Detect: monitor and alert

Spot attacks in progress: SIEM, endpoint detection and database monitoring (NIST CSF: Detect).

Up to five options per category, in alphabetical order: the order means nothing and nothing here is a ranking, a recommendation or an endorsement. We earn nothing from any vendor. For wider market coverage, see analyst reports such as Gartner Magic Quadrants and Forrester Waves, and test any tool against your own needs.

SIEM (security information and event management)

Collects logs, correlates them and raises alerts; the core of most SOCs.

Name	What it is	Type
Google Security Operations	Google Cloud's SIEM and SOAR (formerly Chronicle).	Paid
Microsoft Sentinel	Microsoft's cloud-native SIEM.	Paid
Security Onion	Open-source platform for threat hunting, network monitoring and log management.	Open source
Splunk Enterprise Security	Splunk's SIEM.	Paid
Wazuh	Open-source platform for log analysis, intrusion detection and compliance.	Open source

EDR and XDR

Watches laptops and servers for attacker behaviour; XDR adds email, identity and cloud signals.

Name	What it is	Type
CrowdStrike Falcon	Cloud-delivered endpoint protection and EDR.	Paid
Microsoft Defender for Endpoint	Microsoft's endpoint protection and EDR.	Paid
SentinelOne Singularity	Endpoint, cloud and identity protection.	Paid
Velociraptor	Open-source endpoint visibility and digital forensics.	Open source
Wazuh (endpoint agent)	Open-source agent for endpoint monitoring and threat detection.	Open source

Database activity monitoring (DAM)

Records and alerts on who queries which database.

Name	What it is	Type
IBM Guardium	IBM's data activity monitoring and protection.	Paid
Imperva Data Security Fabric	Imperva's data security and database monitoring (part of Thales).	Paid
Oracle Audit Vault and Database Firewall	Oracle's database auditing and SQL firewall.	Paid
pgAudit	Open-source audit logging extension for PostgreSQL.	Open source

Identity threat detection and response (ITDR)

Spots attacks on identity systems such as Active Directory and cloud identity providers.

Name	What it is	Type
BloodHound Community Edition	Open-source tool that maps attack paths in Active Directory and Entra ID.	Open source
CrowdStrike Falcon Identity Protection	CrowdStrike's identity threat detection and response.	Paid
PingCastle	Active Directory security assessment tool with a free edition.	Free
Semperis	Identity threat detection and recovery for Active Directory and Entra ID.	Paid
Silverfort	Identity protection across on-premises and cloud accounts.	Paid

Network detection and response (NDR)

Analyses network traffic to find attackers that endpoint tools do not see.

Name	What it is	Type
Darktrace	AI-based network detection and response.	Paid
ExtraHop	Network detection and response from traffic analysis.	Paid
Suricata	Open-source network intrusion detection and prevention engine.	Open source
Vectra AI	Attack signal detection across network, identity and cloud.	Paid
Zeek	Open-source network security monitor.	Open source