Best SIEM Tools in 2026: 12 Platforms Ranked

The best SIEM tool in 2026 is the one that matches where your telemetry already lives. For a large enterprise SOC the shortlist is Splunk Enterprise Security, Microsoft Sentinel, Cortex XSIAM, CrowdStrike Falcon Next-Gen SIEM and Google Security Operations. Mid-size teams should add Rapid7 and Elastic to that list, and anyone building a home lab should start with Wazuh. The market also looks different from two years ago: Cisco owns Splunk, IBM sold QRadar SaaS to Palo Alto Networks, and LogRhythm is now part of Exabeam. Every entry below was re-checked against the vendor's own site on September 26, 2026.

Every SIEM on this list exists to answer the same question: out of everything your environment logs each second, which events matter? They differ in the query language they give you, in how they group related events into one alert, and in how long it takes someone new to the console to do useful triage. We build a simulated SIEM for hands-on training, along with XDR and firewall consoles, at SOCSimulator and watch analysts work them every day, so this list is written from the analyst's seat.

What Changed Since the Last Version

Most "best SIEM" lists still describe the 2023 market. Four ownership changes and one portal move matter if you are buying a SIEM, or reading a job ad that names one.

Product	Who sells it in 2026	What changed	Source
Splunk Enterprise Security	Cisco	Cisco's acquisition of Splunk closed on March 18, 2024	Cisco newsroom
QRadar SaaS	Palo Alto Networks	Palo Alto closed the purchase of IBM's QRadar SaaS assets on September 4, 2024 and offers eligible customers migration to Cortex XSIAM at no cost	Palo Alto Networks press release
QRadar SIEM (on-prem)	IBM	Same release: on-prem customers keep receiving IBM features and support, and IBM still sells QRadar SIEM	IBM QRadar SIEM
LogRhythm SIEM	Exabeam	Exabeam and LogRhythm completed their merger on July 17, 2024; LogRhythm SIEM is now Exabeam's self-hosted SIEM, next to the cloud-native New-Scale Fusion	Exabeam press release
Sumo Logic	Francisco Partners (private)	Acquisition closed May 12, 2023; the stock left Nasdaq	Sumo Logic newsroom
Rapid7 InsightIDR	Rapid7	Now sold as Incident Command; the old InsightIDR product page redirects there and the docs are titled "SIEM (InsightIDR)"	Rapid7 SIEM packages
Microsoft Sentinel	Microsoft	Generally available in the Defender portal; after March 31, 2027 it is no longer supported in the Azure portal	Microsoft Learn

For an analyst this has two practical effects. A job ad asking for "QRadar" may now mean a team halfway through a move to XSIAM, so expect to meet XQL as well as AQL. And screenshots in older Sentinel training show the Azure portal, while new deployments will live in the Defender portal.

How We Ranked These SIEM Tools

The order reflects four questions, weighted in this order:

1. What does an analyst do in it all day? Query language, how the alert queue and investigation view work, how quickly you can pivot from an alert to related events. This carries the most weight because it is what you are judged on during a shift.
2. Where does it fit? Which telemetry it ingests natively and which security stack it assumes you already run.
3. How is it billed? The billing unit shapes which logs a SOC keeps, and so which questions you can answer (more on that below).
4. How stable is it? Ownership changes and product renames, because a SIEM migration eats a SOC's year.

What we did not do: run a performance benchmark, or rank by market share or customer counts. Vendors do not publish comparable numbers, and we are not going to make them up. Prices are not listed because none of the enterprise platforms here publishes a full price list; the billing model is listed instead, taken from each vendor's pricing or product page. SOCSimulator is a training platform, not a SIEM, so it is not in the ranking.

