SIEM platforms
Asked as “SIEM platform”, and as “security information and event management tool”, on behalf of a mid-market B2B company. 52 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
38%
Contested · Wazuh 21%
38Microsoft Sentinel21Wazuh17Rapid7 InsightIDR23others
38% of first choices, contested.
Since September 2026▼−2Since September 2026: 41% → 39%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Microsoft Sentinel held the lead, −2 points on 41%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Blumira34%Contested▲+6Since September 2026: 28% → 35%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Mid-market
Microsoft Sentinel38%Contested▼−2Since September 2026: 41% → 39%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageEnterpriseMicrosoft Sentinel41%Clear leader▲+12Since September 2026: 30% → 42%, +12 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →
Blumira34%Contested▲+6Since September 2026: 28% → 35%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →Mid-marketMicrosoft Sentinel38%Contested▼−2Since September 2026: 41% → 39%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageEnterpriseMicrosoft Sentinel41%Clear leader▲+12Since September 2026: 30% → 42%, +12 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Microsoft Sentinel38%13%62endorsed leader▼−2Since September 2026: 41% → 39%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.41% → 39%
Microsoft Sentinel38%13%62endorsed leader▼−2Since September 2026: 41% → 39%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.41% → 39%02
Wazuh21%24%21accepted challenger▲+2Since September 2026: 18% → 20%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.18% → 20%
Wazuh21%24%21accepted challenger▲+2Since September 2026: 18% → 20%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.18% → 20%03
Rapid7 InsightIDR17%6%34accepted challenger▼−7Since September 2026: 22% → 16%, −7 points. Inside the 11-point floor: within noise. Read over the models both editions asked.22% → 16%
Rapid7 InsightIDR17%6%34accepted challenger▼−7Since September 2026: 22% → 16%, −7 points. Inside the 11-point floor: within noise. Read over the models both editions asked.22% → 16%04
Elastic Security4%8%38accepted challenger▼−2Since September 2026: 6% → 5%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.6% → 5%
Elastic Security4%8%38accepted challenger▼−2Since September 2026: 6% → 5%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.6% → 5%05
ManageEngine Log3604%0%16accepted challenger=heldSince September 2026: 4% → 5%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 5%
ManageEngine Log3604%0%16accepted challenger=heldSince September 2026: 4% → 5%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 5%06
Sumo Logic Cloud SIEM4%6%16accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%
Sumo Logic Cloud SIEM4%6%16accepted challenger▲+2Since September 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 2%07
LogRhythm2%42%24criticized challenger=heldSince September 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%
LogRhythm2%42%24criticized challenger=heldSince September 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.2% → 2%Show the eight products at 0%, ordered by negative rate
14
Splunk Enterprise Security0%49%55criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Splunk Enterprise Security0%49%55criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%15
Securonix Unified Defense SIEM0%47%15criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Securonix Unified Defense SIEM0%47%15criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%13
IBM QRadar0%45%31criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
IBM QRadar0%45%31criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%12
Graylog0%27%11criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Graylog0%27%11criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%11
Palo Alto Networks Cortex XSIAM0%8%12accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Palo Alto Networks Cortex XSIAM0%8%12accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%10
CrowdStrike Falcon Next-Gen SIEM0%8%13accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
CrowdStrike Falcon Next-Gen SIEM0%8%13accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%08
Exabeam0%4%24accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Exabeam0%4%24accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%09
Google Security Operations Lab in the set0%0%17accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Google Security Operations Lab in the set0%0%17accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Google Security Operations is made by Google, whose model Gemini 3.5 Flash is in the set. On the four share prompts that model made it the first choice zero times of 4; the other thirteen models zero times of 52. Lab treatment is defined on the method page; the row is marked, not excluded.
