SIEM platforms for small business buyers
Asked as “SIEM platform”, and as “security information and event management tool”, on behalf of a small B2B company. 59 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each.
Standing · first-choice share
34%
Contested · Microsoft Sentinel 22%
34Blumira22Microsoft Sentinel14ManageEngine Log36031others
34% of first choices, contested.
Since September 2026▲+6Since September 2026: 28% → 35%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Blumira held the lead, +6 points on 28%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Blumira34%Contested▲+6Since September 2026: 28% → 35%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageMid-market
Microsoft Sentinel38%Contested▼−2Since September 2026: 41% → 39%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →EnterpriseMicrosoft Sentinel41%Clear leader▲+12Since September 2026: 30% → 42%, +12 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →
Blumira34%Contested▲+6Since September 2026: 28% → 35%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.This pageMid-marketMicrosoft Sentinel38%Contested▼−2Since September 2026: 41% → 39%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.Standing →EnterpriseMicrosoft Sentinel41%Clear leader▲+12Since September 2026: 30% → 42%, +12 points. Past the 11-point floor: movement. Read over the models both editions asked.Standing →The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
01Blumira34%0%45endorsed leader▲+6Since September 2026: 28% → 35%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.28% → 35%
Blumira34%0%45endorsed leader▲+6Since September 2026: 28% → 35%, +6 points. Inside the 11-point floor: within noise. Read over the models both editions asked.28% → 35%02Microsoft Sentinel22%13%60accepted challenger▼−10Since September 2026: 28% → 18%, −10 points. Inside the 11-point floor: within noise. Read over the models both editions asked.28% → 18%
Microsoft Sentinel22%13%60accepted challenger▼−10Since September 2026: 28% → 18%, −10 points. Inside the 11-point floor: within noise. Read over the models both editions asked.28% → 18%03
ManageEngine Log36014%3%29accepted challenger▲+12Since September 2026: 4% → 16%, +12 points. Past the 11-point floor: movement. Read over the models both editions asked.4% → 16%
ManageEngine Log36014%3%29accepted challenger▲+12Since September 2026: 4% → 16%, +12 points. Past the 11-point floor: movement. Read over the models both editions asked.4% → 16%04
Wazuh10%16%45accepted challenger▼−7Since September 2026: 17% → 10%, −7 points. Inside the 11-point floor: within noise. Read over the models both editions asked.17% → 10%
Wazuh10%16%45accepted challenger▼−7Since September 2026: 17% → 10%, −7 points. Inside the 11-point floor: within noise. Read over the models both editions asked.17% → 10%05
Huntress Managed SIEM5%3%30accepted challenger▼−5Since September 2026: 9% → 4%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.9% → 4%
Huntress Managed SIEM5%3%30accepted challenger▼−5Since September 2026: 9% → 4%, −5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.9% → 4%06
Rapid7 InsightIDR3%4%27accepted challenger▲+4Since September 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 4%
Rapid7 InsightIDR3%4%27accepted challenger▲+4Since September 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 4%07
Elastic Security3%15%34accepted challenger=heldSince September 2026: 4% → 4%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 4%
Elastic Security3%15%34accepted challenger=heldSince September 2026: 4% → 4%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.4% → 4%08
Sumo Logic Cloud SIEM3%9%11accepted challenger▼−2Since September 2026: 7% → 4%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.7% → 4%
Sumo Logic Cloud SIEM3%9%11accepted challenger▼−2Since September 2026: 7% → 4%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.7% → 4%Show the three products at 0%, ordered by negative rate
10
IBM QRadar0%84%19criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
IBM QRadar0%84%19criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%11
Splunk Enterprise Security0%74%39criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Splunk Enterprise Security0%74%39criticized challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%09
