![\"\"](\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2017\/12\/Siem.jpg\")
<\/p>\nare<\/p>\n
Analysis and research firm Gartner, Inc. has released the latest iteration of its yearly Magic Quadrant (MQ) for Security Information and Event Management (SIEM)<\/a> in 2017<\/span>. <\/span><\/p>\n Every year, Gartner evaluates the strengths and weaknesses of the SIEM vendors that it considers most significant in the current market and provides readers with a graph\u2014the titular Magic Quadrant\u2014 which plots those vendors based on their ability to execute their platforms and their completeness of vision.<\/span><\/p>\n The 19 vendors in this year\u2019s report, in alphabetical order, are: <\/span><\/p>\n AlienVault, <\/span>BlackStratus, <\/span>EventTracker, <\/span>Exabeam, <\/span>FireEye, <\/span>Fortinet, <\/span>IBM, <\/span>LogRhythm, <\/span>ManageEngine, <\/span>McAfee, <\/span>Micro Focus (ArcSight), <\/span>Micro Focus (NetIQ), <\/span>Rapid7, <\/span>RSA, <\/span>Securonix, <\/span>SolarWinds, <\/span>Splunk, <\/span>Trustwave, and <\/span>Venustech.<\/span><\/p>\n The SIEM 2017 graph is divided into four quadrants: niche players, challengers, visionaries, and leaders. Gartner does not endorse any vendor, product, or service depicted in its research publications, regardless of their position on the quadrant.<\/span><\/p>\n The 2017 SIEM<\/a> Magic Quadrant is the twelfth iteration of the report, which Gartner <\/span>first introduced<\/span> way back in 2005 when their researchers first coined the term. Since then, Gartner has observed the SIEM market mature and increase in competition; the market grew <\/span>from $2.001 billion in 2015 to $2.167 billion in 2016 and is <\/span>projected<\/span> to grow to nearly $6 billion in 2021<\/span>. SIEM is in a period of broad adoption even as growth rates in Asia\/Pacific and Latin America outpace North America and Europe. And with 80% of breaches going undetected by the breached organizations, SIEM solutions are more vital than ever. <\/span><\/p>\n At Solutions Review, we read through the full report<\/span> and pulled a few of the important takeaways and changes since the 2016 report. You can download the 2018 SIEM Magic Quadrant here courtesy of LogRhythm. Here are the SIEM in 2017 findings: <\/span><\/p>\n Before we can explore what\u2019s changed in the past year, we must first review what Gartner\u2019s analysts mean when they discuss SIEM<\/a> and the top players in the field. <\/span><\/p>\n Gartner Analysts define SIEM in 2017 \u201c<\/span>by the customer’s need to analyze event data in real time for the early detection of targeted attacks and data breaches, and to collect, store, analyze, investigate and report on event data for incident response, forensics and regulatory compliance.\u201d<\/span><\/p>\n To put the matter more simply, SIEM allows companies to monitor security events in real-time, analyze those events, and archive them for historical threat analysis and compliance reporting. <\/span><\/p>\n To be considered for inclusion on Gartner\u2019s SIEM Magic Quadrant, vendors must provide both SIM\u2014 which includes <\/span>log management, analytics and compliance reporting<\/span>\u2014and SEM\u2014 which involves <\/span>real-time monitoring and incident management<\/span>\u2014capabilities. <\/span><\/p>\n Additionally, vendors must support data capture from heterogeneous data sources including network devices, security devices, and security programs. Their solution must be delivered to the customer environment as a software or appliance based-product, or via an as-a-service model. <\/span><\/p>\n Gartner excluded vendors who did not appear on the SIEM product evaluation lists of end-user organizations or whose SIEM revenue was less than $15 million over the past year from the Magic Quadrant. <\/span><\/p>\n With that established, let\u2019s see what has changed on the Magic Quadrant for SIEM in 2017.\u00a0You can download the 2018 SIEM Magic Quadrant here<\/a> courtesy of LogRhythm.