Protoxol
Request a demo
Platform Modules Plans Blog Request a demo
SIEM · Module

SIEM & search

Central event store. Fast KQL-style queries. Investigation pivots.

Compare with 5 alternatives ↓

Overview

What SIEM does.

SIEM and Search is the central event store and query layer of the platform. Every signal from every module lands here in a single normalized schema. The query language is KQL-style — familiar to analysts coming from Microsoft Sentinel or Elastic — and runs distributed across hot, warm and cold storage tiers tuned by you, not the vendor. Saved hunts, scheduled correlations and investigation timelines are built in.

Features

Inside SIEM.

Unified schema

Endpoint, network, email, identity, cloud — same shape. Same query.

KQL-style queries

Familiar syntax, fast autocomplete, time-travel queries, saved hunts.

Detection-as-code

Rules in Git. Review via pull request. Deploy via CI. Roll back instantly.

Tiered storage

You decide hot (30d), warm (1y), cold (5y). No mandatory retention upcharges.

Investigation timelines

Pin alerts to a case, build narrative, share with peers, export to audit.

Use cases

Where SIEM earns its keep.

Threat hunting

Hypothesis-driven queries across modules. Save, schedule, share with team.

Compliance reporting

SOC 2, ISO 27001 evidence built from the same data analysts query.

Detection engineering

Author rules in Sigma or DSL. Test against historical data. Deploy with confidence.

Technical specs

SIEM under the hood.

Ingest rate Up to 2 PB/day per cluster
Query language Protoxol DSL (KQL-compatible)
Query latency Sub-second for 30d hot tier
Retention max 10 years cold storage available

Figures from internal testing; test method and date to be published.

Compare alternatives

Protoxol SIEM & search compared with five alternatives

A SIEM is where you look for a process, a login or an IP across every source, and where alerts should arrive already correlated. The Protoxol SIEM and search module is the platform's central event store: it normalises endpoint, network, email, identity and cloud signals into one schema, lets you query in a KQL-style language, and keeps hunts, correlations and investigation timelines. This comparison sets five relevant alternatives beside it and says where a longer-established SIEM fits better.

What Protoxol offers

Comparison table

Each cell shows the status and the scope. Statuses are explained below the table.

Show alternative:

Scroll the table sideways to see every column.

