Splunk if you have deep pockets. Whatever SIEM you choose, make sure you have an ACTUAL data strategy, with schemas, documentation, logging standards, etc. etc. All of the issues I’ve seen with SIEMs stem from a company that DOES NOT have a data culture and thinks “I’ll just log data and let the analytics sort it out….Fucking. No. More on reddit.com

I want to get a data lake and throw every goddamned thing in it then only pull what's really important out of it to a SIEM using Cribl or some shit and slap a SOAR on it. More on reddit.com

My thoughts are this: For a small company, getting a SIEM is kinda pointless as you don't have the staff to man it properly. This is assuming small company means they are not hiring a security analyst... I would do what someone else did and take the money you are thinking of using for a SIEM, and dump it into a good EDR, Spam Protection, Firewall, Vulnerability Scanner product/service, internet filter. With a small company to me it a mater of getting the biggest bang for your buck and where you feel you are most vulnerable. To me, a SIEM would essentially be last because you don't have the staff to really utilize/watch it. Make sense? Now if you are simply asking what SIEM to use...I am NOT the right person to ask :) More on reddit.com

I personally don’t see a strong case for overlap between a SIEM and an APM platform. Both have their place providing value out of the box (ideally) covering common use cases for their respective audiences, eg, devops want APM that day when a service is degraded whereas security wants a SIEM that alerts on suspicious activity. Where I do think the conversation gets a little grey is application security logs. Those could serve both functions from a devops wanting to see login performance and transaction throughput and essentially the same data in security looking for risky logins or transaction fraud detection. I’m chewing on this very matter myself and I see SIEMs and APM tools both living on but converging on a unified data lake storage solution leveraging lower cost storage for raw logs and then using a parser platform to filter out higher fidelity signals to then pass into the appropriate platform. Ideally this results in cost savings (not ingesting tons into either the SIEM or APM as that’s usually a a cost relative to data ingestion) and then having a analytics tool layered on the data lake which can help with reporting and/or threat hunting should an alert fire. More on reddit.com