IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index Security operations SIEM › Small business September 2026 Edition

SIEM platforms for small business buyers

Asked as “SIEM platform”, and as “security information and event management tool”, on behalf of a small B2B company. 46 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Contested
28% of first choices, contested.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Blumira28%0%45accepted challenger
02Microsoft Sentinel28%16%62accepted challenger
03Wazuh17%22%49accepted challenger
04Sumo Logic7%7%15accepted challenger
05Elastic Security4%16%32accepted challenger
06Huntress Managed SIEM4%0%16accepted challenger
07ManageEngine Log3604%0%15accepted challenger
08Huntress2%0%10accepted challenger
Show the six products at 0%, ordered by negative rate
12Splunk Enterprise Security0%100%10criticized challenger
14IBM QRadar0%95%20criticized challenger
13Splunk0%71%34criticized challenger
11Graylog0%33%12criticized challenger
10Datadog Cloud SIEM0%14%14accepted challenger
09Rapid7 InsightIDR0%9%11accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
13
14
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Blumira28%
02Microsoft Sentinel28%
03Wazuh17%
04Sumo Logic7%
05Elastic Security4%
06Huntress Managed SIEM4%
07ManageEngine Log3604%
08Huntress2%
09Rapid7 InsightIDR0%
10Datadog Cloud SIEM0%
11Graylog0%
12Splunk Enterprise Security0%
13Splunk0%
14IBM QRadar0%

02What they warned about

Three of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash, Perplexity Sonar, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
IBM QRadar
95%
19 of 20 labels negative · 11 of 12 models · 11 hard negative
“**Why to Avoid:** These are massive, hardware-heavy systems designed for global compliance and threat hunting at scale.” Qwen 3.7 Flash, negative prompt
Splunk
71%
24 of 34 labels negative · 10 of 12 models · 10 hard negative
“small businesses should avoid or exercise extreme caution with the following platforms... Splunk is highly regarded, but it is notoriously expensive.” Gemini 3.5 Flash, negative prompt
Wazuh
22%
11 of 49 labels negative · 8 of 12 models · 1 hard negative
“Wazuh has limited automation/ML, basic correlation, and no automated response” DeepSeek V4 Flash, negative prompt
Microsoft Sentinel
16%
10 of 62 labels negative · 8 of 12 models
“cost-effective **only if you are already heavily invested in Microsoft 365/Azure**, but ... consumption-based pricing can become expensive” Perplexity Sonar, budget prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

61 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 824 links across 163 sites, every framing counted. Ranked by the number of answers carrying the site or page.

