SIEM and log management

Open-source alternatives to commercial SIEM and log platforms.

Splunk

Splunk Enterprise and Splunk Cloud Platform, now owned by Cisco, against self-hosted open-source SIEM and log stacks built on Wazuh and OpenSearch.

Microsoft Sentinel

Microsoft Sentinel, the cloud SIEM billed through Azure and moving to the Microsoft Defender portal, against self-hosted Wazuh and OpenSearch.

IBM QRadar

IBM QRadar SIEM on premises, after its SaaS business moved to Palo Alto Networks, against self-hosted Wazuh and OpenSearch.

Sumo Logic

Sumo Logic, the SaaS log analytics and cloud SIEM owned by Francisco Partners, against self-hosted OpenSearch and Wazuh.

Google Security Operations

Google Security Operations (formerly Chronicle) is Google Cloud's SIEM and SOAR service, sold in packages priced on ingestion. Pages here cover replacing it with self-hosted Wazuh, OpenSearch and Shuffle.

LogRhythm

LogRhythm SIEM is the self-hosted SIEM sold by Exabeam since the 2024 merger. Pages here cover replacing it with self-hosted Wazuh, OpenSearch or Graylog.

Cribl

Cribl Stream is a commercial telemetry pipeline that routes, filters and reshapes logs before they reach a SIEM, sold as a cloud service or self-managed license. Pages here cover replacing it with Fluent Bit, Fluentd or the OpenTelemetry Collector.

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.
Book a callhello@deployopen.com