Shipvane · 4 AE roles
Marco E. · joined Cargolio
Fleetora · first roles in DEsiem soar threat intel, ranked by real usage_
As of 4 November 2026, Microsoft Sentinel leads siem soar threat intel with 1,349 companies naming it in job postings, ahead of IBM QRadar at 327.
As of 4 November 2026 · refreshed daily · counts move as websites, DNS and career sites are re-read.
- Leader
- Microsoft Sentinel · 1,349
- Runner-up
- IBM QRadar · 327
- Most hiring, 90 days
- Microsoft Sentinel
- Highest postings per company
- Cortex XSIAM
- Catalogue
- T-1.0.1-prov
Every siem soar threat intel we can measure
Companies naming the tool, and postings naming it in the last 90 days. Bars are relative to the leader.
| # | Tool | Companies | companies | Postings, 90 days | postings | per company |
|---|---|---|---|---|---|---|
| 1 | Microsoft SentinelMicrosoft | 1,349 | 3,688 | 2.7 | ||
| 2 | IBM QRadarIBM | 327 | 778 | 2.4 | ||
| 3 | Google SecOpsGoogle | 120 | 426 | 3.5 | ||
| 4 | Cortex XSOARPalo Alto Networks | 119 | 375 | 3.2 | ||
| 5 | ArcSightOpenText | 104 | 320 | 3.1 | ||
| 6 | WazuhWazuh | 99 | 161 | 1.6 | ||
| 7 | Splunk SOARSplunk | 88 | 271 | 3.1 | ||
| 8 | MISPMISP Project | 81 | 161 | 2.0 | ||
| 9 | 79 | 257 | 3.3 | |||
| 10 | Elastic SecurityElastic | 77 | 254 | 3.3 | ||
| 11 | LogRhythmExabeam | 74 | 154 | 2.1 | ||
| 12 | VirusTotalGoogle | 42 | 82 | 2.0 | ||
| 13 | Cortex XSIAMPalo Alto Networks | 37 | 220 | 5.9 | ||
| 14 | Arctic WolfArctic Wolf Networks | 27 | 58 | 2.1 | ||
| 15 | Open Cybersecurity Schema FrameworkLinux Foundation | 26 | 55 | 2.1 |
Compare two tools
Same data, two columns: who chooses which by size, industry and country.
Quote the sentence with the date and the link. The numbers change daily; the link always shows the current ones.
Microsoft Sentinel leads siem soar threat intel with 1,349 companies naming it in job postings, ahead of IBM QRadar at 327. (Breaknorm, 4 November 2026, https://breaknorm.co/tools/category/siem-soar-threat-intel)
Read from the source, not self-reported
Every number on this page can be traced to a page we crawled or a posting we read. Full methodology →
- CatalogueBreaknorm technology catalogue T-1.0.1-prov: 6,296 tools with vendor and category, editions folded into their parent.
- CompaniesCompanies whose own postings name the tool as the team's system, any confidence. Candidate wish-lists excluded.
- 90-day postingsOpen postings first seen or posted in the last 90 days that name the tool.
- Not countedTools used by teams that do not post jobs, and companies without a career site we can read.
siem soar threat intel: questions
How is this ranking made?
By the number of companies whose own job postings name the tool as the team's system, from the Breaknorm technology catalogue (version T-1.0.1-prov). No vendor paid for a position and no editor chose the order.
Why is this different from review-site rankings?
Review sites rank by reviews collected. This ranks by companies hiring people to work in the tool, which is closer to seats in use. It under-counts tools used by teams that rarely post jobs.
What about product editions?
Editions and sub-products () are counted under the parent so no company is counted twice.
Can I get the companies behind a number?
Yes: click a tool, see the first 20, and sign up for the full list with verified e-mails. Counting is free.
Get the companies your way
The same data as a search, over MCP and the API, as bulk files, or pushed to you as it changes.
Every company on every tool,
ranked by what they say
Connect the MCP server, ask which companies run a tool, and get 1,000 records free.