Subcategory · AI Citation Index
SIEM
Splunk and Microsoft Sentinel dominate SIEM shortlists; SentinelOne surges +28 points while category scores tumble from 63 to 21 over 8 months.
172 discovery queries · 261 head-to-heads · refreshed Oct 6, 2026
Discovery stage
The shortlist
Across 172 buyer-style "SIEM" queries
Splunk Enterprise Security and Microsoft Sentinel each appear in 115 of 172 prompts (66.9% shortlist rate), with Splunk earning 323 mentions and Microsoft Sentinel 390. Elastic follows at 64.5% and Rapid7 at 41.3%, while open-source Wazuh captures 22.7% despite lacking a unCited score. Model diversity hits 5 across all top names except Elastic and Sumo Logic (4 models).
Hover or click a logo to see brand details
Get weekly AI visibility changes for SIEM sent to your inbox.
Score shifts, new entrants, citation gaps — every Monday.
Signal by intent
By topic
Top 5 most-cited brands per intent cluster. Brands with zero citations in a topic are not shown.
Evaluation stage
Head-to-head
How often AI cites each brand across uniform category evaluation prompts · median 5/100
Splunk, Microsoft Sentinel, and Splunk Enterprise Security tie at 54 average evaluation score across 30 head-to-head queries. Elastic Security and Google Security Operations follow at 50 across 28 comparisons. Sumo Logic (39), Rapid7 (34), and ServiceNow (32) lag by double digits, with a category median evaluation score of just 5.
Hover or click a logo to see brand details
Each brand's score is the share of category evaluation prompts where AI cited them across all four engines — the same prompt pool for every brand. Brands above the median citation rate have stronger presence in evaluation-stage queries.
Trends
Over the last 12 months
Category average scores dropped from 63 in March 2026 to 21 by October (sample sizes 6 to 3). SentinelOne climbed +28 points to reach a 74 unCited score, the highest in the field. Microsoft Sentinel fell -16 points despite maintaining shortlist dominance.
Brands to know
In this category
Sentinelone
SentinelOne posted a +28-point surge to claim the category's top unCited score of 74. The momentum suggests aggressive AI model training on endpoint-to-SIEM integration messaging.
Read brand profile →Splunk Enterprise Security
Splunk Enterprise Security holds co-equal shortlist presence with Microsoft Sentinel but edges ahead on evaluation score (54 across 30 queries). Its 323 mentions across 5 models reflect entrenched enterprise SIEM legacy.
Read brand profile →Microsoft Sentinel
Microsoft Sentinel matches Splunk's 66.9% shortlist rate and leads all brands with 390 total mentions, yet dropped -16 points in recent trends. Azure bundling drives volume; emerging challengers erode margin.
Read brand profile →Elastic
Elastic appears in 64.5% of prompts with a 72 unCited score, second only to SentinelOne. Its 241 mentions and dual open-source/commercial positioning keep it competitive against proprietary incumbents.
Read brand profile →Rapid7
Rapid7 shows up in 41.3% of prompts and holds a 62 unCited score, but its 34 average evaluation score across 19 queries trails tier-one vendors by 20 points. InsightIDR integration remains the differentiator.
Read brand profile →Citation sources
Where AI pulls citations from
657 citations captured across SIEM prompt runs.
Vendor pages
319Product, help, and marketing pages from tracked vendors
Independent sources
248Reviews, encyclopedias, forums, press — not vendor-owned
Buyer questions
What AI cites for top SIEM questions
Most-cited prompts across the buyer journey. Click any prompt to see the actual URLs AI engines link to.
Discovery
Buyers exploring the categoryEvaluation
Buyers comparing optionsWant to know if AI cites your brand for SIEM?
Free audit. ChatGPT, Perplexity, Gemini, Claude.
Run an audit →