Abstract Composable SIEM
SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.
Logging & Monitoring
Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
Addresses 88 stories in our coverage in the last 90 days 8 products that provide it
What it is
Collection and correlation of logs from identity, endpoints, network, cloud and applications, to detect attacks and support investigations.
How to value it
Without central logs you cannot tell how an attacker got in, what they touched or whether personal data left, and those are the questions regulators ask within days. A SIEM turns scattered logs into detections and evidence, but it needs maintained detection content and people to be worth its cost.
Questions to ask a vendor
- 1How is pricing calculated (data volume, users, assets), and how predictable is it?
- 2Which detections come out of the box, and how are they kept current?
- 3How long is data kept, and can we search it quickly during an incident?
- 4Can it automate common responses?
For your risk register
- Risk
- Attacks go unnoticed, and incidents cannot be investigated or reported in time.
- Control
- SIEM with the core log sources and maintained detections.
- Owner
- Security operations lead.
- Measure
- Share of critical systems sending logs.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Elastic Security
SIEM and endpoint security built on Elasticsearch, with open detection rules.
Google Security Operations
Cloud SIEM and SOAR, formerly Chronicle.
Guardsix SIEM
SIEM with automation, developed and hosted in Europe.
Microsoft Sentinel
Cloud SIEM and automated response, built on Azure.
Cortex XSIAM
AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.
Splunk Enterprise Security
SIEM for detection, investigation and response, on premises or in the cloud.
Agentic Detection
Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.
Recent stories it addresses
386 stories in total- 16 Oct 2026Cybersecurity incident at BAE Systems disrupts US bankruptcy court system
Cybersecurity incident at BAE Systems disrupts US bankruptcy court system operations.
- 16 Oct 2026AEPD (Spain) - PS-00028-2026
Spain's AEPD fines cycling federation €4,800 for data breach affecting 261,965 individuals.
- 16 Oct 2026BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts
BAE Systems cyber incident halts US bankruptcy court notices nationwide.
- 13 Oct 2026OpenAI engineer arrested for allegedly planting spy device in office
OpenAI engineer arrested for planting spy device in office to record sensitive conversations.
- 12 Oct 2026Anthropic takes risky AI tests offline after models breach govt sites
Anthropic pulls AI models offline after they exploited US government websites.
- 10 Oct 2026Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
Anthropic disables live internet access for internal Claude tests after discovering AI model exploited injection flaws
- 9 Oct 2026ANSPDCP (Romania) - Fine against GLOBAL CUSTOMER CARE SERVICES S.R.L
Romania's ANSPDCP fines Global Customer Care Services S.R.L. €5,000 for data breach.
- 8 Oct 2026Swedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensure information security
Swedish DPA fines Miljödata EUR 160K for insufficient security measures after 2.2M-person breach
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.