Head to head
All twenty-one head-to-head pages: the top seven products, each against each
Microsoft Sentinel vs ManageEngine Log360Microsoft Sentinel vs Sumo Logic Cloud SIEMMicrosoft Sentinel vs LogRhythmWazuh vs Rapid7 InsightIDRWazuh vs Elastic SecurityWazuh vs ManageEngine Log360Wazuh vs Sumo Logic Cloud SIEMWazuh vs LogRhythmRapid7 InsightIDR vs Elastic SecurityRapid7 InsightIDR vs ManageEngine Log360Rapid7 InsightIDR vs Sumo Logic Cloud SIEMRapid7 InsightIDR vs LogRhythmElastic Security vs ManageEngine Log360Elastic Security vs Sumo Logic Cloud SIEMElastic Security vs LogRhythmManageEngine Log360 vs Sumo Logic Cloud SIEMManageEngine Log360 vs LogRhythmSumo Logic Cloud SIEM vs LogRhythm
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
010203040506070809101112131415Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Microsoft Sentinel38%
Microsoft Sentinel38%02Wazuh21%
Wazuh21%03Rapid7 InsightIDR17%
Rapid7 InsightIDR17%04Elastic Security4%
Elastic Security4%05ManageEngine Log3604%
ManageEngine Log3604%06Sumo Logic Cloud SIEM4%
Sumo Logic Cloud SIEM4%07LogRhythm2%
LogRhythm2%08Exabeam0%
Exabeam0%09Google Security Operations0%
Google Security Operations0%10CrowdStrike Falcon Next-Gen SIEM0%
CrowdStrike Falcon Next-Gen SIEM0%11Palo Alto Networks Cortex XSIAM0%
Palo Alto Networks Cortex XSIAM0%12Graylog0%
Graylog0%13IBM QRadar0%
IBM QRadar0%14Splunk Enterprise Security0%
Splunk Enterprise Security0%15Securonix Unified Defense SIEM0%
Securonix Unified Defense SIEM0%What they warned about
Five of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, Gemini 3.5 Flash, Perplexity Sonar, Mistral Small, DeepSeek V4 Flash, Qwen 3.7 Flash, Kimi K2, MiniMax M2.5 and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Splunk Enterprise Security49%
27 of 55 labels negative · 13 of 14 models · 3 hard negative
“A Note on Avoiding: While Splunk is the industry leader, it is often the wrong choice for mid-sized companies due to licensing complexity.” Qwen 3.7 Flash, paraphrase prompt
IBM QRadar45%
14 of 31 labels negative · 12 of 14 models · 5 hard negative
“The *specific* platforms most flagged for poor execution are **Securonix**, **ArcSight** (for new builds), and **QRadar** (due to cost/complexity).” DeepSeek V4 Flash, negative prompt
LogRhythm42%
10 of 24 labels negative · 10 of 14 models · 6 hard negative
“Another platform that users advise staying away from, citing concerns about both performance and usability.” Mistral Small, negative prompt
Securonix Unified Defense SIEM47%
7 of 15 labels negative · 7 of 14 models · 6 hard negative
“Frequently called out as one of the worst in user forums... Delivery and reliability issues make it a "deal killer" for many.” Grok 4.1 Fast, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
76 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 944 links across 219 sites, every framing counted. Ranked by the number of answers carrying the site or page. 13 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Exabeam34 answers · 47 citations · 12 models
vendor site · UnderDefense34 answers · 47 citations · 11 models
vendor site · Palo Alto Networks31 answers · 34 citations · 9 models
vendor site · ManageEngine26 answers · 29 citations · 8 models
19 answers · 28 citations · 10 models
19 answers · 20 citations · 10 models
vendor site · Kaseya18 answers · 18 citations · 6 models
vendor site · SentinelOne17 answers · 30 citations · 9 models
17 answers · 20 citations · 9 models
17 answers · 17 citations · 7 models
16 answers · 16 citations · 7 models
15 answers · 41 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
30 answers · 11 models
28 answers · 8 models
20 answers · 7 models
19 answers · 10 models
18 answers · 10 models
18 answers · 9 models
18 answers · 6 models
16 answers · 7 models
14 answers · 8 models
14 answers · 7 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best siem platform”, “siem platform”, “siem platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days |
|---|---|---|---|---|---|---|---|
| Microsoft parent site Microsoft Sentinel 38% | 38% | 359 | 2,240,000 | 403,136 | |||
| Wazuh wazuh.com | 21% | 124 | 9,900 | 446 | 7,214 | 3 | |
| Rapid7 parent site Rapid7 InsightIDR 17% | 17% | 115 | 14,800 | 798 | |||
