Elastic Security Alternatives

I've been running Splunk Enterprise for about 3.5 years across a hybrid environment -- on-prem servers, multiple AWS regions and a fleet of EKS clusters. I manage the cloud infrastructure side, which means I'm both a consumer of Splunk dashboards and responsible for keeping the indexers healthy. I'd give it a 4 out of 5. It's earned the high marks because when something goes wrong at 3am, Splunk is the first place I go and it consistently gives me the answer. But that last star is held back by the cost model and the operational overhead of running it at scale.

LogRhythm SIEM has been an important tool for continuous security event monitoring and incident investigation. In our environment, we use it to centralize logs from different sources, correlate events, and track alerts that require analysis by the SOC. The platform facilitates access to the information needed during an investigation and reduces the time spent collecting data from multiple systems. Although it requires proper initial configuration, once implemented, it offers good visibility into the environment's activity and helps improve detection and response processes.

IBM Qradar has exceptional capabilities when it comes to SIEM solutions. I personally have been using IBM Qradar right from the time I joined my organization. It is easy to navigate, is extremely user friendly and the interface provided is a ready to use interface even for beginners kick starting their careers in SOC and cybersecurity. Although its user friendly nature and ease of navigation is commendable, its response time and log retrieving is something where it lags a lot. Slow processing of selected filters and I/O error while loading of the selected search filters, is some of the things which really take a lot of time while investigating or monitoring of offenses and security events

My Overall experience with Splunk Enterprise Security has been strong, especially in an energy sector environment where visibility and flexibility are critical, one properly tuned , ES provides powerful detection capabilities meaningful risk based insights and a unified view across IT, OT and cloud systems , through it does require ongoing optimization ,data hygiene and careful management of ingestion costs to get the most value , ultimately making it a robust and impactful platform that has significantly improved our Security operations.

My overall experience has been very user friendly and love the transparency when it comes to events and logs.

Overall, our experience with Falcon Next-Gen SIEM service has been pretty good.Deployment and integration were easier than we expected, and it gave us visibility across systems that we didn't really have before.The alerting and analytics are solid, and we've been able to spot unusual activity early, which has been a big help.The support team has been responsive and willing to walk us through tricky situations, which makes a difference.It's definitely improved how we monitor and respond to incidents day-to-day, even if a few things could be smoother

My overall experience with securonix unified defense SIEM has been positive. The platform provides strong analytics capabilities and helps in detecting advanced threats that traditional SIEM tools often miss. Its behavioral analytics and other features are particularly useful in identifying threats and unusual activities. The product does have a learning curve especially for the teams that are new to SIEM or Securonix's architecture. Additionally, tuning and customizing sometimes require more efforts and expertise than expected. overall its a solid solution for organization looking for advance threat detection, but it may require skilled resources to fully utilize its capabilities.

IDR functions exceptionally well as a SIEM solution when you take the time to configure detection rules accurately and ensure you are ingesting as many sources as possible. Our account team has also been outstanding every step of the way.