Is there a SIEM benchmark?

Question

System administration

The company decided to buy SIEM in connection with this, I have to provide a comparative analysis of products from leading brands like HP, IBM, etc.
help me find it please.

Answer 1

Comparative analysis based on what criteria? As such, there is no analysis (we read "not in the public domain") - there are many articles on the topic "this is better, this is worse" (Magic Quadrant for Security Information and Event Management sic! ). If comparison is required according to certain technical characteristics, then only write yourself, sorting through many sources and working with stands. I recently went through this painful process. You can start - with these articles - "Overview of SIEM systems"
UPD. I completely forgot about the wonderful, though already old book - David R. Miller <...> Security Information and Event Management (SIEM) Implementation. There is some good food for thought there.

Answer 2

In 2014, I faced the issue of choosing a SIEM for the Bank (it was just a "working solution" that was needed). In my opinion, ArcSight ESM can be singled out among the leaders (I note that many colleagues complain about support), QRadar SIEM, McAfee ESM - but the acquisition and support of systems is beyond our means. As a result, we settled on a commercial version of the popular OSSIM from AlienVault- Unified Security Management (USM). The system includes a Nessus scanner, IDS (a hybrid of Snort and Suricata) and is able to collect NetFlow streams.

Answer 3

Good afternoon, please tell me what qradar & arcsight can do, what zabbix can't?
collects logs perfectly, works on a trigger condition, reads any logs.