\u00a0<\/span><\/p>\n According to Gartner\u2019s report, the SIEM vendor landscape is evolving. Sure enough, while there were a lot of veterans of the Magic Quadrant operating under new names–Fortinet instead of AccelOps, for instance\u2014there were a surprising number of outright new vendors who made the quadrant this year: <\/span>Venustech, Securonix, Rapid7, Micro Focus (ArcSight), FireEye, and Exabeam. \u00a0<\/span><\/p>\n Gartner\u2019s states in its report that a vendor\u2019s appearance or disappearance from the quadrant is not a reflection of change in quality or opinion, but simply market changes and inclusion criteria. They also noted that many of the new vendors have added SIEM functionality to their preexisting User and Entity Behavior Analysis (UEBA)-focused products. In the case of FireEye, it added SIEM as a service to its threat detection platform. <\/span><\/p>\n Many of these new software platforms are user-based rather than IP address or hostname-based in their monitoring practices, as befits outgrowths of UEBA technology. Gartner notes that this may yet change the market once again in the near future as customers adjust to the deluge of new approaches. <\/span><\/p>\n Vendors in Gartner\u2019s SIEM<\/a> Leaders Quadrant are judged by the strength of their products\u2019 against general market requirements, their success at building an installed revenue stream, and their visibility. <\/span><\/p>\n Gartner notes that the leading vendors continue to command more than 60% of the SIEM market\u2019s revenue. Each displays an emphasis on anomaly detection, threat analytics, and endpoint and network activity monitoring in their solutions. <\/span><\/p>\n This year the Leaders Quadrant was once again dominated by recognizable names from 2016: Splunk, LogRhythm, and IBM. Intel Security did not appear in the quadrant this year, as their affiliation with McAfee ended in April and the latter resumed operating as an independent entity. McAfee did appear in the Leaders Quadrant, but is lower in the rankings than the other leaders. Splunk, meanwhile, rose slightly in its positioning. \u00a0<\/span><\/p>\n But the major difference for the Leaders Quadrant in 2017 is the conspicuous absence of HP or HPE related vendors. Gartner stated that this year HPE closed a business deal with Micro Focus while its ArcSight architecture was still being updated, leaving the software\u2019s status ambiguous. Micro Focus has stated it will continue investing in the program, but Gartner noted licensing and architecture issues persisted for the solution. <\/span><\/p>\n Gartner predicted in the 2016 SIEM<\/a> Magic Quadrant that at least 60% of major vendors will incorporate advanced analytics and UEBA functionality into their products. With the recent expansion of SIEM software stemming from UEBA tools from many vendors, their prediction appears to be fairly accurate. However, other leaders\u2014even leaders such as LogRhythm and visionaries such as Rapid7\u2014offer solutions that have trouble integrating with third-party UEBA programs. \u00a0<\/span>\u00a0<\/b><\/p>\n In response to changing demands in the SIEM marketplace, Gartner\u2019s analysts placed greater weight on capabilities that aid in targeted in attack detection when considering vendors this year. However, they noted that threat management is still the primary driver of demand in the field. General monitoring and compliance reporting came second in the minds of security professionals.<\/span><\/p>\n SIEM has garnered even more attention in the few months since Gartner released this report just a few months ago. Compliance, once the primary interest driving enterprises to this solution, has taken something of a backseat to threat management. As more cybersecurity experts and solutions architects have come to terms with the idea that even the best preventative cybersecurity measures won’t be 100% effective, detection has become the new paradigm in digital safety.<\/p>\n Reducing attacker dwell time and gaining visibility into IT environments are more important than ever before. SIEM<\/a> has risen to prominence as a result. We can’t be sure how this might effect Gartner’s proprietary decision-making process for the Magic Quadrant next year, but we suspect it may influence how they perceive market-shares and persuade them to reduce the importance of compliance capabilities when selecting their Leaders, Visionaries, Challengers, and Niche Players.<\/p>\n\t\t\t![\"Download](\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2020\/02\/SIEM_VM_SB.jpg\")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\nHow Gartner Defines SIEM<\/b><\/h3>\n
A Year of New Names in SIEM in 2017<\/b><\/h3>\n
The Same Vendors Remain \u201cLeaders,\u201d With One Difference<\/b><\/h3>\n
Changing Demands, Changing Programs <\/b><\/h3>\n
The Perspective on SIEM in 2017 From 2018<\/strong><\/h3>\n