Protoxol SIEM & search compared with five alternatives
CriterionProtoxol SIEM & searchMicrosoft SentinelGoogle Security Operations (SIEM, formerly Chronicle)Splunk Enterprise SecurityIBM QRadar SIEMElastic Security
Ingestion and normalisation AvailableEvery module's signals land in one normalised schema, with asset and actor as join keys. AvailableOut-of-the-box connectors, CEF, Syslog and REST. Normalisation through ASIM, at ingestion and at query time. ↗ AvailableForwarder, collector, APIs, OpenTelemetry collectors and webhooks; data is normalised to the Unified Data Model (UDM). ↗ Depends on setupSearch-time normalisation through the Common Information Model (CIM); raw data is kept untouched. ↗ AvailableDevice Support Modules (DSMs) normalise logs into QRadar events; it also collects network flow data. ↗ AvailableUniversal schema support across ECS, OCSF and OpenTelemetry, according to Elastic. ↗
Supported sources AvailableConnects Wazuh, Splunk, Elastic, Suricata, Zeek, Microsoft 365 and Okta. For any other source, ask for confirmation with your list. AvailableConnectors for Microsoft and Azure sources and for third-party products; you can build custom connectors. ↗ AvailableThe forwarder accepts syslog and packet capture; integrations with cloud APIs such as Office 365 and Azure AD. ↗ Needs integrationES correlates access, endpoint and network data captured by other devices and products; input is configured per source. ↗ AvailableIBM cites 700 prebuilt integrations and partner extensions; a DSM is added for new devices. ↗ AvailableOver 400 prebuilt integrations and federated search across deployments without centralising data, according to Elastic. ↗
Query and search AvailableKQL-style query language across all modules, with saved hunts and scheduled searches. AvailableKQL for hunting and rules. Hunts built around a hypothesis, favourite queries and bookmarks on results. ↗ AvailableSearch over UDM and YARA-L 2.0 rules; the same logic serves searching, detecting and building dashboards. ↗ AvailableSPL for searches, dashboards and the analyst queue. ↗ AvailableAQL, a SQL-like language over the Ariel event and flow databases, with filters, aggregation and time windows. ↗ AvailableES|QL as the primary language, plus KQL and EQL. ↗
Rules and correlation AvailableRules as code (Git, pull-request review, CI deploy), written in Sigma or the product DSL, plus scheduled correlations. AvailableBuilt-in or custom analytics rules that group alerts into incidents; MITRE ATT&CK coverage view and watchlists. ↗ AvailableStandard: up to 1,000 single-event and 75 multi-event rules, and a subset of curated detections. ↗ AvailableDetections: scheduled correlation searches and risk rules; finding-based ones group lower-level alerts. ↗ AvailableCustom rules over events, flows and offenses, and anomaly rules over saved searches. ↗ AvailableQuery, EQL, threshold, indicator-match, new-terms, ES|QL and machine learning rule types. ↗
Retention model Depends on setupHot, warm and cold tiers that you configure. Available periods depend on the plan you buy. Depends on setup90 days included; beyond that, billed by volume. The data lake tier holds long-term data, charged for storage and queries. ↗ Available12 months of hot retention included in Standard. Beyond 12 months is a separate charge based on ingested volume. ↗ Depends on setupSearchable retention is set per index in Splunk Cloud; on expiry, data can move to your own AWS S3 or Google Cloud Storage. ↗ Not confirmedHow retention is configured was not found in the documentation consulted. Depends on setupRetention is billed per GB stored in the project; the documentation consulted does not detail data tiers in Serverless. ↗
Investigation and cases AvailableInvestigation timelines: pin alerts to a case, build the narrative, share it and export it for audit. AvailableIncidents with an interactive entity graph and timeline; Jupyter notebooks for heavier analysis. ↗ AvailableCase management, search and collaboration inside the platform; base SOAR included in Standard. ↗ AvailableInvestigations with owner, status, urgency and disposition, notes and attachments, linked to findings and per-type SLAs. ↗ AvailableOffenses group related events, flows, assets and rules; the Offenses tab is where you work toward root cause. ↗ AvailableCases with alerts, Timeline events, indicators and metrics; connectors to Jira, ServiceNow and IBM Resilient. ↗
RBAC and tenant separation Depends on licenceMulti-tenant only in the Enterprise plan, aimed at MSPs. Least-privilege RBAC is described; per-data or per-table detail is not. AvailableAzure roles (Reader, Responder, Contributor), resource-context or table-level RBAC, and Entra ID roles for the data lake. ↗ AvailableData RBAC with labels and scopes, and feature RBAC through IAM. Multi-environment (MSSP) starts at Enterprise. ↗ AvailableES roles (ess_user, ess_analyst) on top of Splunk RBAC. Multi-customer separation not described in the documentation consulted. ↗ AvailableUser roles, security profiles and domains; tenants with delegated administration for managed providers. ↗ AvailableRoles with index privileges and document- and field-level security. Multi-customer separation not verified. ↗
Operation and demonstrated scale Not confirmedNo verified ingest volume or production customer data. Ask for a trial with your own sources. Not confirmedService quotas and ingestion limits not verified in official documentation. Not confirmedService ingestion limits and at-scale operating data not verified in official documentation. Not confirmedIngestion limits and at-scale operating data not verified in official documentation. Not confirmedAt-scale operating data and limits not verified in official documentation. Not confirmedServerless ingestion limits and at-scale operating data not verified.
Cost model AvailablePer protected endpoint by plan, with modules activated separately. SIEM is not in Starter; events per second and retention are quoted. AvailablePer GB in the Analytics tier (pay-as-you-go or commitment from 100 GB/day), plus retention and data lake charges. ↗ AvailableSubscription in credits by ingestion volume; overage is billed at the negotiated rate. Price through sales. ↗ AvailableQuote through sales. Ingest, workload or activity-based models, and two editions: Essentials and Premier. ↗ AvailableLicence by events per second (EPS) and flows per minute (FPM), with capacity shared across managed hosts. ↗ AvailableUsage by GB ingested and GB retained; Elastic states there is no per-endpoint fee as of March 2026. Add-ons billed separately. ↗
Link to endpoint, network and email AvailableEDR, NDR, email, identity and cloud write to the same schema; signals on one asset or actor are grouped into one incident. Needs another productAlerts from Defender for Endpoint and Office 365 are ingested at no charge, but they are separate Defender products. ↗ Needs integrationEndpoint, network and email arrive as telemetry from other products; Google Unified Security adds Google's own products. ↗ Needs integrationCorrelates access, endpoint and network data collected by other products; ES is the analytics layer, not the sensor. ↗ Needs another productIBM lists QRadar NDR and QRadar EDR as companions; confirm their current availability after the SaaS sale. ↗ Depends on licenceEndpoint protection exists, but endpoint response actions are in Complete. Email is not covered in the documentation consulted. ↗
SOC automation Depends on licenceWebhooks, REST and OTEL out. Playbooks with human approval: add-on in Team, included in Enterprise. AvailableAutomation rules and playbooks on Azure Logic Apps, with connectors to ServiceNow, Jira and others. ↗ AvailableBase SOAR in Standard, with over 300 prebuilt integrations and automated playbooks. ↗ Depends on licenceSplunk SOAR integrates with ES, but the Premier edition includes it; Essentials is SIEM with an AI assistant and Detection Studio. ↗ Needs another productIBM lists QRadar SOAR as a companion product; confirm its current availability. ↗ Depends on licenceElastic Workflows is billed per execution, with 10,000 free a month; Agent Builder is Complete only. ↗

