Being in the Gartner magic quadrant is as prestigious as a JD Power Award for initial quality More on reddit.com

When it comes to SIEMs, anything useful will usually also be expensive.

Are you heavily invested in Azure/M365/MDE? If yes, then my suggestion is to take a look at Microsoft Sentinel. Be warned that pricing is a per GB data ingested model, so run some calculations to see if it is cost-effective.

Splunk+Enterprise Security is the gold standard, but also very expensive and requires expertise to manage the infrastructure, unless you go Splunk Cloud.

I personally wouldn't recommend the open-source route unless you have a lot of time to spare, even though platforms like ELK and Wazuh have come a long way.

More on reddit.com

The job is asking you to to do a CISO or CTO's job here. That seems a bit rich for entry-level security, honestly. Either way, I would consider price, support for the technology stack and Saas/Cloud providers they use, log sources support for OSes they use and on-prem tech like firewalls if they're not SD-WAN, and how they perform in things like Gartner MQ for SIEM (I'm no fan, but it shows you are thinking business). If you have the requirements for the scenario, make a spreadsheet with them as rows and at least three separate SIEM solutions as columns and then fill out notes and qualitative ratings on each. If they missed obvious things like cost and ease of implementation add them but don't "I told you so" with that. Good luck! More on reddit.com

Only your org can decide if it's right for them. SIEM is a very broad area but in my experience it's almost never the SIEM itself that fails, it's the lack of planning, process and skills around it. I worked at a major MSSP and one very common occurrence was for us to get called in after an org tried and gave up running their own SIEM in house. Many went all in on something like Splunk and only dedicated 2-3 people at most to the effort, quite often with no prior experience. Those poor souls stood no chance, especially in more complex orgs. Our org is moving off of Exabeam mostly because we're an MS E5 customer and feel we will be able to do the same with MS Sentinel as we're a heavy Azure customer. More on reddit.com