33 answers · 37 citations · 9 models
32 answers · 58 citations · 8 models
29 answers · 39 citations · 8 models
26 answers · 26 citations · 10 models
22 answers · 22 citations · 9 models
21 answers · 26 citations · 10 models
20 answers · 22 citations · 8 models
vendor site · UnderDefense19 answers · 24 citations · 8 models
vendor site · Palo Alto Networks15 answers · 15 citations · 6 models
14 answers · 15 citations · 7 models
14 answers · 14 citations · 6 models
vendor site · Blumira13 answers · 26 citations · 5 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best SIEM platform for a small B2B company?”Paraphrase“Which security information and event management tool would you recommend to a small business that sells to other businesses?”Comparative“What are the top SIEM platforms for a small team and how do they differ?”Budget-constrained“What is the best SIEM platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a SIEM platform. What should we look at?”Negative“Which SIEM platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5Sumo Logic
Two alternativesDatadog Cloud SIEM, Huntress
LogmanagerChanged
Two alternativesNetsurion, Sumo Logic
against: Wazuh
Rapid7 InsightIDR
Two alternativesElastic Security, Microsoft Sentinel
Microsoft Sentinel
Two alternativesGraylog, Wazuh
against: Splunk
no first choiceagainst: IBM QRadar, LogRhythm, Wazuh
GPT-5.4 miniMicrosoft Sentinel
Three alternativesElastic Security, Splunk, Sumo Logic
Microsoft SentinelHeld
Four alternativesCrowdStrike Falcon Complete, CrowdStrike Falcon LogScale, Google Security Operations, Splunk
against: Wazuh
Microsoft Sentinel
One alternativeElastic Security
against: Splunk Enterprise Security
Elastic Security, Microsoft Sentinelagainst: CrowdStrike Falcon Next-Gen SIEMno first choiceagainst: CrowdStrike Falcon Next-Gen SIEM, Datadog Cloud SIEM, Google Security Operations, IBM QRadar, Microsoft Sentinel, Splunk Enterprise Security
Gemini 3.5 FlashBlumira
Three alternativesHuntress Managed SIEM, Microsoft Sentinel, Wazuh
against: Splunk
Huntress Managed SIEMChanged
Three alternativesBlumira, Microsoft Sentinel, Wazuh
against: Elastic Security, Splunk
Blumira, Huntress Managed SIEM
Three alternativesMicrosoft Sentinel, Stellar Cyber, Wazuh
against: IBM QRadar, Splunk
Wazuh
Three alternativesBlumira, ManageEngine Log360, Microsoft Sentinel
against: IBM QRadar, Splunk
Huntress Managed SIEM / MDR
Three alternativesBlackpoint Cyber, Blumira, Red Canary
against: Microsoft Sentinel, Splunk
against: AWS Security Lake / OpenSearch architectures, ELK Stack, IBM QRadar, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Self-Hosted Wazuh or Graylog, Splunk
Perplexity SonarBlumira, Microsoft Sentinel
Four alternativesDatadog Cloud SIEM, Elastic Security, Huntress, Wazuh
BlumiraChanged
Two alternativesHuntress Managed SIEM, Microsoft Sentinel
Blumira, Microsoft Sentinel
Four alternativesElastic Security, Huntress Managed SIEM, Rapid7 InsightIDR, Wazuh
Blumira, Wazuh
One alternativeManageEngine Log360
against: Microsoft Sentinel
no first choiceagainst: Darktrace, ExtraHop, IBM QRadar, IronNet, LogRhythm, Microsoft Sentinel, Splunk Enterprise Security, Vectra AI, Wazuh
Grok 4.1 FastBlumira
Four alternativesHuntress, ManageEngine Log360, Microsoft Sentinel, Wazuh
against: IBM QRadar, Splunk
BlumiraHeld
Two alternativesManageEngine Log360, Microsoft Sentinel
against: Wazuh
Blumira, Rapid7 InsightIDR
Three alternativesElastic Security, Microsoft Sentinel, Wazuh
Wazuh
Four alternativesBlumira, Fluency SIEM, ManageEngine Log360, Microsoft Sentinel
against: Rapid7, Splunk
no first choiceagainst: Darktrace, ExtraHop, IBM QRadar, IronNet, Splunk Enterprise Security, Vectra AI
Mistral SmallBlumira
One alternativeWazuh
against: Splunk
Microsoft Sentinel, Sumo LogicChanged
Three alternativesBlumira, Elastic Security, Wazuh
Elastic Security, Microsoft Sentinel
One alternativeWazuh
against: Splunk Enterprise Security
Microsoft Sentinel, Wazuh
One alternativeBlumira
against: Elastic Security
no first choiceagainst: IBM QRadar, Palo Alto Networks Cortex XDR, Splunkagainst: Elastic Stack, Graylog, IBM QRadar, OpenSearch, Securonix, Splunk Enterprise Security, Sumo Logic, Wazuh
DeepSeek V4 FlashBlumira
Three alternativesManageEngine Log360, Microsoft Sentinel, Wazuh
against: CrowdStrike Falcon Next-Gen SIEM, Elastic Security, IBM QRadar, Splunk
Blumira, Huntress Managed SIEMChanged
Two alternativesManageEngine Log360, Microsoft Sentinel
against: Wazuh
Blumira
Three alternativesElastic Security, Microsoft Sentinel, Wazuh
against: Splunk Enterprise Security
Wazuh
Three alternativesBlumira, Elastic Security, Microsoft Sentinel
against: IBM QRadar, Splunk
no first choice
Six alternativesBlumira, Elastic Security, Fluency, ManageEngine Log360, Sumo Logic, Wazuh
against: Microsoft Sentinel
against: AT&T AlienVault, Elastic Stack, Graylog, IBM QRadar, LogRhythm, OpenSearch, OpenText ArcSight, Splunk, Wazuh
Llama 4 Maverickno first choiceManageEngine Log360Changed
Two alternativesSolarWinds Security Event Manager, Wazuh
Blumira
Four alternativesElastic Security, Huntress Managed SIEM, Microsoft Sentinel, Splunk
Sumo Logic
Three alternativesElastic Security, ManageEngine Log360, Microsoft Sentinel
no first choiceagainst: Darktrace, ExtraHop, IronNet, Microsoft Sentinel, Splunk, Vectra AI
Qwen 3.7 FlashMicrosoft Sentinel
Three alternativesDatadog Cloud SIEM, ManageEngine SecurityManager Plus, Wazuh
against: IBM QRadar, Splunk
Microsoft SentinelHeld
Three alternativesGraylog, ManageEngine Log360, Wazuh
Blumira, Huntress
Three alternativesDatadog Cloud SIEM, Hunters, Microsoft Sentinel
against: Wazuh
Wazuh
Three alternativesBlumira, Fluency SIEM, Microsoft Sentinel
Huntress
Six alternativesCrowdStrike Falcon, Microsoft Defender, Microsoft Defender for Cloud, Microsoft Sentinel, SentinelOne, Wazuh
against: Elastic Security, Oracle Sentinel, Splunk
against: ELK Stack, IBM QRadar, McAfee ePO, Microsoft Sentinel, OpenText ArcSight, Splunk, Trend Micro Deep Security, Wazuh
Kimi K2Blumira, Microsoft Sentinel
Three alternativesHuntress Managed SIEM, ManageEngine Log360, Sumo Logic
against: Splunk
BlumiraChanged
One alternativeHuntress Managed SIEM
Rapid7 InsightIDR
Five alternativesBlumira, Datadog Cloud SIEM, Elastic Security, Microsoft Sentinel, Wazuh
Wazuh
Five alternativesBlumira, Elastic Security, Fluency SIEM, Microsoft Sentinel, Security Onion
no first choice
Four alternativesBlumira, Microsoft Sentinel, Rapid7 InsightIDR, Sumo Logic
against: IBM QRadar, OpenText ArcSight, Splunk
against: ELK Stack, Graylog, IBM QRadar, Microsoft Sentinel, OpenSearch, Splunk, Wazuh
GLM 4.7 FlashXBlumira
