SIEM Tools

AWS managed threat detection service that monitors CloudTrail, VPC Flow Logs, and DNS logs for anomalies across accounts and workloads.

MITRE web tool for annotating ATT&CK matrices and visualizing detection and adversary coverage.

Commercial Open NDR platform built on Zeek, Suricata, and YARA with sensors and cloud management.

Open source analysis and response engine that automates observable enrichment and incident actions.

Cloud-delivered endpoint security platform combining NGAV, EDR, threat intelligence, and managed hunting.

Blue team tool that scores log source visibility and detection coverage into ATT&CK Navigator layers.

SIEM and XDR built on the Elastic Stack with open detection rules and endpoint integration.

Open device management and osquery fleet platform for querying and managing endpoints.

Cloud-native SIEM and SOAR platform, formerly Google Chronicle, with retro-hunting over year-long retention.

Open core log management platform with SIEM features, event definitions, and alerting.

SecOps cloud platform providing EDR sensor infrastructure, telemetry pipelines, and detection APIs.

Microsoft enterprise EDR covering Windows, macOS, Linux, and mobile from one console.

Cloud-native SIEM and SOAR running on Azure with per-GB analytics pricing.

Open source SIEM plugin for OpenSearch with native Sigma rule support and free alerting.

Go-based fleet manager for osquery endpoints with admin UI, REST API, and distributed query management for scalable telemetry.

Operating system instrumentation framework that exposes low-level system telemetry as SQL tables for security monitoring.

Open source host-based intrusion detection with log analysis, file integrity monitoring, and active response.

Open source framework that analyzes Zeek logs for C2 beaconing, DNS tunneling, and scanning.

Free Linux distribution bundling network monitoring, intrusion detection, and log management.

AI-driven endpoint platform with autonomous response, story-line detection, and 1-year data retention.

Open-source SOAR platform that automates security workflows, integrates threat intelligence and case tools, and supports hybrid deployments.

Generic signature format for describing log detection rules, enabling portable threat detections across different SIEMs.

Open-source network intrusion detection and prevention engine that inspects traffic with rule-based signatures and protocol analysis.

Search-driven SIEM and observability platform, owned by Cisco since 2024.

Windows Sysinternals service that logs detailed process, network, and file activity to the event log.

Open source SOAR platform with workflow automation, cases, and AI-assisted playbook building.

Free online translator that converts Sigma and Roota rules into SIEM, EDR, and data lake query languages.

Open-source SIEM and XDR platform providing endpoint monitoring, log analysis, file integrity checks, and threat detection.

Pattern-matching engine that helps malware researchers identify and classify binary samples based on text and binary rules.