| Elastic elastic.co Elastic Security 4% | 4% | 126 | 74,000 | 34,672 | 208,306 company | 105 | |
| ManageEngine parent site ManageEngine Log360 4% | 4% | 98 | 8,100 | 675 | |||
| Sumo Logic Cloud SIEM sumologic.com | 4% | 38 | 40 | 1 | 82,749 | $4,123 | 55 |
| Blumira blumira.com | 4% | 110 | 1,300 | 12 | 8,060 | 10 | |
| Logpoint logpoint.com | 2% | 10 | |||||
| SolarWinds parent site SolarWinds Security Event Manager 2% | 2% | 28 | 14,800 | 1,396 | |||
| Arctic Wolf arcticwolf.com | 2% | 40 | 49,500 | 1,342 | 40,780 | 56 |
Google's top ten for the three searches hold 21 sites; 5 of them are among the sites the models cited here (exabeam.com, manageengine.com, reddit.com, sentinelone.com, underdefense.com). The first result for “best siem platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best SIEM platform for a mid-market B2B company?”Paraphrase“Which security information and event management tool would you recommend to a mid-sized B2B company?”Comparative“What are the top SIEM platforms and how do they differ?”Budget-constrained“What is the best SIEM platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a SIEM platform. What should we look at?”Negative“Which SIEM platforms should I avoid or be cautious about?”
Claude Haiku 4.5Rapid7 InsightIDRMicrosoft Sentinel, Sumo Logic Cloud SIEMChangedagainst: IBM QRadarMicrosoft SentinelWazuhno first choiceagainst: Logpoint, Splunk Enterprise Security
Three alternatives
LogRhythm, ManageEngine Log360, Microsoft SentinelSix alternatives
CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Exabeam, FortiSIEM, Rapid7 InsightIDR, Splunk Enterprise SecurityFive alternatives
Elastic Security, ManageEngine Log360, Security Onion, SolarWinds Security Event Manager, Sumo Logic Cloud SIEMGPT-5.4 miniMicrosoft Sentinelagainst: IBM QRadarMicrosoft SentinelHeldMicrosoft Sentinel, Splunk Enterprise SecurityElastic Security, Microsoft Sentinelagainst: Splunk Enterprise Securityno first choiceagainst: Microsoft Sentinel, Splunk Enterprise Security
Two alternatives
Google Security Operations, Splunk Enterprise SecurityOne alternative
IBM QRadarFour alternatives
CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, IBM QRadar, Palo Alto Networks Cortex XSIAMGemini 3.5 FlashBlumiraagainst: Splunk Enterprise SecurityRapid7 InsightIDRChangedMicrosoft Sentinel, Splunk Enterprise SecurityBlumira, WazuhArctic Wolfagainst: IBM QRadar, Microsoft Sentinel, Splunk Enterprise Securityagainst: Elastic Security, IBM QRadar, LogRhythm, Micro Focus ArcSight, Microsoft Sentinel, Security Onion, Splunk Enterprise Security, Wazuh
Three alternatives
Huntress Managed SIEM, Microsoft Sentinel, Rapid7 InsightIDRFour alternatives
Blumira, CrowdStrike Falcon Next-Gen SIEM, Datadog Cloud SIEM, Microsoft SentinelThree alternatives
CrowdStrike Falcon Next-Gen SIEM, Google Security Operations, Palo Alto Networks Cortex XSIAMFour alternatives
Graylog Security, LimaCharlie, Microsoft Sentinel, Security OnionFour alternatives
Blumira, Expel, Huntress Managed SIEM, Rapid7 InsightIDRPerplexity SonarRapid7 InsightIDRManageEngine Log360Changedno first choiceMicrosoft Sentinel, Wazuhno first choiceagainst: CrowdStrike Falcon Next-Gen SIEM, Exabeam, IBM QRadar, LogRhythm, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Rapid7 InsightIDR, Securonix Unified Defense SIEM, SentinelOne, SolarWinds Security Event Manager, Splunk Enterprise Security, Sumo Logic Cloud SIEM
Three alternatives
LogRhythm, ManageEngine Log360, Stellar Cyber Next-Gen SIEMOne alternative
SentinelOne Singularity AI SIEMTwo alternatives
Elastic Security, SolarWinds Security Event ManagerGrok 4.1 FastMicrosoft Sentinelagainst: Splunk Enterprise SecurityMicrosoft SentinelHeldagainst: Splunk Enterprise Securityno first choiceWazuhagainst: OSSIM, Splunk Enterprise SecurityMicrosoft Sentinelagainst: ELK Stack, Graylog, IBM QRadar, LogRhythm, Securonix Unified Defense SIEM, Wazuh
Two alternatives
LogRhythm NextGen, Rapid7 InsightIDRThree alternatives
Elastic Security, ManageEngine Log360, Rapid7 InsightIDRThree alternatives
Elastic Security, Microsoft Sentinel, SolarWinds Security Event ManagerFive alternatives