What each status means

Available
Native feature of the product or plan compared.
Needs integration
Works through a connector or a third-party product.
Depends on setup
Exists, but its scope depends on deployment or configuration.
Depends on licence
Only in a higher plan or as a paid add-on.
Needs another product
Covered by a different product from the same vendor.
In development
Announced or being built; not generally available.
Not confirmed
Not enough evidence. It does not mean “no”.

Five comparisons

One per product, naming the plan that was compared.

Microsoft Sentinel

Plan or edition: SIEM on the Analytics tier (pay-as-you-go or commitment tiers), with an optional data lake tier; Microsoft Defender console

Sentinel is the natural first look if your estate already runs on Microsoft: it reads Entra ID, Microsoft 365 and Azure through native connectors, and Defender alerts come in with no ingestion charge. You investigate in KQL with incidents and an entity graph, and automate with Logic Apps playbooks. Azure Lighthouse covers serving several customers. The bill follows the GB you ingest and retention past 90 days, so estimate volume first. Protoxol has neither that connector catalogue nor proven scale, but it bills per protected endpoint and keeps EDR, network and email in one schema. One calendar point: from April 2027 Sentinel is used only through the Defender portal.

Official source ↗

Google Security Operations (SIEM, formerly Chronicle)

Plan or edition: Standard package (Enterprise and Enterprise Plus add UEBA, extended intelligence and more rules)

If you will push a lot of volume and want a year of searchable data without a separate retention fee, Standard covers it: forwarder or API ingestion, UDM, YARA-L rules and a base SOAR with over 300 integrations. The limits are written down: 1,000 single-event and 75 multi-event rules, with UEBA and the full curated-detection set starting at Enterprise, as does multi-environment mode for MSSPs. It is bought by ingestion volume, through sales. Protoxol cannot show that scale or that catalogue today; in exchange it offers EDR, network and email in one schema and per-endpoint billing. Look at Google if your main telemetry is cloud and your team already writes YARA-L.