Graylog0%21%14accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%
Graylog0%21%14accepted challenger=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.0% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Head to head
All twenty-one head-to-head pages: the top seven products, each against each
Microsoft Sentinel vs ManageEngine Log360Microsoft Sentinel vs Sumo Logic Cloud SIEMMicrosoft Sentinel vs LogRhythmWazuh vs Rapid7 InsightIDRWazuh vs Elastic SecurityWazuh vs ManageEngine Log360Wazuh vs Sumo Logic Cloud SIEMWazuh vs LogRhythmRapid7 InsightIDR vs Elastic SecurityRapid7 InsightIDR vs ManageEngine Log360Rapid7 InsightIDR vs Sumo Logic Cloud SIEMRapid7 InsightIDR vs LogRhythmElastic Security vs ManageEngine Log360Elastic Security vs Sumo Logic Cloud SIEMElastic Security vs LogRhythmManageEngine Log360 vs Sumo Logic Cloud SIEMManageEngine Log360 vs LogRhythmSumo Logic Cloud SIEM vs LogRhythm
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
0102030405060708091011Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Blumira34%
Blumira34%02Microsoft Sentinel22%
Microsoft Sentinel22%03ManageEngine Log36014%
ManageEngine Log36014%04Wazuh10%
Wazuh10%05Huntress Managed SIEM5%
Huntress Managed SIEM5%06Rapid7 InsightIDR3%
Rapid7 InsightIDR3%07Elastic Security3%
Elastic Security3%08Sumo Logic Cloud SIEM3%
Sumo Logic Cloud SIEM3%09Graylog0%
Graylog0%10IBM QRadar0%
IBM QRadar0%11Splunk Enterprise Security0%
Splunk Enterprise Security0%What they warned about
Six of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Kimi K2, GLM 4.7 FlashX, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Splunk Enterprise Security74%
29 of 39 labels negative · 14 of 14 models · 14 hard negative
“Traditional Enterprise SIEMs (e.g., Splunk, older on-prem architectures) These platforms are often too complex, expensive, and resource-intensive for small businesses.” Mistral Small, negative prompt
IBM QRadar84%
16 of 19 labels negative · 10 of 14 models · 11 hard negative
“generally positioned as an enterprise product, with comments that it is pricey and better fit for larger/security-mature environments” Perplexity Sonar, negative prompt
Microsoft Sentinel13%
8 of 60 labels negative · 7 of 14 models
“Why to be cautious: Microsoft Sentinel and Google SecOps are excellent... their pricing is almost entirely variable” Gemini 3.5 Flash, negative prompt
Google Security Operations71%
5 of 7 labels negative · 5 of 14 models · 1 hard negative
“"costly upkeep… challenging" and a "steep learning curve… especially if unfamiliar with Google Cloud services."” Muse Glimmer 30B, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
77 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 1010 links across 207 sites, every framing counted. Ranked by the number of answers carrying the site or page. 13 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
52 answers · 55 citations · 12 models
vendor site · SentinelOne43 answers · 67 citations · 12 models
vendor site · Palo Alto Networks36 answers · 36 citations · 12 models
28 answers · 28 citations · 10 models
25 answers · 25 citations · 10 models
vendor site · UnderDefense24 answers · 29 citations · 10 models
vendor site · G221 answers · 27 citations · 10 models
vendor site · Logmanager21 answers · 21 citations · 10 models
21 answers · 21 citations · 10 models
19 answers · 21 citations · 10 models
17 answers · 18 citations · 8 models
16 answers · 17 citations · 8 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
52 answers · 12 models
35 answers · 11 models
31 answers · 11 models
28 answers · 10 models
25 answers · 10 models
21 answers · 10 models
21 answers · 10 models
20 answers · 9 models
18 answers · 9 models
16 answers · 9 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best siem platform”, “siem platform”, “siem platforms”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days |
|---|---|---|---|---|---|---|---|
| Blumira blumira.com | 34% | 110 | 1,300 | 12 | 8,060 | 10 | |
| Microsoft parent site Microsoft Sentinel 22% | 22% | 359 | 2,240,000 | 403,136 | |||
| ManageEngine parent site ManageEngine Log360 14%, ManageEngine EventLog Analyzer 2% | 15% | 98 | 8,100 | 675 | |||
