We are currently evaluating toolsets, as with you, our primary driver is aggregation and correlation and getting away from our older rules-based system to accommodate new technologies. SIEM seems to come up a lot, but that is not in scope for us so those features mean little…