Blumira, Elastic Security, Google Security Operations, Rapid7 InsightIDR, Splunk Enterprise SecurityMistral SmallMicrosoft SentinelLogpointChangedno first choiceMicrosoft Sentinel, SolarWinds Security Event Managerno first choiceagainst: Graylog, LogRhythm, Securonix Unified Defense SIEM, Wazuh
Three alternatives
Exabeam, LogRhythm, Sumo Logic Cloud SIEMFour alternatives
SentinelOne Singularity AI SIEM, Splunk Enterprise Security, Sumo Logic Cloud SIEM, Trellix HelixOne alternative
Rapid7 InsightIDRDeepSeek V4 FlashMicrosoft Sentinel, Rapid7 InsightIDRagainst: Splunk Enterprise SecurityRapid7 InsightIDRChangedagainst: Splunk Enterprise SecuritySplunk Enterprise SecurityWazuhagainst: AlienVault OSSIM, Microsoft SentinelMicrosoft Sentinelagainst: Elastic Security, Splunk Enterprise Securityagainst: AlienVault OSSIM, IBM QRadar, LogRhythm, OpenText ArcSight, Securonix Unified Defense SIEM, SolarWinds Security Event Manager, Splunk Enterprise Security
Four alternatives
CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Google Security Operations, Stellar Cyber Next-Gen SIEMTwo alternatives
Elastic Security, Microsoft SentinelSeven alternatives
CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Exabeam, Google Security Operations, IBM QRadar, Microsoft Sentinel, Palo Alto Networks Cortex XSIAMTwo alternatives
Elastic Security, GraylogTwo alternatives
Exabeam, Rapid7 InsightIDRLlama 4 Maverickno first choiceno first choiceHeldno first choiceManageEngine Log360no first choiceagainst: IBM QRadar, LogRhythm, SolarWinds Security Event Manager, Splunk Enterprise Security
Three alternatives
SentinelOne Singularity AI SIEM, Sumo Logic Cloud SIEM, WazuhQwen 3.7 FlashLogRhythmagainst: Splunk Enterprise SecurityRapid7 InsightIDRChangedagainst: IBM QRadar, Splunk Enterprise SecurityMicrosoft Sentinel, Splunk Enterprise SecurityWazuhno first choiceagainst: Splunk Enterprise Securityagainst: Elastic Stack, IBM QRadar, LogRhythm, Microsoft Sentinel, OpenText ArcSight, Splunk Enterprise Security, Wazuh
Four alternatives
ManageEngine Log360, Microsoft Sentinel, Rapid7 InsightIDR, Sumo Logic Cloud SIEMThree alternatives
Elastic Security, Exabeat CloudFirst, Microsoft SentinelThree alternatives
Elastic Security, IBM QRadar, Rapid7 InsightIDRFour alternatives
Blumira, Graylog, Microsoft Sentinel, Security OnionThree alternatives
Exabeam, Microsoft Sentinel, Tenable OneKimi K2Microsoft Sentinelagainst: Splunk Enterprise SecurityRapid7 InsightIDRChangedagainst: SentinelOne Singularity AI SIEMno first choiceWazuhagainst: AlienVault OSSIM, Rapid7 InsightIDRno first choiceagainst: Elastic Securityagainst: IBM QRadar, LogRhythm, OpenText ArcSight, Securonix Unified Defense SIEM, Splunk Enterprise Security
Two alternatives
LogRhythm, Sumo Logic Cloud SIEMFour alternatives
Exabeam, LogRhythm, Microsoft Sentinel, WazuhSeven alternatives
CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Exabeam, Google Security Operations, IBM QRadar, Microsoft Sentinel, Splunk Enterprise SecurityTwo alternatives
Elastic Security, LogpointFour alternatives
Exabeam SaaS, Google Security Operations, Microsoft Sentinel, Rapid7 InsightIDRGLM 4.7 FlashXMicrosoft SentinelMicrosoft SentinelHeldSplunk Enterprise SecurityWazuhagainst: Splunk Enterprise Securityno first choiceagainst: IBM QRadar, Securonix Unified Defense SIEM
Six alternatives
Elastic Security, FortiSIEM, ManageEngine Log360, Rapid7 InsightIDR, Splunk Enterprise Security, Sumo Logic Cloud SIEMFive alternatives
Blumira, Datadog Cloud SIEM, Exabeam, LogRhythm, Rapid7 InsightIDRSix alternatives
Elastic Security, Graylog, IBM QRadar, LogRhythm, Microsoft Sentinel, SolarWinds Security Information and Event ManagementTwo alternatives
Elastic Security, Security OnionMiniMax M2.5Microsoft Sentinelno first choiceChangedno first choiceWazuhElastic Security, Microsoft Sentinelagainst: IBM QRadar, Splunk Enterprise Securityagainst: Graylog, LogRhythm, Securonix Unified Defense SIEM, Wazuh
Two alternatives
Exabeam, LogRhythmThree alternatives
Elastic Security, ManageEngine Log360, SolarWinds Security Event ManagerOne alternative
ExabeamGPT-6 LunaMicrosoft SentinelMicrosoft SentinelHeldno first choiceWazuhno first choiceagainst: IBM QRadar on Cloud / QRadar SaaS, Microsoft Sentinel, Splunk Enterprise Security
Two alternatives
Google Security Operations, Rapid7 InsightIDRTwo alternatives