SIEM Comparison Table

#	Tool	Owner	Deployment	Query language	Billing model	Best for
1	Splunk Enterprise Security	Cisco	Cloud, on-prem, hybrid	SPL	Activity-based, workload or ingest (your choice)	Large SOCs with years of SPL content
2	Microsoft Sentinel	Microsoft	SaaS (Azure, Defender portal)	KQL	Per GB: pay-as-you-go or commitment tiers, plus a data lake tier	Microsoft 365 and Azure estates
3	Cortex XSIAM	Palo Alto Networks	SaaS	XQL	Quote only	Palo Alto estates, QRadar SaaS migrations
4	CrowdStrike Falcon Next-Gen SIEM	CrowdStrike	SaaS	CQL	Quote; licensed Falcon module data carries no extra ingestion charge	CrowdStrike endpoint shops
5	Google Security Operations	Google Cloud	SaaS	YARA-L rules, UDM search	Packages based on ingestion, 12 months hot retention	High-volume, long-lookback hunting
6	Elastic Security	Elastic	Self-managed or Elastic Cloud	ES|QL, EQL	Compute and storage	Teams that run their own infrastructure
7	IBM QRadar SIEM	IBM	On-prem software	AQL	Sized by events per second (EPS)	Regulated, network-heavy estates staying on-prem
8	Rapid7 Incident Command	Rapid7	SaaS	LEQL	Per asset	Lean mid-size teams
9	Exabeam (New-Scale Fusion, LogRhythm SIEM)	Exabeam	SaaS, or self-hosted for LogRhythm	Built-in search	Quote; LogRhythm as subscription or perpetual license	Tier 2 investigation, UEBA
10	Securonix Unified Defense SIEM	Securonix	SaaS	Built-in search	Quote only	Insider threat, UEBA-first programs
11	Sumo Logic Cloud SIEM	Francisco Partners	SaaS	Sumo Logic search query language	Sumo Credits: ingest tiers, or Flex with search billed separately	DevSecOps teams sharing an observability stack
12	Wazuh	Wazuh Inc.	Self-hosted, or hosted by Wazuh	XML rules	Free, open source (GPLv2)	Home labs, small teams

1. Splunk Enterprise Security

Splunk Enterprise Security gives analysts the most flexible search language on this list, SPL, and has been a Cisco product since March 2024.

Splunk's Search Processing Language (SPL) is what analysts learn when they want maximum flexibility. SPL is verbose by design: every transformation is explicit, so a long multi-step query stays readable to someone who did not write it. The learning curve is real, and the payoff is a query environment that can answer almost any investigative question, provided the data was indexed.

The Enterprise Security Content Updates (ESCU) pack gives teams a maintained detection library mapped to MITRE ATT&CK. For Tier 1, risk-based alerting matters most: low-level detections add risk to a user or host, and the queue shows the entity that crossed a threshold rather than every raw match. That structure supports the TP or FP decision covered in the alert triage guide. Splunk also ships an AI Assistant inside Enterprise Security for query help, summaries and reports, and sells ES in two editions, Essentials and Premier.

On cost, the old "Splunk bills by volume" line is out of date. Splunk Cloud Platform now lets a customer pick activity-based, workload or ingest pricing, which changes the conversation for teams that ingest a lot and search a little. Splunk's certification track for analysts starts with Core Certified User and Power User.

Best for: Large enterprise SOCs, hybrid environments, analysts targeting senior roles at large employers.

Skip it if: Nobody on the team will own SPL detections long term. Splunk's value comes from the searches and detections your team writes and keeps tuned.

Splunk Enterprise Security →

2. Microsoft Sentinel

Microsoft Sentinel is Microsoft's cloud-native SIEM, queried with Kusto Query Language (KQL) and built for organizations already running Microsoft 365, Defender and Azure.

For those organizations Sentinel is the natural place to aggregate: connectors for Microsoft sources are native, and an analyst can move from a Sentinel incident to a Defender for Endpoint device timeline without leaving the console. That console is now the Defender portal. Microsoft says Sentinel is generally available there even for customers without Defender XDR or an E5 license, and that after March 31, 2027 it will no longer be supported in the Azure portal. If you are learning Sentinel today, learn it in the Defender portal.

KQL is the most learnable SIEM query language for someone starting fresh. Operators chain with pipes and read top to bottom, and Microsoft Learn's training costs nothing. Our KQL tutorial for SOC analysts walks through the operators you will use in the first month.

Sentinel pricing has two data tiers. The analytics tier supports full detections and queries and is billed pay-as-you-go or through commitment tiers that reserve 100 GB to 50,000 GB of daily ingestion. The data lake tier is cheaper long-term storage for investigations and compliance. Where a log lands decides what an analytics rule can see, so ask which tier a source goes to before assuming a detection covers it.

Best for: Organizations on Microsoft 365 or Azure, analysts targeting roles at Microsoft-first enterprises.

Skip it if: Most of your volume is non-Microsoft network telemetry (firewall, DNS, proxy) and you cannot tier it. That is the data that makes per-GB analytics billing climb.