| Wazuh wazuh.com | 10% | 124 | 9,900 | 446 | 7,214 | 3 | |
| Huntress huntress.com Huntress Managed SIEM 5% | 5% | 35 | 33,100 | 4,338 | 352,368 company | $15,522 | 120 |
| Rapid7 parent site Rapid7 InsightIDR 3% | 3% | 115 | 14,800 | 798 | |||
| Elastic elastic.co Elastic Security 3% | 3% | 126 | 74,000 | 34,672 | 208,306 company | 105 | |
| Sumo Logic Cloud SIEM sumologic.com | 3% | 38 | 40 | 1 | 82,749 | $4,123 | 55 |
| Blumira Respond | 2% | ||||||
| Hunters AI-Driven SIEM | 2% |
Google's top ten for the three searches hold 21 sites; 2 of them are among the sites the models cited here (sentinelone.com, underdefense.com). The first result for “best siem platform” is gartner.com.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best SIEM platform for a small B2B company?”Paraphrase“Which security information and event management tool would you recommend to a small business that sells to other businesses?”Comparative“What are the top SIEM platforms for a small team and how do they differ?”Budget-constrained“What is the best SIEM platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a SIEM platform. What should we look at?”Negative“Which SIEM platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5Sumo Logic Cloud SIEMBlumiraChangedBlumiraElastic Security, ManageEngine EventLog Analyzerno first choiceagainst: ELK Stack, Splunk Enterprise Security
Three alternatives
Blumira, Huntress Managed SIEM, LogmanagerFour alternatives
Elastic Security, Graylog, Microsoft Sentinel, Sumo Logic Cloud SIEMFour alternatives
Graylog, Huntress Managed SIEM, Rapid7 InsightIDR, WazuhTwo alternatives
Graylog, Microsoft SentinelGPT-5.4 miniMicrosoft Sentinelagainst: Splunk Enterprise SecurityMicrosoft SentinelHeldMicrosoft Sentinelagainst: IBM QRadar, Splunk Enterprise SecurityBlumira, Elastic Securityagainst: Microsoft Sentinelno first choiceagainst: Datadog Cloud SIEM, Exabeam New-Scale SIEM, Gurucul Next-Gen SIEM, Securonix Unified Defense SIEM, Splunk Enterprise Security, Trustwave SIEM Enterprise
One alternative
Elastic SecurityOne alternative
Elastic SecurityGemini 3.5 FlashBlumiraagainst: Palo Alto Cortex, Splunk Enterprise SecurityBlumiraHeldBlumira, Huntress Managed SIEMagainst: IBM QRadar, Splunk Enterprise SecurityBlumiraBlumiraagainst: IBM QRadar, Microsoft Sentinel, Splunk Enterprise Securityagainst: Devo, Google Security Operations, IBM QRadar, Microsoft Sentinel, OpenText ArcSight, Securonix Unified Defense SIEM, Self-hosted Elastic (ELK) Stack, Splunk Enterprise Security, self-hosted Wazuh
Three alternatives
Huntress Managed SIEM, Microsoft Sentinel, WazuhFour alternatives
Datadog Cloud SIEM, Huntress Managed SIEM, Microsoft Sentinel, WazuhThree alternatives
Datadog Cloud SIEM, Microsoft Sentinel, WazuhThree alternatives
LimaCharlie, Microsoft Sentinel, WazuhOne alternative
Huntress Managed SIEMPerplexity SonarManageEngine Log360ManageEngine Log360HeldHuntress Managed SIEM, Microsoft SentinelBlumiraagainst: ManageEngine Log360no first choiceagainst: Elastic Stack, Graylog, IBM QRadar, LogRhythm, Splunk Enterprise Security, Wazuh
Two alternatives
Huntress Managed SIEM, Microsoft SentinelThree alternatives
Huntress Managed SIEM, SentinelOne Singularity AI SIEM, SolarWinds Security Event ManagerFour alternatives
ManageEngine Log360, SentinelOne Singularity AI SIEM, SolarWinds Security Event Manager, WazuhTwo alternatives
Microsoft Sentinel, Rapid7 InsightIDRGrok 4.1 FastBlumiraagainst: Huntress Managed SIEM, WazuhBlumiraHeldagainst: WazuhBlumira, ManageEngine Log360against: Splunk Enterprise SecurityWazuhagainst: Splunk Enterprise SecurityBlumira, Huntress Managed SIEMagainst: Wazuhagainst: ELK Stack, Graylog, IBM QRadar, Micro Focus (formerly ArcSight) ESM, Splunk Enterprise Security, Wazuh
One alternative
Microsoft SentinelTwo alternatives
Huntress Managed SIEM, Microsoft SentinelTwo alternatives
Microsoft Sentinel, Rapid7 InsightIDRFour alternatives
Blumira, Elastic Security, Microsoft Sentinel, Sumo Logic Cloud SIEMTwo alternatives
Microsoft Sentinel, Rapid7 InsightIDRMistral SmallManageEngine Log360, Rapid7 InsightIDRBlumira, ManageEngine Log360ChangedLogRhythm, Microsoft SentinelMicrosoft Sentinel, Sumo Logic Cloud SIEMno first choiceagainst: Checkmk, SolarWinds Security Event Manager, Splunk Enterprise Security