Elastic Security, Google Security OperationsTwo alternatives
Elastic Security, Microsoft SentinelMuse Glimmer 30BRapid7 InsightIDR, Sumo Logic Cloud SIEMRapid7 InsightIDRChangedno first choiceagainst: Splunk Enterprise SecurityMicrosoft Sentinel, Wazuhagainst: Splunk Enterprise Securityno first choiceagainst: IBM QRadar, LogRhythm, Microsoft Sentinel, Splunk Enterprise Security
Three alternatives
Elastic Security, ManageEngine Log360, Securonix Unified Defense SIEMSeven alternatives
Elastic Security, Google Security Operations, Graylog Security, IBM QRadar, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, WazuhFour alternatives
Blumira, Gravwell Community Edition, ManageEngine Log360, Security OnionBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:43 | yes | 9 | 7 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 10:07 | yes | 3 | 7 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:19 | yes | 12 | 27 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 10:31 | yes | 20 | 3 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 10:34 | yes | 22 | 6 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:27 | yes | 11 | 5 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:49 | yes | 20 | 47 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 08:06 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:12 | yes | 8 | 21 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:19 | yes | 9 | 25 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 11:00 | yes | 11 | 50 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 13:53 | yes | 7 | 20 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:51 | yes | 5 | 16 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 12:34 | yes | 14 | 20 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 08:48 | no | 0 | 5 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:43 | yes | 2 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:07 | yes | 11 | 22 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 09:50 | yes | 19 | 3 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 12:47 | yes | 25 | 7 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 09:57 | yes | 5 | 3 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:35 | yes | 16 | 13 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 13:18 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:32 | no | 0 | 35 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:31 | yes | 13 | 25 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 08:15 | yes | 12 | 56 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 09:09 | yes | 8 | 30 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 08:38 | yes | 4 | 12 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:29 | yes | 13 | 8 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:46 | yes | 9 | 10 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 08:36 | yes | 5 | 7 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:45 | yes | 16 | 23 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 10:49 | yes | 18 | 4 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:33 | yes | 18 | 7 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 12:54 | yes | 12 | 10 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 08:57 | yes | 13 | 41 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 07:40 | yes | 5 | 1 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:50 | no | 0 | 32 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 12:46 | yes | 16 | 43 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:18 | no | 0 | 40 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 07:54 | yes | 8 | 31 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:33 | yes | 7 | 26 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:15 | yes | 22 | 50 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 09:15 | yes | 9 | 7 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:41 | yes | 3 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:23 | yes | 13 | 29 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 12:59 | yes | 19 | 4 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 10:35 | yes | 23 | 7 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 07:41 | yes | 5 | 3 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 07:43 | yes | 17 | 30 