinet / SIEM with asset and operations context
FortiSIEM
This page covers FortiSIEM rather than the full Fortinet portfolio. Deployment models and behavior analytics or response features require edition checks. An IT/OT use case does not authorize active discovery or containment on operational equipment.
Rapid7 / Cloud SIEM and detection
SIEM (InsightIDR)
This profile covers the product, not Rapid7’s managed detection and response service. Collectors, agents, automation and adjacent capabilities need explicit scope checks; a software deployment does not by itself provide around-the-clock analyst coverage.
Guardsix / SIEM and normalized analytics
Guardsix SIEM
This profile covers SIEM. Cloud and on-premises choices, automation and neighboring capabilities must be confirmed in the proposal. A regional vendor presence does not establish the location or regulatory approval of a specific hosted deployment.
Graylog / Security analytics over log management
Graylog Security
This page covers Graylog Security. Open-source log management availability does not make every security feature free; rule formats, supported content and advanced capabilities should be checked against the selected release and entitlement.
Wazuh Inc. / Open-source security monitoring
Wazuh
This profile covers the Wazuh platform rather than a guarantee of equivalent coverage to every commercial SIEM. Self-managed deployments require infrastructure and maintenance; managed cloud services have separate terms. Open-source licensing does not remove operating costs.