One alternative
SentinelOneFive alternatives
Blumira, Elastic Security, Huntress Managed SIEM, Rapid7 InsightIDR, Sumo Logic Cloud SIEMTwo alternatives
Elastic Security, ManageEngine Log360DeepSeek V4 FlashBlumiraagainst: IBM QRadar, Splunk Enterprise SecurityManageEngine Log360Changedagainst: Rapid7 InsightIDRMicrosoft Sentinel, Rapid7 InsightIDRagainst: Splunk Enterprise SecurityManageEngine Log360, WazuhBlumira, Microsoft Sentinelagainst: Elastic Security, IBM QRadar, Splunk Enterprise Security, Wazuhagainst: Exabeam & LogRhythm, IBM QRadar, OpenText ArcSight, Splunk Enterprise Security
Three alternatives
ManageEngine Log360, Rapid7 InsightIDR, WazuhOne alternative
WazuhThree alternatives
Elastic Security, ManageEngine Log360, WazuhThree alternatives
Graylog, OSSIM, UnderDefenseThree alternatives
Huntress Managed SIEM, ManageEngine Log360, Rapid7 InsightIDRLlama 4 Maverickno first choiceHunters AI-Driven SIEMChangedno first choiceno first choiceno first choiceagainst: Splunk Enterprise Security
Four alternatives
Exabeam, Graylog Security, LogRhythm SIEM, Splunk Enterprise SecurityQwen 3.7 FlashMicrosoft SentinelMicrosoft SentinelHeldHunters SecurityWazuhagainst: Elastic Stackno first choiceagainst: IBM QRadar, Splunk Enterprise Securityagainst: Google Security Operations, HP ArcSight, IBM QRadar, Microsoft Sentinel, RSA Security Analytics, Self-Managed ELK Stack, Self-Managed Graylog, Self-Managed Wazuh, Splunk Enterprise Security
Three alternatives
Elastic Security, LogRhythm NextGen, WazuhThree alternatives
Datadog Cloud SIEM, ManageEngine MISP, WazuhThree alternatives
ManageEngine Log360, Microsoft Sentinel, WazuhTwo alternatives
Graylog, ManageEngine Log360Two alternatives
CrowdStrike, SentinelOneKimi K2Microsoft Sentinelagainst: IBM QRadar, Splunk Enterprise SecurityBlumiraChangedagainst: Splunk Enterprise SecurityMicrosoft Sentinel, Rapid7 InsightIDRBlumira, Wazuhagainst: Microsoft SentinelHuntress Managed SIEM, Microsoft Sentinelagainst: Splunk Enterprise Securityagainst: Elastic Security, FortiSIEM, IBM QRadar, Micro Focus ArcSight, Splunk Enterprise Security
Four alternatives
Blumira, Elastic Security, ManageEngine Log360, WazuhThree alternatives
Huntress Managed SIEM, Microsoft Sentinel, Rapid7 InsightIDRThree alternatives
Datadog Cloud SIEM, Elastic Security, WazuhOne alternative
Security OnionThree alternatives
Blumira, Elastic Security, WazuhGLM 4.7 FlashXBlumira, Microsoft SentinelRapid7 InsightIDRChangedagainst: SolarWinds Security Event ManagerBlumira, Microsoft SentinelWazuhagainst: Graylogno first choiceagainst: CrowdStrike Falcon Next-Gen SIEM, Datadog Cloud SIEM, Elastic Security, Exabeam, Google Security Operations, IBM QRadar, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Splunk Enterprise Security
Three alternatives
Elastic Security, LogRhythm, ManageEngine Log360Two alternatives
Blumira, ManageEngine Log360Five alternatives
Elastic Security, ManageEngine Log360, Rapid7 InsightIDR, Sumo Logic Cloud SIEM, WazuhTwo alternatives
Elastic Security, Microsoft SentinelMiniMax M2.5ManageEngine Log360ManageEngine Log360HeldBlumira, Microsoft SentinelBlumirano first choiceagainst: Splunk Enterprise Securityagainst: IBM QRadar, Palo Alto Networks Cortex XSIAM, Splunk Enterprise Security, Sumo Logic Cloud SIEM
Three alternatives
SentinelOne Singularity AI SIEM, Sumo Logic Cloud SIEM, WazuhTwo alternatives
Microsoft Sentinel, WazuhSix alternatives
Datadog Cloud SIEM, Elastic Security, Huntress Managed SIEM, ManageEngine Log360, Rapid7 InsightIDR, WazuhTwo alternatives
ManageEngine Log360, WazuhFour alternatives
Exabeam, LogRhythm, Microsoft Sentinel, Rapid7 IDRGPT-6 LunaMicrosoft SentinelBlumira RespondChangedMicrosoft Sentinelagainst: Google Security OperationsWazuhMicrosoft Sentinelagainst: Elastic Securityagainst: Elastic Security, IBM QRadar SaaS, LogRhythm self-managed, Microsoft Sentinel, Splunk Enterprise Security, Wazuh
Two alternatives
Elastic Security, Google Security OperationsOne alternative
Microsoft SentinelFour alternatives
Elastic Security, Rapid7 InsightIDR, Splunk Enterprise Security, WazuhOne alternative
