SIEM
Central log analytics for threat detection.
Overview
SIEM aggregates logs and telemetry to correlate events, drive detections, and support investigation and compliance reporting. It is the analytical core of most SOCs. Cost is dominated by data ingest/retention volume and can vary enormously. Open-source stacks are viable for cost-sensitive or hands-on teams.
Central visibility needed once foundational controls are in place.
Advantages
- Splunk powerful and flexible search
- Sentinel cloud-native and Microsoft-integrated
- Elastic/Wazuh/Graylog free
- the analytical core of a SOC.
Trade-offs
- Ingest-based pricing is brutal at scale (Splunk)
- tuning and detection engineering are heavy
- OSS is a big ops lift
- storage costs.
Open-source option
Wazuh, Security Onion, and Graylog are all genuinely production-capable, actively-maintained self-hostable SIEM/log-analytics platforms — this area already had strong OSS coverage even though the field was previously unset.
Vendors & tools in this area
Google's cloud-native SIEM (formerly Chronicle), with native Mandiant threat-intel integration.
Visit site →Cloud-native, detection-as-code SIEM built on the customer's own data lake; acquired by Databricks in 2026 to anchor its 'security lakehouse' push.
Visit site →