niche · 0.0

SIEM

Score 19.8 / 100 55 providers +6 via APIs 17 APIs Search apis.io →

Providers using this tag (55)

Ranked by API Evangelist rating — Exemplar and Strong are expanded by default.

Exemplar 1 Complete, well-documented, and agent-ready
Elastic Stack (ELK Stack)AnalyticsLoggingMonitoringObservability3 APIs76.7
Strong 1 Solid coverage with minor gaps
Logz.ioObservabilityLoggingMetricsTracing19 APIs64.9
Developing 16 Usable, with meaningful gaps to close
PantherCompanySecurityDetection and Response1 API53.9Amazon Security LakeData LakeSecurityThreat Detection3 APIs52.8ArmorCompanyCybersecurityManaged Detection and ResponseCloud Security16 APIs51.1HuntressCompanySecurityCybersecurityManaged Detection and Response1 API51.1LevelBlueCompanyEnterpriseCybersecuritySecurity1 API47.3SplunkAnalyticsData AnalysisLoggingMachine Data1 API45.3Sumo LogicLoggingObservabilitySecurityMonitoring1 API45.0Microsoft SentinelMicrosoftSecuritySOAR5 APIs44.5Push SecurityCompanyEnterpriseSecurityIdentity1 API44.3AdluminSecurityCybersecurityManaged Detection and ResponseExtended Detection and Response2 APIs42.2Rapid7SecurityVulnerability ManagementXDR3 APIs41.8Vectra AICompanyCybersecurityNetwork Detection and ResponseThreat Detection2 APIs41.3Google Cloud ChronicleIncident ResponseLog ManagementSecurity AnalyticsSecurity Operations1 API41.0SpyderbatCompanySecurityCloud SecurityRuntime Security2 APIs40.3RunRevealCompanySecuritySecurity Log Management1 API39.9SophosCybersecurityEndpoint ProtectionSecurity1 API39.6
Thin 11 Limited public surface area
ScannerCompanySecurityLog Analytics1 API38.7Stellar CyberCybersecuritySecurityXDR1 API38.6DevoCompanyCybersecuritySecurity6 APIs34.5SecuronixSecurityUEBASOAR4 APIs34.0TessianCompanyEnterpriseEmail SecurityCybersecurity1 API31.7AnvilogicCompanySecurityCybersecuritySecurity Operations2 APIs30.6ProofpointSecurityCybersecurityEmail SecurityThreat Intelligence7 APIs30.6ExabeamCompanyCybersecuritySecurity13 APIs30.2NebulockCompanySecurityThreat HuntingThreat Detection1 API29.5HuntersCompanyCybersecuritySOC1 API29.2LookoutCompanyCybersecurityMobile SecurityEndpoint Security1 API27.7
Emerging 19 Early or largely undocumented
TodylCompanyCybersecuritySecurityManaged Service Providers1 API23.9ResurfaceAPI AnalyticsAPI ComplianceAPI LoggingAPI Observability5 APIs23.3ExpelCybersecurityMDRManaged Detection and ResponseSOC1 API22.2IBM QRadar Security Intelligence PlatformAnalyticsLog ManagementSecurity2 APIs20.7CardinalOpsCompanyCybersecuritySecurity OperationsDetection Engineering19.1BlackpointCompanyCybersecurityManaged Detection and ResponseMDR19.0Radiant SecurityCompanySecurityCybersecuritySecurity Operations18.6Dropzone AISecuritySOCAI AgentAutonomous1 API18.5HalcyonCompanyAI InfrastructureCybersecurityRansomware1 API18.4CroglCompanySecurityCybersecuritySecurity Operations17.7Vega SecurityCompanyCybersecuritySecurity Operations17.4AnomaliCompanyEnterpriseCybersecurityThreat Intelligence1 API16.2HumioCompanyBig DataLog ManagementObservability1 API16.0AaDya Security (Judy Security)CompanySecurityCybersecurityEndpoint Detection and Response14.7Abstract SecuritySecurityCybersecuritySecurity Data Pipeline14.3GraylogLoggingObservabilityLog Management1 API14.0CounterTackCompanySecurityCybersecurityEndpoint Security1 API13.8ExaforceCompanySecurityCybersecuritySecurity Operations13.5SIEMonsterCompanySecurityCybersecurity12.1
Minimal 6 Almost no public developer surface
Artemis SecurityCompanySecurityCybersecurityThreat Detection8.6Ostra SecurityCompanySecurityCybersecurityManaged Security8.5ArcSightCompanySecurityCybersecurity7.9Jask LabsCompanySecurityCybersecuritySecurity Operations5.0ObservoCompanyData PipelineObservabilitySecurity5.0Observo AiCompanyData PipelineObservabilitySecurity5.0
Unrated 1 Not yet scored
SenSageCompanySecurityLog Management

APIs with this tag (15)

Ranked by the provider's API Evangelist rating — the Kin Score is scored per provider, not per API, so every API of a provider shares its band. How the rating works →

