Analysts note that foreign SIEM developments are gradually losing their market shares to Russian ones, which is facilitated by the import substitution policy, regulators' requirements to include SIEM-specific functionality in information security systems (so far only for critical infrastructures under Federal Law No. 187) , as well as the activity of Russian developers, including niche ones. Experts also attribute the active creation of different levels of security incident monitoring and response centers (SOC) and computer emergency response centers (CERT) in the country to the drivers of the development of the Russian SIEM market.
the majority of SIEM implementations in iran mobile database occur (due to the complexity and high cost of the systems) as a result of pilot projects, the average duration of which is about three months. During pilot projects, the SIEM is primarily integrated with the customer's information systems, which the customer considers important data providers for managing information security events. The leading SIEM products on the market already have the connectors necessary for integration with most information systems.
According to Vladimir Bengin, head of the practice of implementing MaxPatrol SIEM at Positive Technologies, large companies with more than 500 employees and more than 1,000 nodes in the ICT infrastructure predominate among customers of SIEM systems. However, he believes that when determining the need for a SIEM system, it is more correct to proceed not from the aforementioned structural indicators, but from the main business tasks that the customer is aiming to solve, and from the ICT infrastructure used for this.