Microsoft SentinelOne alternative
Google Security OperationsMuse Glimmer 30BMicrosoft SentinelBlumira, Microsoft SentinelChangedHunters, Microsoft SentinelBlumiraBlumira, Huntress Managed SIEMagainst: Google Security Operations, IBM QRadar, Microsoft Sentinel, Palo Alto Networks Cortex XSIAM, Splunk Enterprise Security
Three alternatives
Huntress Managed SIEM, Rapid7 InsightIDR, WazuhTwo alternatives
Elastic Security, ManageEngine Log360Six alternatives
Blumira, Datadog Cloud SIEM, Elastic Security, Huntress SIEM, Sumo Logic Cloud SIEM, WazuhFive alternatives
Elastic Security, Graylog, Huntress Managed SIEM, Microsoft Sentinel, WazuhBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 13:30 | yes | 9 | 8 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 12:15 | yes | 3 | 5 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:53 | yes | 13 | 20 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-01 09:17 | yes | 19 | 3 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 07:42 | yes | 21 | 7 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 13:40 | yes | 5 | 3 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 10:30 | yes | 20 | 34 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:05 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 09:10 | no | 0 | 29 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 10:11 | yes | 12 | 22 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 10:42 | yes | 15 | 31 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 08:14 | yes | 12 | 21 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-01 13:35 | yes | 4 | 11 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 09:54 | yes | 15 | 36 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:03 | yes | 17 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 08:04 | yes | 3 | 4 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:40 | yes | 9 | 19 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-01 11:27 | yes | 19 | 4 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 08:26 | yes | 22 | 7 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:27 | yes | 5 | 3 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 09:33 | yes | 23 | 17 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:22 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 08:46 | no | 0 | 29 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 08:26 | yes | 20 | 26 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 11:02 | yes | 20 | 24 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:11 | yes | 11 | 29 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:13 | yes | 2 | 15 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 08:32 | yes | 13 | 20 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:45 | yes | 16 | 11 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 09:07 | yes | 6 | 8 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 13:45 | yes | 16 | 25 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-01 13:03 | yes | 18 | 5 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 12:59 | yes | 20 | 9 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 07:27 | yes | 8 | 8 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 12:52 | yes | 23 | 41 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 11:35 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 10:38 | yes | 17 | 34 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:07 | yes | 20 | 27 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 11:32 | yes | 24 | 93 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:59 | yes | 7 | 20 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-01 10:25 | yes | 6 | 19 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 13:11 | yes | 22 | 41 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 08:12 | yes | 9 | 7 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:17 | yes | 4 | 7 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 09:00 | yes | 6 | 21 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-01 11:49 | yes | 19 | 3 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 12:52 | yes | 23 | 45 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 11:11 | yes | 5 | 3 