Exploring Incident Management: A Comparative Study of Splunk Enterprise, Graylog Open and Syslog-ng and their Impact on Mean Time to Resolution (MTTR)

Introduction Security Information and Event Management (SIEM) systems play a crucial role in detecting, managing, and mitigating security incidents, yet selecting an appropriate SIEM solution remains a complex challenge. This study introduces Mean Time to Resolution (MTTR) which is used to measure an organization’s efficiency in detecting, diagnosing, and resolving security incidents, with a low MTTR indicating a more effective incident response. However, there is limited empirical research on how different tiers of SIEM systems (basic/intermediate/advanced), in terms of capability and complexity influence MTTR in practice, which further complicates the selection process for organizations. This study compares Cisco’s Splunk Enterprise Security (advanced), Graylog’s Graylog Open (intermediate), and One Identity’s Syslog-ng (basic) to determine their effectiveness in reducing MTTR and incident management. Research Question How does Splunk Enterprise compare to Syslog-ng and Graylog Open in reducing Mean Time to Resolution (MTTR) in practical incident management scenarios? Method The PowerShell-based framework Invoke-AtomicRedTeam is used to simulate security incidents in a laboratory experiment to measure and compare Mean Time to Detect (MTTD) and Mean Time to Acknowledge (MTTA) of each SIEM system under controlled conditions. Mean Time to Investigation (MTTI) was excluded due to its reliance on human expertise and organizational processes, which are difficult to standardize in a simulated setting. The research follows a quantitative approach, analyzing log timestamps and descriptive statistical measures to evaluate each SIEM solution’s performance in practical incident scenarios. The study aims to provide organizations with practical insights into how different SIEM tiers perform in reducing MTTR, supporting more informed decision-making in SIEM selection and implementation. Results The experiment’s result revealed a clear trend where higher-tier SIEM systems exhibited longer Mean Time to Detect (MTTD) values, Syslog-ng achieved the lowest MTTD. Between Graylog Open and Splunk Enterprise, Graylog Open had a lower MTTD with Splunk Enterprise demonstrating a 21% higher MTTD but was the most consistent, averaging a 25% lower standard deviation than Graylog Open. While in terms of Mean Time to Acknowledge (MTTA), Graylog Open significantly outperformed Splunk Enterprise, potentially due to differences in alert delivery methods and search time processes, with Syslog-ng having the highest MTTA due to having a fixed value of 1800 seconds (30 minutes). Discussion The findings highlight the trade-offs between detection speed, index time processing, as well as operational reliability across SIEM tiers. The basic SIEM system, Syslog-ng, was the fastest but showed the limitations of relying on manual log review. The advanced SIEM system, Splunk Enterprise, offers rich search and correlation capabilities and consistency, but was slowest potentially due to more index time processes. The intermediate system Graylog Open was faster than Splunk Enterprise but exhibited reliability issues in its alerting functionality and lacked advanced data analysis and manipulation features.