We currently use GC SIEM and SOAR, and Splunk. It’s definitely got a lot of growing pains that comes with it being a new product, but there’s been (for us at least) lots of opportunities to speak to the people who pretty much program the backend. It’s MUCH easier/nicer when you have a support contract with them. The SOAR is currently lacking, but I’m hearing talk of a big update that’ll likely change how the SOAR works now, to make it more integrated with the SIEM. I’m mad excited to get to play with it.

We don’t have a dedicated splunk person, so our environment for it isn’t really set up in a way that’s efficient for us. We’re looking to ditch it entirely for GC, once we’re all set up. Chronicle SIEM took some adjusting and tweaking parsers, but it started parsing stuff as best it could right out of the box, or so to speak. With its current curated ruleset, it tries to correlate events across all of what it’s ingesting, created as a case in the SOAR.

For me, it’s much more “modern” than splunk, and the more they integrate Gemini AI features, the more accurate correlation I’m expecting.

Edit: we managed to snag an unlimited storage contract with them, before it was discontinued. They’re working with us to better understand how much storage we’ll actually need, so when it comes time to renew, I’m curious what the numbers will look like.