[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:security-monitoring-siem":3},{"control":4,"products":25,"stories":90,"lessons":134,"related":159,"compare":188},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.","Collection and correlation of logs from identity, endpoints, network, cloud and applications, to detect attacks and support investigations.","Without central logs you cannot tell how an attacker got in, what they touched or whether personal data left, and those are the questions regulators ask within days. A SIEM turns scattered logs into detections and evidence, but it needs maintained detection content and people to be worth its cost.",[11,12,13,14],"How is pricing calculated (data volume, users, assets), and how predictable is it?","Which detections come out of the box, and how are they kept current?","How long is data kept, and can we search it quickly during an incident?","Can it automate common responses?","Risk: attacks go unnoticed, and incidents cannot be investigated or reported in time. Control: SIEM with the core log sources and maintained detections. Owner: security operations lead. Measure: share of critical systems sending logs.",[17,18,19,20],"NIS2 Art. 21(2)(b) and Art. 23: incident handling and reporting","DORA Art. 10 and 17: detection and incident management","CIS Control 8: audit log management","ISO\u002FIEC 27001:2022 A.8.15 and A.8.16: logging and monitoring",{"name":22,"slug":23},"Logging & Monitoring","logging-monitoring","2026-10-16T12:48:13.619782+00:00",[26,34,42,50,58,66,74,82],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"total":91,"last_days":92,"recent":93},433,122,[94,99,104,109,114,119,124,129],{"slug":95,"title":96,"published_at":97,"brief":98},"microsoft-365-crawls-back-to-life-after-a-24-hour-outage-6b7a92","Microsoft 365 Crawls Back to Life After a 24-Hour Outage","2026-11-13T19:08:57+00:00","Microsoft 365 outage affecting 70+ countries caused by bad network update, not cyberattack.",{"slug":100,"title":101,"published_at":102,"brief":103},"the-microsoft-outage-is-a-warning-for-the-world-aa3046","The Microsoft Outage Is a Warning for the World","2026-11-13T17:15:54+00:00","Microsoft 365 outage impacts Outlook, Teams, and Copilot globally for a second day.",{"slug":105,"title":106,"published_at":107,"brief":108},"microsoft-struggles-to-restore-email-and-other-services-in-a-global-outage-d96956","Microsoft Struggles to Restore Email and Other Services in a Global Outage","2026-11-13T13:47:42+00:00","Microsoft's global outage impacts Exchange Online, Outlook, Teams across multiple regions.",{"slug":110,"title":111,"published_at":112,"brief":113},"microsoft-365-massive-outage-fixes-fail-as-restored-servers-keep-going-unrespons-873bde","Microsoft 365 Massive Outage – Fixes Fail as Restored Servers Keep Going Unresponsive","2026-11-13T06:52:50+00:00","Microsoft 365 experiences a massive global outage as fixes fail to restore server stability.",{"slug":115,"title":116,"published_at":117,"brief":118},"self-hosted-claude-managed-agents-keeps-agent-credentials-in-your-environment-a53dac","Self-hosted Claude Managed Agents keeps agent credentials in your environment","2026-11-12T18:07:00+00:00","Anthropic releases self-hosted Claude Managed Agents for private beta.",{"slug":120,"title":121,"published_at":122,"brief":123},"when-attackers-move-at-ai-speed-how-can-your-soc-keep-up-23c69f","When Attackers Move at AI Speed, How Can Your SOC Keep Up?","2026-11-12T16:15:30+00:00","AI accelerates cyberattacks, pressuring SOCs to investigate faster amid rising threats.",{"slug":125,"title":126,"published_at":127,"brief":128},"hackers-abuse-windows-group-policy-to-deploy-citrus-ransomware-and-disable-micro-c82f42","Hackers Abuse Windows Group Policy to Deploy Citrus Ransomware and Disable Microsoft Defender","2026-11-12T06:46:42+00:00","Citrus ransomware group uses Windows Group Policy to deploy malware and disable Microsoft Defender.",{"slug":130,"title":131,"published_at":132,"brief":133},"emudhra-revokes-8-more-ca-certificates-after-private-key-mishap-c13c66","eMudhra revokes 8 more CA certificates after private key mishap","2026-11-11T21:27:40+00:00","eMudhra revokes 8 more CA certificates due to improper private key handling.",[135,139,143,147,151,155],{"slug":136,"title":137,"published_at":138},"microsoft-365-outage-exposes-risks-of-unvalidated-network-changes","Microsoft 365 Outage Exposes Risks of Unvalidated Network Changes","2026-11-13T20:20:57.119+00:00",{"slug":140,"title":141,"published_at":142},"microsoft-365-cascading-failure-exposes-risks-of-hyperscaler-dependency","Microsoft 365 Cascading Failure Exposes Risks of Hyperscaler Dependency","2026-11-13T18:20:58.32+00:00",{"slug":144,"title":145,"published_at":146},"faulty-update-triggers-global-microsoft-outage-echoing-crowdstrike-incident","Faulty Update Triggers Global Microsoft Outage, Echoing CrowdStrike Incident","2026-11-13T14:20:22.59+00:00",{"slug":148,"title":149,"published_at":150},"microsoft-365-global-outage-exposes-gaps-in-resilience-and-configuration-recovery","Microsoft 365 Global Outage Exposes Gaps in Resilience and Configuration Recovery","2026-11-13T08:21:35.526+00:00",{"slug":152,"title":153,"published_at":154},"self-hosted-ai-agents-demand-rigorous-credential-and-configuration-controls","Self-Hosted AI Agents Demand Rigorous Credential and Configuration Controls","2026-11-12T19:21:17.711+00:00",{"slug":156,"title":157,"published_at":158},"ai-accelerated-attacks-are-outpacing-human-speed-soc-defenses","AI-Accelerated Attacks Are Outpacing Human-Speed SOC