# SIEM platforms: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "SIEM platform" and as "security information and event management tool", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://it-ai-index.com/security/siem-platforms/

**Standing:** Microsoft Sentinel leads with 41% of first choices; verdict clear leader. 49 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Microsoft Sentinel | 41% | 12% | 56 |
| 2 | Rapid7 InsightIDR | 22% | 4% | 28 |
| 3 | Wazuh | 18% | 7% | 15 |
| 4 | Elastic Security | 6% | 0% | 32 |
| 5 | ManageEngine Log360 | 4% | 6% | 16 |
| 6 | Blumira | 4% | 0% | 12 |
| 7 | LogRhythm | 2% | 34% | 29 |
| 8 | Google Security Operations | 0% | 8% | 12 |
| 9 | Palo Alto Networks Cortex XSIAM | 0% | 8% | 13 |
| 10 | Sumo Logic | 0% | 17% | 18 |
| 11 | Exabeam | 0% | 15% | 13 |
| 12 | Graylog | 0% | 30% | 10 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: ManageEngine Log360; alternatives Blumira, Microsoft Sentinel, Rapid7 InsightIDR
- GPT-5.4 mini: Microsoft Sentinel; alternatives Google Security Operations, Splunk Enterprise Security
- Gemini 3.5 Flash: Blumira, Huntress Managed SIEM, Microsoft Sentinel; alternatives Rapid7 InsightIDR, Sumo Logic
- Perplexity Sonar: Microsoft Sentinel; alternatives Rapid7 InsightIDR
- Grok 4.1 Fast: Rapid7 InsightIDR; alternatives Blumira, Elastic Security, LogRhythm, ManageEngine Log360
- Mistral Small: Microsoft Sentinel, Rapid7 InsightIDR; alternatives ManageEngine Log360
- DeepSeek V4 Flash: Microsoft Sentinel, Rapid7 InsightIDR; alternatives CrowdStrike Falcon Next-Gen SIEM, Elastic Security, LogRhythm
- Llama 4 Maverick: Microsoft Sentinel, Rapid7 InsightIDR; alternatives ManageEngine Log360
- Qwen 3.7 Flash: Microsoft Sentinel, Rapid7 InsightIDR; alternatives LogRhythm
- Kimi K2: Rapid7 InsightIDR; alternatives CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Google Security Operations, Microsoft Sentinel
- GLM 4.7 FlashX: Microsoft Sentinel; alternatives Elastic Security, IBM QRadar, LogRhythm, Rapid7 InsightIDR
- MiniMax M2.5: Microsoft Sentinel, Rapid7 InsightIDR; alternatives Elastic Security, LogRhythm

## Sources the answers cite

63 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- underdefense.com: 32 answers, 41 citations
- paloaltonetworks.com: 32 answers, 34 citations
- exabeam.com: 22 answers, 25 citations
- cipherssecurity.com: 20 answers, 25 citations
- gartner.com: 19 answers, 31 citations
- reddit.com: 18 answers, 39 citations
- expertinsights.com: 17 answers, 17 citations
- xoomar.com: 16 answers, 27 citations

Pages named in the most answers:

- https://paloaltonetworks.com/cyberpedia/siem-tools-comparison (31 answers)
- https://underdefense.com/blog/siem-solutions-comparison (28 answers)
- https://gartner.com/reviews/market/security-information-event-management (18 answers)
- https://expertinsights.com/security-operations/the-top-siem-solutions (17 answers)
- https://cipherssecurity.com/best-siem-tools-mid-size-enterprises-2026 (15 answers)
- https://subrosacyber.com/blog/best-siem-reddit (13 answers)
- https://exabeam.com/explainers/siem-tools/siem-buyers-guide (12 answers)
- https://exelegent.com/best-siem-tools-for-mid-market-organizations (12 answers)
- https://manageengine.com/log-management/top-siem-tools.html (12 answers)
- https://cipherssecurity.com/best-siem-tools-in-2026-compared (10 answers)

## Warned against

- LogRhythm: 10 of 29 labels negative. "user feedback in the results is explicitly negative, with calls to avoid it if you care about "mental sanity and money."" (Perplexity Sonar, negative prompt)
- Securonix: 8 of 14 labels negative. "Multiple users have expressed dissatisfaction with Securonix, citing issues such as poor support, deactivation of policies without warning, and overall poor performance." (Llama 4 Maverick, negative prompt)
- IBM QRadar: 11 of 30 labels negative. "the cloud and related services are no longer viable options for new deployments or expansions" (Mistral Small, negative prompt)
- Splunk Enterprise Security: 11 of 26 labels negative. "Avoid Splunk Enterprise Security at this stage unless you have a large budget ... it's overkill and cost-prohibitive" (DeepSeek V4 Flash, paraphrase prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.