Official source ↗

Splunk Enterprise Security

Plan or edition: Essentials edition (SIEM); Premier adds UEBA and SOAR. On Splunk Cloud Platform or Splunk Enterprise (software)

Splunk Enterprise Security is what many analysts already know: SPL for searching, correlation or risk-based detections, investigations with status and per-type SLAs, and the choice of Splunk Cloud Platform or the software on your own infrastructure. Pin down the edition before comparing: Essentials is SIEM; UEBA and SOAR arrive with Premier, and both are quoted through sales under ingest, workload or activity models. ES analyses data that other products collect and ships no sensor of its own. Protoxol bills per endpoint and brings EDR, network and email, but lacks Splunk's app ecosystem and track record. Splunk fits better when your team already writes SPL.

Official source ↗

IBM QRadar SIEM

Plan or edition: QRadar SIEM 7.5 software (self-managed; the QRadar on Cloud/SaaS version was retired)

Start with the availability notice: IBM sold the QRadar SaaS assets to Palo Alto Networks, which set end of life for QRadar on Cloud and the cloud-native SIEM at 14 April 2026; the on-prem software is not affected. What remains with IBM is a mature SIEM, with DSMs to normalise, AQL, offenses and EPS/FPM licensing, built for teams that run their own infrastructure. Protoxol offers EU-hosted SaaS or self-hosting and per-endpoint billing, but it is younger and does not demonstrate that scale. Choose QRadar if you already have DSMs and rules to maintain.

Official source ↗

Elastic Security

Plan or edition: Elastic Cloud Serverless, Security Analytics Essentials tier (Complete adds UEBA, AI and endpoint response)

Elastic Security suits teams that want to get their hands on the parts: ES|QL, KQL and EQL, seven rule types from threshold to machine learning, cases with connectors to Jira or ServiceNow, and three ways to deploy, from Serverless to air-gapped. In Serverless you pay per GB ingested and retained, and Elastic says it no longer charges per endpoint. That flexibility means you decide schema, sources and rules. For endpoint response you need to move up to Complete. Protoxol ships those modules already joined, with defined investigation paths, but with fewer integrations and without Elastic's community. If your team already knows Elasticsearch, start there.

Official source ↗

When to choose Protoxol

  • You want to investigate endpoint, network and email from one schema and one console, without building three integrations.
  • Your team is small or an MSP runs it, and you prefer to budget per protected endpoint rather than per GB ingested.
  • You need EU-hosted SaaS or your own installation with the same product, and can test with your sources before deciding.

When to consider something else

  • Your estate lives in Microsoft 365 and Azure and you want native connectors and Defender alerts with no ingestion charge: Microsoft Sentinel.
  • You move a very high log volume and need scale and an integration catalogue already proven: Google SecOps or Splunk.
  • You already maintain DSMs and rules, or your team masters SPL, AQL or Elasticsearch: QRadar, Splunk or Elastic spare you the migration.

See the module in a demo

Questions about this comparison

01Can I keep my current SIEM and run Protoxol alongside it?

Yes. Protoxol ingests from Splunk, Elastic and Wazuh and exports through webhooks, REST and OTEL, so you can keep your SIEM as the system of record during a trial.

02How is a SIEM billed: per GB, per endpoint or per user?

It depends on the product. Sentinel and Google SecOps follow ingestion volume, Splunk offers ingest, workload or activity models, QRadar licenses by EPS and FPM, and Protoxol quotes per protected endpoint by plan. Work it out with your three numbers: daily volume, endpoints and analysts.

03What happened to QRadar in the cloud?

IBM sold the QRadar SaaS assets to Palo Alto Networks, which announced end of life for QRadar on Cloud on 14 April 2026. IBM's on-prem software is not affected.

04What should I ask for in a SIEM trial?

Bring your real sources and check what normalises by itself, what a year of retention costs and who can see each customer's data. Also ask for the vendor's documented maximum volume; for Protoxol that figure is not yet verified.

Sources and review date

Reviewed on October 2, 2026. Reviewed by The Protoxol team.

Protoxol capabilities are based on the current commercial documentation on this site and were not technically validated in this review; anything undocumented is shown as “Not confirmed”. Vendor data comes from each vendor's public documentation on the date shown and may have changed.

Selection

See SIEM against your data.

Thirty minutes. Your environment. The modules that fit. No slideware.

Book a demo See pricing

Small team without a SOC? Read SIEM for small business.