Defenses","2026-11-12T17:22:09.493+00:00",[160,164,168,172,176,180,184],{"slug":161,"name":162,"problem":163},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":165,"name":166,"problem":167},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",{"slug":169,"name":170,"problem":171},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",{"slug":173,"name":174,"problem":175},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",{"slug":177,"name":178,"problem":179},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":181,"name":182,"problem":183},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",{"slug":185,"name":186,"problem":187},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"microsoft\u002Fsentinel":189,"palo-alto-networks\u002Fcortex-xsiam":207,"google\u002Fgoogle-security-operations":225,"elastic\u002Felastic-security":242,"splunk\u002Fenterprise-security":261,"guardsix\u002Fguardsix-siem":277,"abstract-security\u002Fabstract-composable-siem":287,"vega\u002Fvega-agentic-detection":290},{"hq_country":190,"also_provides":191,"reviews":192,"affected":205,"reported":206},"US",[],[193,196,199,202],{"label":194,"url":195},"AV-TEST: business results for Microsoft Defender","https:\u002F\u002Fwww.av-test.org\u002Fen\u002Fantivirus\u002Fbusiness-windows-client\u002Fmanufacturer\u002Fmicrosoft\u002F",{"label":197,"url":198},"ITPro: Microsoft Defender for Business review (2024)","https:\u002F\u002Fwww.itpro.com\u002Fcloud\u002Fcloud-security\u002Fmicrosoft-defender-for-business-review-feature-filled-enterprise-security-for-small-businesses",{"label":200,"url":201},"Gartner Peer Insights: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fmicrosoft-defender-for-endpoint",{"label":203,"url":204},"PeerSpot: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fmicrosoft-defender-for-endpoint-reviews",311,128,{"hq_country":190,"also_provides":208,"reviews":210,"affected":223,"reported":224},[209],{"slug":169,"name":170},[211,214,217,220],{"label":212,"url":213},"AV-Comparatives EPR test 2026: Palo Alto Networks","https:\u002F\u002Fwww.av-comparatives.org\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FEPR_PaloAlto_2026.pdf",{"label":215,"url":216},"CyberRatings 2025 Q4 Enterprise Firewall Report: Palo Alto Networks follow-on","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q4-enterprise-firewall-report-palo-alto-networks-follow-on\u002F",{"label":218,"url":219},"Gartner Peer Insights: PA-Series user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fpa-series",{"label":221,"url":222},"PeerSpot: Palo Alto Networks NG Firewalls user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fpalo-alto-networks-ng-firewalls-reviews",22,43,{"hq_country":190,"also_provides":226,"reviews":227,"affected":240,"reported":241},[],[228,231,234,237],{"label":229,"url":230},"Gartner Peer Insights: Google SecOps user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fgoogle-secops",{"label":232,"url":233},"PeerSpot: Mandiant Advantage user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fmandiant-advantage-reviews",{"label":235,"url":236},"CSO Online: Top 10 vendors for AI-enabled security, according to CISOs (2026)","https:\u002F\u002Fwww.csoonline.com\u002Farticle\u002F4115785\u002Ftop-10-vendors-for-ai-enabled-security-according-to-cisos.html",{"label":238,"url":239},"CSO Online: SOAR buyer's guide: 11 security orchestration, automation, and response products (2025)","https:\u002F\u002Fwww.csoonline.com\u002Farticle\u002F3622920\u002Fsoar-buyers-guide-11-security-orchestration-automation-and-response-products-and-how-to-choose.html",155,146,{"hq_country":243,"also_provides":244,"reviews":246,"affected":259,"reported":260},null,[245],{"slug":161,"name":162},[247,250,253,256],{"label":248,"url":249},"AV-Comparatives EPR test 2026: Elastic","https:\u002F\u002Fwww.av-comparatives.org\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FEPR_Elastic_2026.pdf",{"label":251,"url":252},"AV-Comparatives: Business Security Test H1 2026 (March to June)","https:\u002F\u002Fav-comparatives.org\u002Ftests\u002Fbusiness-security-test-2026-march-june\u002F",{"label":254,"url":255},"Gartner Peer Insights: Elastic Security user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Felastic-security",{"label":257,"url":258},"PeerSpot: Elastic Security user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Felastic-security-reviews",0,8,{"hq_country":190,"also_provides":262,"reviews":263,"affected":276,"reported":259},[],[264,267,270,273],{"label":265,"url":266},"PeerSpot: Splunk Enterprise Security user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsplunk-enterprise-security-reviews",{"label":268,"url":269},"Gartner Peer Insights: Splunk Enterprise Security user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fsplunk-enterprise-security",{"label":271,"url":272},"PeerSpot: Splunk SOAR user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsplunk-soar-reviews",{"label":274,"url":275},"CSO Online: Where CISOs need to see Splunk go next (2025)","https:\u002F\u002Fwww.csoonline.com\u002Farticle\u002F4058991\u002Fwhere-cisos-need-to-see-splunk-go-next.html",4,{"hq_country":278,"also_provides":279,"reviews":280,"affected":259,"reported":259},"DK",[],[281,284],{"label":282,"url":283},"Gartner Peer Insights: Guardsix SIEM user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fguardsix-siem",{"label":285,"url":286},"PeerSpot: Logpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Flogpoint-reviews",{"hq_country":190,"also_provides":288,"reviews":289,"affected":259,"reported":259},[],[],{"hq_country":291,"also_provides":292,"reviews":293,"affected":259,"reported":294},"IL",[],[],1]