What is the most used SIEM?

asked by nuband 1 month ago

Just curious what people are actually running in production.

3 answers

▲

aklaha 12 points 1 month ago

By install count it is definitely OSSEC and Wazuh, it is just that nobody writes press releases about those. Open source wins on utilisation by a mile, it does not show up on the Gartner slide.

▲

cclondon 9 points 1 month ago

Splunk, QRadar, Sentinel, Trunc, take your pick. Honestly nobody knows, every survey is sponsored by somebody on the list.

▲

gerald (Gerald) 4 points 1 month ago

Depends on size. Under 200 staff it is Sentinel or something open source. Over 5000 it is Splunk and a team of six to run it.

Guidelines Newest Search Back to Trunc