Microsoft Sentinel →

3. Cortex XSIAM

Cortex XSIAM is Palo Alto Networks' SOC platform: SIEM, SOAR, EDR, NDR and cloud detection on one data layer, queried with XQL, and the official landing spot for former QRadar SaaS customers.

XSIAM does not sell itself as a SIEM. The product page lists SIEM as one "foundational capability" next to SOAR, EDR, NDR and CDR, all on Cortex XDL, with Cortex AgentiX handling agentic AI and automation on top. For an analyst the result is one console where the alert, the endpoint timeline and the playbook live together.

Queries use the Cortex Query Language (XQL). Palo Alto describes it as SQL-like in its functions but not SQL: a query is built in stages, one step after another, which will feel familiar if you already write KQL.

The QRadar link is why XSIAM moved up this list. When Palo Alto closed the QRadar SaaS purchase it announced free migration services for eligible customers through IBM Consulting, and IBM deployed XSIAM for its own security operations. There is no public price list; everything is quoted.

Best for: Palo Alto Networks estates, QRadar SaaS customers planning their move, SOCs that want SIEM, SOAR and EDR in one contract.

Skip it if: You are committed to another EDR vendor and only want a SIEM. XSIAM bundles its own endpoint and network detection, and you may end up paying for overlap.

Cortex XSIAM →

4. CrowdStrike Falcon Next-Gen SIEM

CrowdStrike Falcon Next-Gen SIEM extends the Falcon endpoint platform into a SIEM, and data from Falcon modules you already license goes in without an extra ingestion charge.

CrowdStrike spells this out in the product FAQ: endpoint, identity, cloud and other Falcon telemetry is available in Next-Gen SIEM with no additional ingestion charge. You can also buy it standalone to analyze third-party logs without other Falcon modules. The search engine is index-free, and the Falcon Onum pipeline filters, enriches and routes data before it lands.

Analysts write queries in CrowdStrike Query Language (CQL), inherited from LogScale. Charlotte AI handles alert triage, and Charlotte Agentic SOAR adds governed automation workflows. When the SIEM and the EDR share a backend, the pivot from a SIEM alert to the process tree on the host stays inside one console.

Best for: Organizations already standardized on CrowdStrike Falcon for endpoint protection.

Skip it if: You do not run Falcon. The no-extra-ingestion advantage disappears and you are comparing it as a plain cloud SIEM.

CrowdStrike Falcon Next-Gen SIEM →

5. Google Security Operations

Google Security Operations (Google SecOps, formerly Chronicle) is Google Cloud's SIEM and SOAR, built for long-lookback hunting across large volumes and sold in packages based on ingestion.

Earlier versions of this list described Chronicle as flat-rate. Google's own pricing section now says SecOps "is available in packages and based on ingestion", and every package includes one year of security telemetry retention; the Standard package keeps 12 months of it hot. For an analyst, that hot year means a retro-hunt for an indicator published today can reach back twelve months without a restore job.

Detections are written in YARA-L. From the Enterprise package up, Gemini can turn a natural-language question into a search, summarize a case and draft detections, and Enterprise Plus adds full Google Threat Intelligence, which bundles Mandiant and VirusTotal data. The Unified Data Model (UDM) normalizes disparate sources into one event schema, so multi-source pivots behave consistently. The cost is that UDM is a proprietary schema you have to learn before complex queries feel natural.

Retroactive hunting on any platform only reaches back through what you ingested, and object-storage data-plane logs (S3 data events, Azure Storage diagnostics) are off by default and billed separately. A bucket read by a valid token is the event a multi-year archive tends not to hold.

Best for: Large enterprises with high ingestion volume, threat hunting teams, organizations already on Google Cloud.

Skip it if: Your team has no one to own the UDM parsing and YARA-L rules. The platform rewards detection engineering and gives little back without it.

Google Security Operations →

6. Elastic Security

Elastic Security is the SIEM layer of the Elastic Stack, with a free Basic tier you can self-host and paid tiers priced on compute and storage rather than per device.

Elastic now calls itself an "agentic security operations platform", with SOAR-style automation handled natively by Elastic Workflows. The more useful fact for budgeting is on the Elastic Security page: SIEM and XDR are priced on compute and storage, not per endpoint.

