Centralized event and log data collection
Effectiveness of real-time centralized event and log data collection
Cat avg: 8.9
ManageEngine Log360
15 Reviews and Ratings
Top Performing Features
Behavioral analytics and baselining
How effectively activity and behavior baselines are established and maintained
Cat avg: 8.6
Response orchestration and automation
Quality of built-in response orchestration and automation in Next-Gen SIEM
Cat avg: 8.4
Reporting and compliance management
Ease and quality of reporting and compliance functions
Cat avg: 8.5
Worst Performing Features
Correlation
Correlation of logs and events to pinpoint significant threats
Cat avg: 8.4
Data integration/API management
Ease and quality of data integrations between SIEM and other systems
Cat avg: 8.3
Event and log normalization/management
Ability to normalize event syntax so that logs can be compared and are machine-understandable
Cat avg: 8.7
ManageEngine Log360 Features from Reviews
Security Information and Event Management (SIEM)
Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools
6.5-23%
Centralized event and log data collection
Effectiveness of real-time centralized event and log data collection
Category average: 8.9
Correlation
Correlation of logs and events to pinpoint significant threats
Category average: 8.4
Event and log normalization/management
Ability to normalize event syntax so that logs can be compared and are machine-understandable
Category average: 8.7
Deployment flexibility
Ability to tune system to maximize threat detection and minimize false positives
Category average: 7.8
Custom dashboards and workspaces
dashboards that can be customized to meet the needs of specific groups
Category average: 8.7
Data integration/API management
Ease and quality of data integrations between SIEM and other systems
Category average: 8.3
Behavioral analytics and baselining
How effectively activity and behavior baselines are established and maintained
Category average: 8.6
Response orchestration and automation
Quality of built-in response orchestration and automation in Next-Gen SIEM
Category average: 8.4
Reporting and compliance management
Ease and quality of reporting and compliance functions
Category average: 8.5
Incident indexing/searching
Effectiveness of searching across structured and unstructured events and incidents within SIEM
Category average: 8.8
ManageEngine Log360 Features from the Vendor
Security Information and Event Management (SIEM)
Vendor-reviewedCentralized event and log data collection
Effectiveness of real-time centralized event and log data collection
Correlation
Correlation of logs and events to pinpoint significant threats
Event and log normalization/management
Ability to normalize event syntax so that logs can be compared and are machine-understandable
Deployment flexibility
Ability to tune system to maximize threat detection and minimize false positives
Integration with Identity and Access Management Tools
Integration with access control tools like Active Directory and LDAP
Custom dashboards and workspaces
dashboards that can be customized to meet the needs of specific groups
Host and network-based intrusion detection
Ability to detect both endpoint intrusion and network ingress detection
Log retention
Length and quality of log storage and archiving over time
Data integration/API management
Ease and quality of data integrations between SIEM and other systems
Behavioral analytics and baselining
How effectively activity and behavior baselines are established and maintained
Response orchestration and automation
Quality of built-in response orchestration and automation in Next-Gen SIEM
Reporting and compliance management
Ease and quality of reporting and compliance functions
Incident indexing/searching
Effectiveness of searching across structured and unstructured events and incidents within SIEM
Additional Features
Vendor-contributedNative SOAR with built-in incident response playbooks that can block IPs, disable accounts, and open ITSM tickets without third‑party SOAR tools.
Agentic AI that autonomously investigates alerts, correlates evidence, and recommends or executes response actions to reduce analyst workload.
Re-engineered detection engine with 2,000+ MITRE ATT&CK and SIGMA-mapped rules and ML-powered adaptive alerting to cut false positives.
User and Entity Behavior Analytics (UEBA) to baseline normal behavior, detect anomalies (suspicious logons, data exfiltration, lateral movement), and assign dynamic risk scores.
Cloud security monitoring and CASB-style visibility across AWS, Azure, and Google Cloud, including shadow IT discovery and misconfiguration alerts.
File integrity monitoring (FIM) for critical files and folders with real-time alerts and detailed audit trails for compliance.
Threat intelligence integration with feeds such as VirusTotal, STIX/TAXII, and AlienVault OTX to automatically flag indicators tied to known malicious IPs, URLs, and domains.