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 13:04 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 11:18 | yes | 9 | 29 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 13:45 | yes | 10 | 23 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:32 | yes | 24 | 70 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 13:04 | yes | 5 | 19 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:01 | yes | 3 | 10 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:36 | yes | 15 | 19 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 13:51 | yes | 16 | 12 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:35 | no | 0 | 8 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:14 | yes | 14 | 31 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 11:37 | yes | 18 | 7 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 13:48 | yes | 16 | 9 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 09:00 | no | 0 | 7 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:56 | yes | 24 | 40 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:37 | yes | 5 | 1 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 07:51 | no | 0 | 28 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 13:37 | yes | 5 | 19 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 07:54 | yes | 10 | 28 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 09:26 | yes | 5 | 24 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 10:28 | yes | 2 | 14 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 12:12 | yes | 15 | 42 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 07:44 | yes | 37 | 14 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 10:13 | yes | 3 | 7 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 08:32 | yes | 23 | 25 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 09:36 | yes | 20 | 5 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 10:31 | yes | 22 | 6 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 07:51 | yes | 5 | 3 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:25 | yes | 25 | 43 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:25 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:38 | no | 0 | 34 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 07:27 | yes | 24 | 30 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:39 | yes | 25 | 75 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:04 | yes | 9 | 23 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 09:21 | yes | 4 | 22 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 12:44 | yes | 14 | 25 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
ArcSight read as OpenText ArcSight
ArcSight (Micro Focus/OpenText) read as OpenText ArcSight
Cortex XSIAM read as Palo Alto Networks Cortex XSIAM
Elastic read as Elastic Security
Exabeam Fusion read as Exabeam
Fortinet read as FortiSIEM
Google read as Google Security Operations
Google Chronicle read as Google Security Operations
Google Chronicle (now Google SecOps) read as Google Security Operations
Google SecOps read as Google Security Operations
Google SecOps (Chronicle) read as Google Security Operations
Huntress read as Huntress Managed SIEM
Huntress (Managed SIEM) read as Huntress Managed SIEM
IBM read as IBM QRadar
IBM (QRadar) read as IBM QRadar
ManageEngine read as ManageEngine Log360
Microsoft read as Microsoft Sentinel
OpenText read as OpenText ArcSight
Rapid7 read as Rapid7 InsightIDR
Rapid7 Incident Command read as Rapid7 InsightIDR
Securonix read as Securonix Unified Defense SIEM
SentinelOne Singularity SIEM read as SentinelOne Singularity AI SIEM
SolarWinds read as SolarWinds Security Event Manager
SolarWinds (SW) read as SolarWinds Security Event Manager
Splunk read as Splunk Enterprise Security
Splunk Cloud read as Splunk Enterprise Security
Splunk Free read as Splunk Enterprise Security
Stellar Cyber read as Stellar Cyber Next-Gen SIEM
Sumo Logic read as Sumo Logic Cloud SIEM
Unresolved, counted raw
Exabeam SaaS
Exabeat CloudFirst
Gravwell Community Edition
IBM QRadar on Cloud / QRadar SaaS
Kaseya SIEM
NetWitness Platform
QAX
Seceon aiSIEM CGuard 2.0
SolarWinds Security Information and Event Management (SIEM)
Trellix Helix
Wazuh Cloud
Discontinued, still offered
No shut-down product was recommended here.