Two query languages matter. ES|QL is the piped language for general search and aggregation. EQL (Event Query Language) is built for behavioral detection: it lets you write sequence queries that describe attacker behavior across several events, which maps directly to how MITRE ATT&CK techniques unfold in real logs.

The self-hosting story is real: you can run a full stack on commodity hardware, ingest your own data and use the built-in detection rules without a paid license. Our open source SIEM guide covers what the free tier includes and where its license stops being open source. The catch for beginners is that Elastic asks for infrastructure decisions before you get to any security work.

Best for: Teams comfortable running infrastructure, organizations that need cost control, analysts who want a home lab SIEM they can own completely.

Skip it if: Nobody wants to run clusters and you are not going to pay for Elastic Cloud. Running it yourself means owning upgrades, disk and shard sizing.

Elastic Security →

7. IBM QRadar SIEM

IBM QRadar SIEM is IBM's on-prem SIEM, known for network flow analysis and a correlation engine refined over many years of production use. The SaaS version now belongs to Palo Alto Networks.

QRadar's query language, the Ariel Query Language (AQL), is SQL-like and approachable for analysts with any database background. Its strength is network-centric investigation: QRadar ingests flow data natively and its correlation rules catch lateral movement and exfiltration patterns that cross network segments. Flow data is also what makes the volume side of exfiltration over a web service legible, since the destination there is an HTTPS domain the business already allows and the anomaly is the shape of the upload rather than the reputation of the domain.

The IBM product page now leads with native support for Sigma community rules, user behavior analytics and QRadar NDR. It also notes that QRadar EDR integrates "with no impact to your EPS count", a reminder that QRadar capacity is sized in events per second.

QRadar remains common in financial services, healthcare and critical infrastructure, so it is worth recognizing if those sectors are where you plan to apply (our guide on how to become a SOC analyst covers how to target a sector).

Best for: Regulated enterprises with strong network telemetry requirements that want to stay on-prem with IBM.

Skip it if: You are a QRadar SaaS customer. That product is Palo Alto's now, and the published path forward is XSIAM.

IBM QRadar SIEM →

8. Rapid7 Incident Command

Rapid7 Incident Command, the product formerly marketed as InsightIDR, is a cloud SIEM licensed per asset instead of per gigabyte.

The packages page states that all three tiers (Essential, Advanced, Ultimate) use asset-based pricing. That makes cost predictable for lean teams that would struggle with a volume bill, and it removes the pressure to drop noisy log sources to save money. The trade-off sits in retention: raw logs are kept 90 days on Essential and 180 days on Advanced and Ultimate, with longer retention as an add-on. Alerts and audit data are kept 13 months.

Searches are written in LEQL, and the AI natural-language search can generate a LEQL query from a plain-English prompt, which is a useful way to learn the syntax. User behavior analytics and SOAR are part of the product, and the higher packages add extras such as a hosted Velociraptor for DFIR.

Best for: Lean mid-size SOCs, teams that want predictable cost and built-in UEBA.

Skip it if: Your threat hunting program needs a year of raw logs searchable without add-ons.

Rapid7 Incident Command →

9. Exabeam (New-Scale Fusion and LogRhythm SIEM)

Exabeam sells two SIEMs since its 2024 merger with LogRhythm: the cloud-native New-Scale Fusion, built around behavioral analytics and timelines, and the self-hosted LogRhythm SIEM.

Earlier versions of this list ranked Exabeam and LogRhythm separately. They are one company now, and Exabeam's own navigation files them as "Cloud-Native Platform" and "Self-Hosted Platform".

New-Scale Fusion combines New-Scale SIEM and New-Scale Analytics. Instead of a flat alert list, it builds a timeline of user and entity activity and groups related events into one story, which is exactly the framing a Tier 2 investigation needs. Exabeam Nova agents analyze detections, simplify triage and write case summaries.

LogRhythm SIEM is for organizations that must keep data in their own data center or a self-managed private cloud. Exabeam's FAQ is explicit that it is not cloud native. It keeps the structured Tier 1 workflow LogRhythm was known for, with hundreds of SmartResponse actions for containment (isolate host, disable account, block IP) and a sync service that shares case status and risk scores with Exabeam UEBA. It is sold as a subscription or a perpetual license.

Best for: SOCs focused on Tier 2 investigation speed and UEBA (New-Scale Fusion); mid-market or regulated estates with an on-prem mandate (LogRhythm SIEM).