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 08:50 | yes | 20 | 23 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 12:04 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 12:53 | yes | 15 | 52 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 09:47 | yes | 15 | 22 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 09:57 | yes | 14 | 16 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 12:22 | yes | 20 | 32 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 12:17 | yes | 2 | 11 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 10:42 | yes | 14 | 28 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 10:17 | no | 0 | 8 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 07:27 | no | 0 | 8 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 12:50 | yes | 10 | 26 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-01 08:49 | yes | 18 | 4 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 09:24 | yes | 18 | 15 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 08:59 | no | 0 | 7 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 13:04 | yes | 18 | 40 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:56 | yes | 5 | 2 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 13:24 | no | 0 | 29 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 13:30 | yes | 20 | 27 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 11:13 | yes | 14 | 20 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 11:57 | no | 0 | 8 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-01 11:01 | yes | 4 | 21 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 11:49 | yes | 13 | 25 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-01 11:57 | yes | 17 | 9 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-01 11:16 | yes | 2 | 5 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-01 10:48 | yes | 14 | 22 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-01 11:52 | yes | 21 | 4 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-01 12:34 | yes | 19 | 5 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-01 10:58 | yes | 9 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-01 08:35 | yes | 25 | 36 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-01 10:05 | yes | 5 | 1 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-01 10:20 | yes | 22 | 80 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-01 12:06 | yes | 12 | 24 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-01 11:47 | yes | 21 | 75 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-01 08:55 | yes | 5 | 18 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-01 13:02 | yes | 5 | 21 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-01 12:07 | yes | 12 | 15 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Cortex XSIAM read as Palo Alto Networks Cortex XSIAM
Elastic read as Elastic Security
Elastic Cloud (Elastic Security) read as Elastic Security
Exabeam Fusion read as Exabeam
Google Chronicle (Security Operations) read as Google Security Operations
Google SecOps read as Google Security Operations
Google SecOps (Chronicle) read as Google Security Operations
Huntress read as Huntress Managed SIEM
ManageEngine read as ManageEngine Log360
OpenText (ArcSight) read as OpenText ArcSight
Rapid7 read as Rapid7 InsightIDR
Securonix read as Securonix Unified Defense SIEM
SentinelOne Singularity SIEM read as SentinelOne Singularity AI SIEM
Splunk read as Splunk Enterprise Security
Splunk (Enterprise Security) read as Splunk Enterprise Security
Splunk Cloud read as Splunk Enterprise Security
Splunk Enterprise read as Splunk Enterprise Security
Splunk Enterprise / Splunk Cloud read as Splunk Enterprise Security
Sumo Logic read as Sumo Logic Cloud SIEM
Unresolved, counted raw
Adlumin
Blumira Respond
Exabeam New-Scale SIEM
Gurucul Next-Gen SIEM
Hunters AI-Driven SIEM
Hunters Security
Huntress SIEM
LogRhythm self-managed
ManageEngine MISP
Micro Focus (formerly ArcSight) ESM
Netsurion
RSA Security Analytics
Rapid7 IDR
SecurityOnion
Self-Managed Graylog
Self-Managed Wazuh
Self-hosted Elastic (ELK) Stack
Trustwave SIEM Enterprise (Legacy)
VMware Helix
self-hosted Wazuh
Discontinued, still offered
No shut-down product was recommended here.