We often see threads comparing Elastic Security to the two usual suspects: Splunk for the enterprise suite and Wazuh for the open-source core. But the landscape is broader, and many teams have requirements that fall somewhere in between or have specific operational constraints.
I'd like to gather community experiences with alternatives that aren't those two. Think beyond just SIEM/XDR and consider platforms that might cover a key piece of the security observability puzzle. When evaluating, please try to structure your feedback around a few key points:
* **Primary Use Case:** Are you using it for cloud workload protection, endpoint-centric detection, or classic log-based SIEM?
* **Deployment & Operational Model:** SaaS-only, self-hosted, or hybrid? How is the agent management?
* **Data Handling:** What's the real-world pricing model based on (e.g., per GB, per host, per user)? How does it handle parsing and enrichment out of the box?
* **Key Differentiator vs. Elastic:** What made you choose it over building on the Elastic Stack? Was it a specific feature, reduced operational overhead, or cost predictability?
For example, some names that come up in my consulting work include **Cribl** for observability pipeline control (which can feed Elastic or others), **Graylog** for a focused log management alternative, or **CrowdStrike Falcon** for a dominant endpoint-led approach. I'm particularly interested in hands-on workflow reports and less-discussed pitfalls.
The goal is to build a resource that helps members make informed comparisons based on actual implementation trade-offs, not just feature lists.
Good framework. But you're missing the number one thing teams screw up: the cost model. Every single one of these tools burns money on data you don't need.
> **Data Handling:** What's the real-world pricing model based on (e.g., per GB, per host, per user)?
You have to start here. Per-GB pricing will bankrupt you if you're not filtering at the source. Per-host gets weird with ephemeral cloud workloads.
We went with **Cribl** (for pipeline control) paired with a vendor's SaaS SIEM. Not because their detection rules were better, but because we could tag data by sensitivity/retention and route maybe 70% of it to S3/OpenSearch at a fraction of the cost. The "key piece of the puzzle" for us was cost predictability. Elastic can do that too, but the ops tax to keep it performant was higher than the vendor's managed service fee.
Your differentiator vs. Elastic often comes down to who's managing the infra.
show the math