As all of you know, Gartner SIEM MQ 2011 is out – you can see it here (or here) without registration. The quadrant mostly matches my recent SIEM project experience.
My observations follow below:
- CA “SIEM” and “Log Manager” are finally wiped off the face of the Earth (=removed from SIEM MQ), NetIQ is dumped down to the Niche. As they should be.
- Honestly, Symantec SSIM in Leaders is a mystery to me; must be those invisible non-competitive deals or EU/APAC deals. I’ve not seen them on an enterprise SIEM shortlist in the US for a loooooooong time. The rest of the leaders match my expectations fully (and four of them have been at some point my consulting clients)
- Splunk is now officially a [sub-par] SIEM, even though it is really not. Is that good or bad? Well, they got their “honorable mention” for the last few years and now they are in the quadrant. BTW, this example shows that you can make A LOT of money by being free and not in any Magic Quadrant!
- Visionary sector of the MQ galaxy is extremely crowded – but with very different tools, ranging from Prism to Trustwave. Many organizations will choose a tool from this sector, but need to be careful – read the related posts below for some selection ideas and pitfalls.
BTW, congrats to all the vendors who got added this year: AlienVault, Tripwire, splunk and the regional SIEM guys.
As always, apart from insight, the MQ document has a good share of unintentional hilarity, for example:
- “This company declined to provide any information to Gartner for this research” (Darwin Awards anybody?)
- “Customer feedback on product function and support is mixed.” (Anton translation: product usually doesn’t work?)
- “Non-English-language versions of XYZ are not available.” (Anton’s comment: is everything else about the product perfectly perfect?)
Finally, if anybody is wondering, I think the concept of Magic Quadrant (whoever at Gartner came up with) is brilliant. However, many wrong SIEM purchase decisions I’ve seen made usually stem from the decision maker’s own ignorance and not from whatever document or market visualization he has in his possession. Keep this in mind…
Rocky, your turn! 
Possibly related posts:
- How Do I Get The Best SIEM?
- How to Replace a SIEM?
- SIEM Resourcing or How Much the Friggin’ Thing Would REALLY Cost Me?
- How to Write an OK SIEM RFP?
- On Choosing SIEM
- "So, What Should I Want?" or How NOT to Pick a SIEM-III?
- The Myth of SIEM as "An Analyst-in-the-box" or How NOT to Pick a SIEM-II?
- I Want to Buy Correlation” or How NOT to Pick a SIEM?
- Log Management + SIEM = ?
- On SIEM Complexity
- SIEM Bloggables: SIEM Use Cases and Whitepaper with detailed SIEM use cases
- Log Management / SIEM Users: "Minimalist" vs "Analyst"
- All posts labeled SIEM