Skip it if: You want one product line. Exabeam currently sells two, with different deployment models, so check which one a job ad or a proposal actually means.

Exabeam →

10. Securonix Unified Defense SIEM

Securonix is a cloud SIEM with a UEBA core: it scores users and entities against their own baselines instead of relying mainly on threshold rules.

Where a traditional SIEM fires when a condition matches, Securonix builds risk scores over time and surfaces deviations. That works well for insider threat cases and slow campaigns that never trip a threshold. The product lineup now wraps Unified Defense SIEM with UEBA, SOAR, the ThreatQ threat intelligence platform and an agentic AI analyst.

Working in Securonix means understanding why a risk score moved, what contributed to it, and which underlying events to open. It is a different mental model from threshold triage, and a useful one to have by Tier 2.

Best for: Enterprise SOCs focused on insider threat and behavioral detection.

Skip it if: Your team is still building basic correlation rules. Behavioral scoring is hard to trust when you cannot yet explain the events underneath it.

Securonix →

11. Sumo Logic Cloud SIEM

Sumo Logic is a privately held, cloud-native log analytics platform whose Cloud SIEM puts security detection on the same backend as operational monitoring.

Francisco Partners took Sumo Logic private in May 2023. The product direction has stayed consistent: one platform for observability and security, which suits DevSecOps teams that share responsibility for cloud infrastructure. Analysts can pivot between application performance data and security events without switching tools, and the Cloud SIEM adds MITRE-mapped detections, entity normalization and a triage workflow. Dojo AI, Sumo's multi-agent AI layer, sits across both.

The billing model deserves a closer look before you pick it. Sumo Credits offer ingest tiers (Continuous, Frequent, Infrequent) or Flex, where search is billed separately. Under a search-billed model, a broad query across months of data has a price, which can push a team to ration hunts.

Best for: Cloud-native organizations with DevSecOps models and shared observability.

Skip it if: Your SOC does heavy ad-hoc hunting across long time ranges and you would end up on search-billed pricing.

Sumo Logic Cloud SIEM →

12. Wazuh

Wazuh is a free, open source (GPLv2) SIEM and XDR platform with endpoint agents, file integrity monitoring and a MITRE-mapped rules engine, and it is the best SIEM to learn on at home.

Wazuh is production-grade, but it lands at the bottom of an enterprise ranking because you own the infrastructure, the tuning and the maintenance, with no vendor SLA unless you buy support. The project is active: v4.14.8 shipped on September 25, 2026.

For a career changer, deploying Wazuh with a few agents and writing your own rules teaches log ingestion, rule logic and alert correlation better than reading about them. The full setup, hardware sizing and how it compares with the other free options are in our open source SIEM guide.

Best for: Home labs, resource-constrained organizations, teams that want full control without license fees.

Skip it if: You need a vendor SLA and do not plan to buy Wazuh's support contract.

Wazuh →

Other Platforms Worth Knowing

Two more show up in buyer comparisons often enough to recognize by name:

• Datadog Cloud SIEM layers security detection onto Datadog's observability platform, with 12 months of security data available for hunting. Its pricing includes a monthly allotment of Bits Security Analyst AI investigations per terabyte analyzed. Like Sumo Logic, its best fit is a team already running Datadog for monitoring.
• Fortinet FortiSIEM combines SIEM with a built-in configuration management database (CMDB), native SOAR from FortiSOAR, and the FortiAI-Assist assistant. It is the natural aggregation point for estates built on the Fortinet Security Fabric.

How SIEM Pricing Models Change What You Can Search

Buyers compare billing models to forecast spend. Analysts should compare them for a different reason: the billing unit decides which logs make it into the SIEM, and that decides which questions you can answer at 2 a.m. You run a query, get zero results, and conclude the attacker did nothing, when in fact the log source was never ingested because it was too expensive.