Strong 2 Solid coverage with minor gaps
Logz.io Cloud SIEM APILogz.io Cloud SIEM control plane — manage detection rules (correlation and threshold), retrieve raised secu...64.9Datadog Security Monitoring APIThe Security Monitoring API allows you to create and manage security rules, signals, and filters. It provid...63.6
Developing 7 Usable, with meaningful gaps to close
Workspot SIEM (Splunk) Events APIHMAC-SHA256 authenticated REST API for fetching Workspot Control event data — end-user and administrator ac...51.5Huntress SIEM APIQuery your SIEM logs programmatically using 51.1Splunk Enterprise Security APIThe Splunk Enterprise Security API provides REST endpoints for accessing and modifying findings, investigat...45.3Trellix Helix APIAPI for the Trellix Helix security operations platform that integrates security controls from Trellix and o...43.6Workday User Activity Logging APIREST API for retrieving user activity logs and signon data from a Workday tenant. Returns detailed JSON rec...42.9Adlumin XDR/MDR APITenant-scoped REST API over the Adlumin security operations platform. Eleven v1 endpoints return security d...42.2Rapid7 InsightIDR APIREST API for the InsightIDR SIEM/XDR product covering investigations, alerts, log search, threats, and SOC ...41.8
Thin 2 Limited public surface area
Anaplan Audit APITracks and streams audit events and security alerts for integration with Security Information and Event Man...31.0Hunters SOC Platform APIAuthentication-gated runtime API for the Hunters SOC platform, used for data ingestion (API/webhook collect...29.2
Emerging 4 Early or largely undocumented
Strider Shield APIShield is Strider's curated nation-state threat-intelligence dataset — high-risk email addresses, malicious...23.9QRadar REST APICore REST API for managing QRadar SIEM functionality including offenses, assets, rules, and searches.20.7Dropzone AI Platform IntegrationsDropzone AI's primary "API surface" is its catalog of 90+ outbound integrations to SIEM, EDR/XDR, identity,...18.5Graylog REST APIGraylog provides a REST API for managing log data, streams, dashboards, alerts, users, and system configura...14.0

Companies reaching this through an API (6)

These companies publish an API, specification or operation carrying “SIEM” but do not classify their business under it. Listed unranked and kept out of the count above, because one tagged operation is not a statement about what a company does.

Anaplan Datadog Strider Trellix Workday Security Workspot

Score breakdown

Frequency
50.8
log-scaled weighted occurrences
Breadth
1.5
spread across providers
Quality lift
33.4
mean composite of providers using it
Cohesion
0.0
strength of nearest seed neighbor

Related tags

Threat Detection 33 co-occurrences Security Operations 18 co-occurrences Log Management 14 co-occurrences Managed Detection and Response 9 co-occurrences SOC 9 co-occurrences SOAR 8 co-occurrences Incident Response 11 co-occurrences Detection Engineering 5 co-occurrences

Where this tag comes from

Provider tag55
Api tag17
Openapi tag1
Openapi op tag1

Cohort brief

Auto-generated

The 52 providers in the APIs.io catalog tagged SIEM, scored on the Kin Score. Every figure below is computed from the catalog — nothing here is written.

Providers
52
all scored
Mean Kin Score
30.4
+6.5 vs catalog 23.9
Mean Agent Readiness
15.9
+3.9 vs catalog 12
Spread
5–76.7
median 29.9 · σ 15.7
How the 52 split by band
Exemplar 1Strong 1Developing 16Thin 11Emerging 19Minimal 4
Facet averages, against the whole catalog
FacetThis cohortCatalogDifferenceScored
Access Clarity 36.3 26.5 +9.8 52
Developer Ergonomics 32.6 23.4 +9.2 52
Discoverability 67.5 61.2 +6.3 52
Operational Transparency 20.1 13.9 +6.2 52
Contract Quality 24.5 19.8 +4.7 52
Contract Governance 8.6 6.4 +2.2 52

A facet is averaged over the members that carry it, not over the whole cohort — the “Scored” column is that count. Averaging an absent facet as zero would score our own coverage gaps as the providers’ posture.

What this cohort publishes
ArtifactThis cohortCatalogDifference
MCP server (any) 26% 10% +16
MCP server (first-party) 23% 13% +10
Agent Skills 0% 0% 0
OAuth scopes 17% 11% +6
Security 100% 96% +4
Arazzo workflows 8% 2% +6
Governance rules 17% 14% +3

mcp_pct counts any mcp/ artifact including ones API Evangelist derived from the provider OpenAPI; mcp_first_party_pct counts only servers the provider publishes. Prefer the latter.

Top by Kin Score
  1. 1 Elastic Stack (ELK Stack) 76.7
  2. 2 Logz.io 64.9
  3. 3 Panther 53.9
  4. 4 Amazon Security Lake 52.8
  5. 5 Armor 51.1
  6. 6 Huntress 51.1
  7. 7 LevelBlue 47.3
  8. 8 Splunk 45.3
  9. 9 Sumo Logic 45
  10. 10 Microsoft Sentinel 44.5
Top by Agent Readiness
  1. 1 Huntress 55.6
  2. 2 Elastic Stack (ELK Stack) 48.8
  3. 3 Securonix 42.5
  4. 4 Armor 40.4
  5. 5 Adlumin 38.2
  6. 6 Splunk 34
  7. 7 Rapid7 34
  8. 8 Sumo Logic 33.7
  9. 9 Spyderbat 32.4
  10. 10 Panther 30.8
All 55 members of this roster resolve to a scored provider in the catalog.Generated from the catalog build of 16 September 2026, across 27514 providers, using the same computation served by the APIs.io cohort API. Briefs are published for rosters of 5 or more scored providers; below that a distribution is not meaningful.

Work with this as data

Every tag here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for tags

7 MCP tools reach this
  • find_tagsBrowse and filter every tag in the catalog.
  • get_cohortThis tag as a scored cohort — every provider carrying it, with scores.
  • cohort_statsPRO — the distribution across this tag: mean, median, band split, adoption rates.
  • cohort_rankingsPRO — the leaderboard, on composite AND agent-readiness axes.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This tag 
curl "https://apis.io/api/v1/tags/siem"
All tags 
curl "https://apis.io/api/v1/tags?limit=25"
As a scored cohort 
curl "https://apis.io/api/v1/cohorts/tag/siem"
The distribution (Pro) 
curl "https://apis.io/api/v1/cohorts/tag/siem/stats" \
  -H "X-API-Key: $APIS_IO_KEY"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.