SIEM (Security Information and Event Management) Tools

– Splunk – IBM QRadar – LogRhythm – ArcSight – AlienVault (AT&T USM) – Microsoft Sentinel – Graylog – Securonix – Elastic Security (ELK Stack)

SOAR (Security Orchestration, Automation, and Response) Tools

– Cortex XSOAR (Palo Alto Networks) – IBM Resilient – Splunk SOAR (Phantom) – Swimlane – DFLabs IncMan SOAR – Siemplify (Acquired by Google Cloud)

Threat Intelligence Platforms (TIP)

MISP (Malware Information Sharing Platform) ThreatConnect Recorded Future Anomali IBM X-Force Exchange OpenCTI AlienVault OTX

EDR/XDR (Endpoint / Extended Detection & Response) Tools

– CrowdStrike Falcon – SentinelOne – Carbon Black – Microsoft Defender for Endpoint – Sophos Intercept X – Trend Micro Apex One – Cynet 360 – Trellix XDR (formerly FireEye/McAfee)

Network Security Monitoring Tools

– Zeek (formerly Bro) – Suricata – Snort – Security Onion – Wireshark – NTOPng – NetFlow Analyzer

Vulnerability Management Tools

– Tenable Nessus – Qualys – Rapid7 Nexpose / InsightVM – OpenVAS – Burp Suite (for web vulnerabilities)

Asset and Configuration Management

– ServiceNow Security Operations – Lansweeper – ManageEngine AssetExplorer – CMDB in Splunk/QRadar

Digital Forensics & Incident Response (DFIR) Tools

– Autopsy – Volatility Framework – FTK Imager – X-Ways Forensics – Magnet AXIOM – Cuckoo Sandbox

Log Collection & Parsing Tools

– Logstash – Fluentd – Beats (Filebeat, Winlogbeat, etc.) – Syslog-ng – Rsyslog

Cloud Security Tools

– AWS Security Hub – Azure Security Center – Google Chronicle – Prisma Cloud – Lacework – Wiz