This is a listing of SIEMs I’ve used in one way or another, and my notes on each. Some info may be outdated.

LogRhythm

I learned on LogRythm and have 6 years of experience. LogRhythm is an enterprise SIEM with a web interface and has optional packages (prewritten alarms, reports, playbooks, and smart response scripts (or automation/SOAR)) based on compliance packs and frameworks (ie NIST 800-53, MITRE ATTACK). It’s primarily for private cloud (or on prem). Logrhythm played with offering a web based service which would have eliminated the need for an engineer, but I think this may have fell there when they were unable to get gov customers which required a variety of compliance certifications. They may have continued with this but I don’t recall seeing it.

The good: LogRhythm has a great web UI that is easy to learn quickly. Metadata is parsed from logs and listed in columns and rows with each column searchable the same way formatted tables in Excel. It has dashboards and a large array of log processing policies. The knowledge base packages are a huge plus and it allows for threat intelligence feeds to integrate easily. It also allows for MFA using an authentication app or smart card.

The bad: LogRhythm has attempted horizontal scaling but efforts have been minimal. Basically LogRhythm requires a database, generally MS-SQL, for metadata, alarms, reports, threat intel, etc. and installs an open source version of elasticsearch for the log indexer either in centos/RedHat or windows. For a medium sized enterprise network, you likely need at least 3 servers. We were using two windows servers, one for program manager and web console, one for the log processor, and a Linux server for the data indexer. Basically the architecture is a problem. You can install it on ec2 in aws and so on, but that much data can cost more than the hardware.

Another issue is the lack of dashboard options. Hopefully this has changed. Lastly, the smart response scripts, aka automation, was limited to PowerShell only.

Elastic SIEM aka ELK Stack aka Elastic Stack

( Elastic Search, LogStash, and Kiana)

Elastic has become the go to for a lot of government entities and businesses due to it being “open source” which I’ll touch on later. Basically you can get elastic SIEM with all the services and options needed to be fully in compliance, or have all the extras built out on top of the open source version. It’s very flexible and is used for more than just a SIEM due to its quick search and unstructured database

The Good: Elastic SIEM is fast, customizable, powerful, horizontally scalable (VMs or cloud), works in public or private cloud and can adapt. Kibana itself is the web front end and has decent dashboard options, reporting, and many options. Getting the full SIEM will likely satisfy any compliance requirements. Elastic can also be used for other things, such as vuln management, or basically any situation where different types of data need to be stored in one place.

The Bad: on paper elastic looks affordable, but by the time you purchase the addons, such as security alarms, threat intelligence, notifications, AI, etc., the price isn’t much better than it’s competitors. Alternatively you can develop your own solutions and pay very little, but you will need at least one full time elastic dev, if not more. With that said, elastic is very configurable but there are many documented incidents where an engineer accidentally misconfigured something which allowed access to attackers with little effort.

Log360 ManageEngine

I just recently had the opportunity to use Log360 and I can say it does the job, but not I’m not a fan of the layout. It again requires addons with additional licenses to get everything a SIEM needs. I won’t do a good and bad on this, because I have little experience. I can say it’s easy to use, but features are lacking and searching logs or performing drill downs in general leaves a lot to be desired. During an incident time matters, and log360’s layout takes too long to navigate. For example, while attempting to search a log source, instead of only showing the log sources in my environment, it gives a drop down menu with every log sources log360 is able to ingest. Your results will show the raw log message with bits of metadata below but there’s no table or option to include/exclude that parsed data without starting a new search. I know other SIEMs are like this, but they usually have other methods without having to start a new search.

Azure Sentinel

Sentinel is the Microsoft cloud native SIEM and you will only consider Sentinel if you’re already using Azure, Defender, etc., I do like Sentinel.

The good: It’s powerful, and it has many addons based on compliance, frameworks, etc. Microsoft has video courses and other training for Sentinel. Sentinel has a powerful search and like Elastic and Splunk, has a query language (KQL) that can be saved and shared. From my experience Sentinel is fast.

The bad: compared to other SIEMs there is a learning curve with Sentinel. You can’t jump on it for the first time and figure it out in a couple hours, like with simpler SIEMs like LogRhythm and Log360.

Splunk

For years Splunk has been the go-to for Federal and DoD SOCs. I once took Splunk training under the assumption that I would be using it one day, and my most recent job is in the procurement phase of switching to Splunk.

The good: trusted across the board in many SOCs. Has everything you need compliance wise. Fast and powerful search and query language (SPL2).

The bad: there is a learning curve, which seems to be true for the more powerful SIEMs. The only big complaint I’ve heard is the price. I’ve never personally purchased a SIEM, but like with most things, you get what you pay for.