Four alternativesElastic Security, Huntress Managed SIEM, Microsoft Sentinel, Wazuh
Microsoft SentinelChanged
One alternativeBlumira
against: Splunk
Microsoft Sentinel
Eight alternativesBlumira, Datadog Cloud SIEM, Elastic Security, Huntress Managed SIEM, LogRhythm, Rapid7 InsightIDR, Sumo Logic, Wazuh
against: Splunk Enterprise Security
Microsoft Sentinel
Two alternativesBlumira, Wazuh
against: ELK Stack, Graylog
no first choiceagainst: AlienVault (formerly Open Threat Exchange) / AT&T Cybersecurity, Datadog Cloud SIEM, Exabeam & LogRhythm, IBM QRadar, Microsoft Sentinel, Rapid7 InsightIDR, Splunk Enterprise Security
MiniMax M2.5Blumira, Microsoft Sentinel
Three alternativesGraylog, Huntress Managed SIEM, SolarWinds Security Event Manager
ManageEngine Log360Changed
One alternativeMicrosoft Sentinel
against: Splunk Enterprise Security
Wazuh
Five alternativesBlumira, Elastic Security, Huntress Managed SIEM, Microsoft Sentinel, Rapid7 InsightIDR
Elastic Security, Wazuh
Two alternativesGraylog, Sumo Logic
no first choiceagainst: Darktrace, Elastic Security, ExtraHop, IBM QRadar, IronNet, LogRhythm, Securonix, Splunk, Vectra AI
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:19yes97 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:54yes54 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 08:16yes2224 s
Direct recommendationPerplexity Sonarsonar2026-09-17 09:09yes205 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 08:57yes4218 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 08:21yes55 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 09:05yes1719 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 08:29yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 08:37no051 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 08:57yes720 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:02yes3161 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 08:42yes847 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:25yes159 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:44no03 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:04yes1628 s
ParaphrasePerplexity Sonarsonar2026-09-17 08:50yes205 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 08:34yes3515 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 08:19yes56 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 08:52yes1818 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 08:51yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 08:42no059 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:03yes2027 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:22yes28189 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 09:07yes1547 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:17yes1810 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:27yes37 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 08:59yes1727 s
ComparativePerplexity Sonarsonar2026-09-17 08:18yes207 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:07yes2813 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 09:04yes57 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 08:25yes1822 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 08:28yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 08:43yes550 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:10yes947 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:25yes841 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 08:38yes1437 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:55no05 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:22yes45 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:02yes1926 s
Budget constrainedPerplexity Sonarsonar2026-09-17 08:55yes206 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:08yes4518 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 09:04yes54 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 08:43yes1917 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 08:18yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 08:59yes1553 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 08:59yes1026 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:26yes29126 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 08:51yes522 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:16no07 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 08:26no07 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 08:55yes721 s
Scale constrainedPerplexity Sonarsonar2026-09-17 08:39yes2013 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 08:50yes1810 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 09:08no011 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 08:32yes1419 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:04yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:03no043 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 08:42yes1476 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:54no011 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 09:03no013 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 08:56yes1410 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:01yes26 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 08:44yes1524 s
Negative framingPerplexity Sonarsonar2026-09-17 08:25yes208 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 08:33yes3415 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 08:44yes118 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 08:45yes2824 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 08:55yes54 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:03no040 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 08:17yes1025 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 08:39yes1658 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 08:56yes1331 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
ArcSight read as OpenText ArcSight
Cortex XSIAM read as Palo Alto Networks Cortex XSIAM
Datadog read as Datadog Cloud SIEM
Datadog Security read as Datadog Cloud SIEM
Elastic read as Elastic Security
Elastic Cloud read as Elastic Security
Google Chronicle read as Google Security Operations
Google SecOps / Chronicle read as Google Security Operations
Vectra read as Vectra AI
Unresolved, counted raw
AT&T AlienVault (USM Anywhere / OSSIM)
AWS Security Lake / OpenSearch architectures
AlienVault (formerly Open Threat Exchange) / AT&T Cybersecurity
Huntress Managed SIEM / MDR
ManageEngine SecurityManager Plus
McAfee ePO
Netsurion
Oracle Sentinel
Panther
Perch
Self-Hosted Wazuh or Graylog
Trend Micro Deep Security
Discontinued, still offered
No shut-down product was recommended here.
← Awareness trainingSOAR →