Which product is right for you?
Is your goal fast log collection, archiving and regulatory compliance; or event-chain correlation, UEBA and threat hunting? OrianaSIEM is the advanced edition that includes every OrianaLOG capability; the two products share the same architecture, and moving from OrianaLOG to OrianaSIEM is always possible.
Feature comparison
| Feature | OrianaLOG | OrianaSIEM |
|---|---|---|
| Scope | Log management platform | All OrianaLOG capabilities + SIEM layer |
| Primary purpose | Log collection, archiving, fast search, reporting, regulatory compliance | Same + security event management, threat detection, advanced correlation |
| Correlation | One-shot correlation | 6 engines: rule, time, counter, event chain, time delta, YARA + Sigma + script |
| Ready-made rules | Ready-made tags and single-rule scenarios | 3,500+ ready-made correlation rules, Sigma catalog |
| UEBA / behavior analysis | — | Profiling-based UEBA, anomaly detection (no extra license) |
| MITRE ATT&CK | — | Tactic/technique mapping, STIX/TAXII sync |
| Threat intelligence | Cyber attack shield (malicious IP/URL) | USOM + CTI feeds, IoC correlation |
| Automated actions | E-mail, SMS alarms | E-mail, SMS, SSH command, alarm merging |
| Patented Minimize & Deduplication | Yes | Yes |
| Time-stamped archive (Turkish law 5070) | Yes | Yes |
| Reporting | On-demand/daily/weekly/monthly; dynamic designer; PDF/Excel | Same + executive summary reports and MITRE ATT&CK views |
| SOC / SOAR integration | Alarm forwarding via e-mail and SMS | Forwarding of triggered events to SOC / SOAR tools via Web API, e-mail and SMS |
| File Audit | Yes | Yes |
| MSSP / multi-tenant | Role management, device assignment | Role management + tenant isolation |
| Performance (internal tests) | 50,000 EPS on a single server; 0.95 ms queries | Same core; EPS-based multi-server scaling, 100,000 peak EPS reference |
| Best fit | SMB and mid-market; low-cost log management; compliance-focused (Turkish Law 5651) | Large enterprises, banks, public sector, regulated organizations, MSSPs |
Which one, in which situation?
| Situation | OrianaLOG | OrianaSIEM |
|---|---|---|
| I only need log collection, archiving, single-rule correlation and fast analysis | ✔ Good fit | More than needed |
| I must produce GDPR, Turkish Law 5651 and KVKK compliance reports | ✔ With retention and integrity | ✔ Same + executive summary reports |
| I need advanced threat hunting, UEBA and event-chain analysis | — | ✔ Good fit |
| Installing agents is a problem; I want agentless collection via Syslog, API or file sources | ✔ Agent optional | ✔ Agent optional |
| My system resources are limited; it must run on low CPU/RAM | ✔ Very low consumption | ✔ Low consumption, scales with EPS |
| I work with an external SOC / SOAR; I need to forward triggered events | Via e-mail / SMS | ✔ Enriched event forwarding via Web API |
| As an MSSP, I will serve many customers | ✔ Role-based | ✔ Tenant isolation |
| Ease of installation and maintenance matters | ✔ Very easy | ✔ Installed in 1 day |
Using both together: OrianaLOG collects and archives all logs quickly and raises first-level alarms; OrianaSIEM performs advanced correlation and threat analysis only on critical events. High EPS loads are handled comfortably, resource consumption drops, and if needs change later only one side has to scale.
Total cost of ownership, not license price
Performance, TCO, operational burden and architecture instead of a feature checklist. Category-based evaluation instead of brand-by-brand comparison.
| Dimension | Global enterprise SIEM | Cloud (SaaS) SIEM | Open-source stack | Oriana |
|---|---|---|---|---|
| License model | Volume / EPS based; grows as you grow | GB/month ingest + long-retention fees | Free license | No volume penalty; based on platform scope and retention period |
| Hardware / resources | High; appliance or large cluster | Vendor-side | High RAM/disk for Elasticsearch clusters | Non-Elasticsearch engine; up to 60-70% less disk in internal tests |
| Data location | On-premise or cloud | Vendor's cloud; data egress cost | On-premise | On-premise, hybrid, partner cloud; data sovereignty |
| Specialist dependency | Certified specialists, proprietary query language, consulting | Query-language expertise; connector maintenance on the customer | 2-3 full-time engineers, continuous tuning | No proprietary query language; 3,500+ ready-made rules; vendor-managed updates |
| Time to deploy | Can take months | Weeks | Weeks to months (setup + tuning) | Installed in 1 day, POC in 1-2 weeks, live within days |
| Support and accountability | Vendor / integrator | Vendor | Community; no accountable vendor at audit time | Manufacturer-direct support, SLA, in Türkiye and internationally |
| Regulation | International templates | International templates | Module-based | GDPR/NIS2/ISO/PCI + Turkish Laws 5651/5070, KVKK, BDDK; TRTEST A-Level (Türkiye) certified SIEM |
The right tool may differ for every need.
We openly acknowledge that global platforms lead in ecosystem breadth and AI-driven advanced analytics. If your organization is built entirely on a single cloud ecosystem and keeping logs in that cloud fits your data policy, that ecosystem's SIEM may be the more natural choice.
But if data sovereignty, predictable cost, international and national regulation, and manufacturer-direct support are your priorities, Oriana is the better fit. We can test this together on your own data.
Where we differentiate measurably in a POC
- Query response time (p95) and EPS capacity, with zero event loss
- Resource consumption (CPU, RAM, disk) and deduplication ratio
- Alarm quality with profiling-based UEBA and 3,500+ ready-made rules
- Report generation time and time to connect a source
- MTTD / MTTR scenarios; installation time
Rule of evidence: no numerical claim without a benchmark. A direct comparison with a competitor requires the same data set, the same hardware, the same retention policy and the same query scenario.
Have you compared resource consumption and query time in a POC on the same data?
Let's define the success criteria together and report the results in a format you can present to your board.