Abstract Composable SIEM
SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.
Logging & Monitoring
Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
Addresses 120 stories in our coverage in the last 90 days 8 products that provide it
What it is
Collection and correlation of logs from identity, endpoints, network, cloud and applications, to detect attacks and support investigations.
How to value it
Without central logs you cannot tell how an attacker got in, what they touched or whether personal data left, and those are the questions regulators ask within days. A SIEM turns scattered logs into detections and evidence, but it needs maintained detection content and people to be worth its cost.
Questions to ask a vendor
- 1How is pricing calculated (data volume, users, assets), and how predictable is it?
- 2Which detections come out of the box, and how are they kept current?
- 3How long is data kept, and can we search it quickly during an incident?
- 4Can it automate common responses?
For your risk register
- Risk
- Attacks go unnoticed, and incidents cannot be investigated or reported in time.
- Control
- SIEM with the core log sources and maintained detections.
- Owner
- Security operations lead.
- Measure
- Share of critical systems sending logs.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Elastic Security
SIEM and endpoint security built on Elasticsearch, with open detection rules.
Google Security Operations
Cloud SIEM and SOAR, formerly Chronicle.
Guardsix SIEM
SIEM with automation, developed and hosted in Europe.
Microsoft Sentinel
Cloud SIEM and automated response, built on Azure.
Cortex XSIAM
AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.
Splunk Enterprise Security
SIEM for detection, investigation and response, on premises or in the cloud.
Agentic Detection
Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.
Recent stories it addresses
431 stories in total- 13 Nov 2026Microsoft Struggles to Restore Email and Other Services in a Global Outage
Microsoft's global outage impacts Exchange Online, Outlook, Teams across multiple regions.
- 13 Nov 2026Microsoft 365 Massive Outage – Fixes Fail as Restored Servers Keep Going Unresponsive
Microsoft 365 experiences a massive global outage as fixes fail to restore server stability.
- 12 Nov 2026Self-hosted Claude Managed Agents keeps agent credentials in your environment
Anthropic releases self-hosted Claude Managed Agents for private beta.
- 12 Nov 2026When Attackers Move at AI Speed, How Can Your SOC Keep Up?
AI accelerates cyberattacks, pressuring SOCs to investigate faster amid rising threats.
- 12 Nov 2026Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender
Citrus ransomware group uses Windows Group Policy to deploy malware and disable Microsoft Defender.
- 11 Nov 2026eMudhra revokes 8 more CA certificates after private key mishap
eMudhra revokes 8 more CA certificates due to improper private key handling.
- 11 Nov 2026eBPF Rootkits: Why Underground Actors Are Taking Notice
Linux eBPF rootkits are spreading via underground forums, sharing code and tutorials.
- 11 Nov 2026Poland shuts down government services platform ePUAP following cyberattack
Poland shuts down government services platform ePUAP following cyberattack.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.