What is the most used SIEM?

asked by nuband 29 days ago

Just curious what people are actually running in production.

3 answers

▲

aklaha 12 points 28 days ago

By install count it is definitely OSSEC and Wazuh, it is just that nobody writes press releases about those. Open source wins on utilisation by a mile, it does not show up on the Gartner slide.

▲

cclondon 9 points 29 days ago

Splunk, QRadar, Sentinel, Trunc, take your pick. Honestly nobody knows, every survey is sponsored by somebody on the list.

▲

gerald (Gerald) 4 points 28 days ago

Depends on size. Under 200 staff it is Sentinel or something open source. Over 5000 it is Splunk and a team of six to run it.

Guidelines Newest Search Back to Trunc