Billing model	Who uses it	The pressure it creates	What to check before you trust a "no results"
Per GB ingested	Sentinel (analytics tier), Google SecOps packages, Splunk's ingest option	Filter noisy sources at collection, or send them to a cheaper tier	Is the source in the analytics tier, or only in the data lake?
Per asset	Rapid7 Incident Command	Volume stops being the constraint; retention becomes one	Is the event older than the 90 or 180 day raw log retention?
Events per second	IBM QRadar SIEM	Coalesce or drop repetitive events at the collector to stay inside the EPS license	Were repeated events aggregated into one record?
Compute and storage	Elastic Security	Retention becomes a disk budget	How far back does the index actually go?
Search billed separately	Sumo Logic Flex	Wide searches cost money, so hunts get narrowed	Did someone narrow the time range to save cost?
Bundled with a platform	CrowdStrike (Falcon data), Cortex XSIAM	The vendor's own telemetry is cheap to keep; third-party logs are not	Is the third-party source (firewall, proxy, SaaS) connected at all?

Object storage is a common example. Data-plane logs for buckets are off by default and billed separately on the major clouds, so a read with a valid token is often not in the SIEM at all. In your first week on a new SOC, ask for the list of ingested sources and their retention.

Is SIEM Still Relevant? SIEM vs XDR, SOAR and a SOC

SIEM is still relevant, and it is not being replaced. The categories are converging, and knowing the boundaries clarifies what each tool on this list does.

A SIEM aggregates logs from across the environment, correlates them, and raises alerts. XDR (Extended Detection and Response) is narrower and deeper: it correlates endpoint, network, and cloud telemetry with built-in response actions, and several platforms here (Cortex XSIAM, CrowdStrike, Wazuh, Microsoft Defender alongside Sentinel) blur the SIEM and XDR line on purpose. That boundary matters because some activity barely touches the network at all: input capture, where a process registers a keyboard hook to read credentials as the user types them, lands in endpoint telemetry and in almost nothing the perimeter sees. Clipboard data sits in the same blind spot and is quieter still: a clip.exe run or a Get-Clipboard call raises no security event of its own, so whatever the user last copied leaves with only process-creation or script-block logging to show anything read it. SOAR (Security Orchestration, Automation, and Response) sits above the alert layer and automates the response with playbooks and containment actions. A SOC (Security Operations Center) is not a tool at all; it is the team and process that operate the SIEM, XDR, and SOAR together.

What is new in 2026 is AI triage inside the SIEM console: Splunk's AI Assistant, Cortex AgentiX, Charlotte AI, Gemini in Google SecOps, Exabeam Nova. These tools summarize and suggest; the analyst still has to verify the evidence and own the verdict. For most enterprises the answer is not SIEM or XDR but SIEM and XDR feeding one analyst workflow, which is why query and triage fluency in a SIEM remains the foundational skill however the product categories merge.

Which SIEM Should You Learn First?

Start with the job ads. Search the SOC analyst postings in the city or remote market you are targeting for "SPL", "KQL", "XQL" and "QRadar", and count. Ten minutes of that tells you more about your local market than any global list can, including this one.

For most people the count points to Splunk or Microsoft Sentinel. KQL is the easier first language and Microsoft's training is free. SPL is worth adding once KQL feels natural, and a Splunk Free instance (500 MB a day, no alerting) is enough to practice the syntax. If you are building a home lab with no budget, deploy Wazuh. The common ports and protocols cheat sheet is worth keeping open while you write your log ingestion config, since network telemetry feeds most SIEM detection rules.

The skills that transfer across platforms are the ones to focus on regardless of the first tool: knowing what a detection rule is doing in the log data, pivoting from an alert to correlated context, and judging whether a set of events adds up to an attack chain. The alert triage guide covers those in depth. For the detection scenarios these platforms run (brute force, impossible travel, privilege escalation and more), the SIEM use cases guide explains the logic behind each one.

What Does a SOC Analyst Actually Do with a SIEM?

A SOC analyst's core SIEM workflow comes down to three recurring activities: reviewing the alert queue to find events that warrant investigation, running queries to pivot from a suspicious indicator to the fuller picture, and documenting verdicts and escalations clearly enough that the next analyst can continue without losing context.

The SIEM is the primary tool for all three. Alert queues come from its correlation rules. Investigative queries run against its indexed data. Case notes and verdicts live in its case management layer or in a connected SOAR. The SIEM tells you an alert fired; confirming what actually executed on the host usually means pivoting into an endpoint console, so it pays to learn one of the best EDR tools alongside your SIEM.

Reading about SPL, KQL and XQL only gets you so far; you learn a query language by writing queries against alert data that looks real. SOCSimulator's training operations put a simulated SIEM alert queue in front of you under shift conditions, and some operations include a Query tab where you write KQL against that room's own logs.