2023 SC Awards Finalists: Best SIEM Solution

LogRhythm provides a unified security platform with comprehensive security analytics, user and entity behavior analytics, network detection and response, and security orchestration, automation, and response capabilities in a single, integrated platform. The platform reduces mean time to detect and mean time to respond, delivering rapid time-to-value from day one.

LogRhythm’s SIEM platform has been awarded patents for its novel log and event management, analytics, and risk-based monitoring and prioritizing features. The platform is the market’s leading standalone pure-play provider of security analytics platforms and offers a True Unlimited Data Plan that eliminates the need for CISOs to make challenging judgments about which data to monitor and secure to stay within budget.

LogRhythm customers typically receive Daily Knowledge Base updates, monthly upgrades to the software agent, and quarterly feature releases. LogRhythm has a cheaper total cost of ownership than its rivals and offers customizable alternatives. LogRhythm helps clients with quick deployments and integrations, automating tedious tasks, and consistent, repeatable workflows.

ManageEngine’s Log360 is a unified SIEM solution that integrates DLP and CASB capabilities to detect, investigate, and respond to security threats. It can ingest logs and event data from over 750 types of network sources and offers capabilities such as agentless and agent-based log collection, event correlation, MITRE ATT&CK framework reports, threat intelligence, data security, compliance management, anomaly detection, and incident management on a single console. Log360 enables playbooks and workflow configuration to mitigate incidents and has a correlation engine that puts seemingly unrelated events together to recognize potential threats. It assigns risk scores based on anomalous activity by users or entities and offers more than 30 correlation rules for tracking attacks such as ransomware, cryptojacking, and DDoS. The solution can be purchased in a modular structure, allowing SMEs to prioritize the features they need most. Log360 has integrated CASB capability, and it also integrates with popular ITSM tools. SHM, a leading provider of business services, uses Log360 to ensure comprehensive network security and to protect against globally blacklisted IP sources. The pricing is subscription-based and starts at $595, depending on the configuration needed.

OpenText ArcSight, a modern Security Information and Event Management (SIEM) platform, has been praised by analysts and customers for its 20-plus years of expertise and leadership in the SIEM market. The platform offers enterprise-wide threat awareness and security insights to Security Operation Centers (SOCs) with multiple deployment options. It provides greater visibility through open, scalable data collection, real-time threat detection through correlation and machine learning for accurate anomaly detection and behavioral analysis. Additionally, it offers a native SOAR for timely threat response, intuitive forensic investigation backed by big-data analytics, and a shared interface to increase contextual understanding of threats. ArcSight supports customers in lowering total cost of ownership through structured data, 360° analytics, automation, and a unified platform. The platform is focused on enabling customers through five key use cases and supports multiple deployment options to satisfy unique customer needs.According to a 2022 IDC SIEM market report, ArcSight has the fourth largest share of the SIEM market. The platform has received recognition from GigaOm, Gartner, and KuppingerCole in 2022, as well as being named a Best SIEM Solution finalist in both the 2022 and 2021 SC Awards. In 2020, it was named the SC Labs Best Buy for SIEM. With continuing positive reviews from both analysts and customers, ArcSight is expected to increase its market share over the next 12-24 months.

As the threat landscape evolves, Security Operations Center (SOC) teams struggle to keep up with an unrealistic number of threat alerts to analyze and legacy solutions designed with Security Information and Event Management (SIEM) technology invented years ago. The Sumo Logic Cloud SIEM solution offers modernized security operations and is breaking down these barriers by giving analysts prioritized and contextualized threat data to mitigate risk. Advantages of Sumo Logic include cloud-native scalability, automated security operations, a single platform, modern analyst experience, cloud and modern application context, and automatic alert triage. Sumo Logic offers an Adaptive Signal Clustering (ASC) engine to help analysts identify and contextualize attacks and movements, including multiple low-severity signals that often go unnoticed. Customers include 23andMe, Alaska Airlines, Samsung, and Viacom. Sumo Logic is delivered as a SaaS subscription, which is updated continually with new feature updates added weekly. Sumo Logic supports SMB entry-level machine analytics to the largest Fortune 100 companies, creating a wide range of contract opportunities.

Wazuh is an open-source security platform that offers unified SIEM and XDR capabilities to protect workloads across various environments. With multi-platform agents that collect security and runtime event data, Wazuh provides easy and fast detection and remediation of anomalies and threats. Wazuh’s platform is free, providing a comprehensive security solution with reduced licensing fees and maintenance costs compared to managing multiple proprietary tools. It also helps with regulatory compliance, preventing costly fines and penalties for non-compliance. With over 20 million downloads in 2022, Wazuh has one of the largest open-source security communities in the world, democratizing cybersecurity for organizations of all sizes. Wazuh’s platform is easy to deploy and integrate with third-party tools, with one of the fastest-growing and active communities. Several leading enterprises, including Groupon, have benefited from using Wazuh, gaining visibility, improving their security metrics, and reducing costs.