Freedom251 › IT & Infrastructure
Free and open first
Best Threat Hunting Software in 2026
- 29 apps
- Research read 7 Oct 2026
- How the order is worked out
- 1
Wazuh
Free plan Open source APILinuxMac+3Wazuh combines security monitoring with response capabilities and integrations for a range of environments.
- 2
Elastic Security
Free plan APILinuxSelf-hosted+1Elastic Security combines threat detection, endpoint and cloud capabilities, and workflow automation, with both free and paid options.
- 3
LimaCharlie
Free plan APILinuxMac+3LimaCharlie combines endpoint security, data ingestion, and automation, with controls for multi-tenant operations.
- 4
- 5
Blumira
Free trial AndroidAPIiPhone+5Blumira packages monitoring, detections, and response capabilities into employee-priced editions.
- 6
ExtraHop RevealX
Free trial APILinuxSelf-hosted+1Choose RevealX if your enterprise needs unified network detection, performance visibility, and packet forensics across hybrid environments.
- 7
Google Cloud Secret Manager
Free plan Web - 8
ManageEngine Log360
Free trial APILinuxSelf-hosted+2Choose ManageEngine Log360 if your security team needs SIEM capabilities spanning log analysis, behavior analytics, cloud monitoring, and automated response.
- 9
- 10
Corelight Open NDR
Paid APILinuxSelf-hosted+1Corelight Open NDR combines detection, traffic analysis, and response workflows across several deployment types.
- 11
Hunters
Free trial APIWebHunters combines managed detections, automated investigation, and response capabilities for security operations.
- 12
Panther
Free trial APISelf-hostedWebPanther combines alert investigation, detection engineering, and security log management for SOC teams. Buyers should review its deployment choices and request pricing to assess fit.
- 13
Security Onion
Free plan LinuxWeb - 14
Splunk Enterprise
Free trial Self-hosted - 15
Vectra AI Identity Threat Detection and Response
Free trial APIWebChoose Vectra ITDR if your security team needs to monitor identity activity across network and cloud environments and wants investigation and response capabilities.
- 16
IBM QRadar SIEM
Paid LinuxSelf-hosted - 17
AT&T AlienVault USM Anywhere
Paid LinuxMacWeb+1 - 18
Coralogix SIEM
Paid WebCoralogix SIEM pairs custom detection rules and real-time alerts with three listed query languages. The Usage-based logs plan is $0.42 a month and includes infinite retention.
- 19
Bitdefender GravityZone Cloud Workload Security
Paid LinuxWebWindows - 20
Datadog Cloud SIEM
Paid Web - 21
Graylog Security
PaidGraylog Security brings triage, detection, alerting, and evidence collection into a paid hybrid product. Its annual cost and query language should be checked against the intended security environment.
- 22
SentinelOne Singularity XDR
Paid LinuxMacWeb+1 - 23
Darktrace / NETWORK
Paid - 24
FortiSIEM
Paid Web - 25
Rapid7 InsightIDR
Paid WebInsightIDR brings log monitoring, configurable detections, and real-time alerts into a cloud product.
#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price
More in IT & Infrastructure
- Active Directory Management Software25
- Application Deployment Software44
- Application Security Posture Management Software17
- Attack Surface Management Software33
- Backup and Disaster Recovery Software36
- Breach and Attack Simulation Software20
- Business Antivirus Software24
- Cloud Automation Software32
- Cloud Detection and Response Software25
- Cloud Governance Software26
- Cloud Infrastructure Entitlement Management Software25
- Cloud-Native Application Protection Platforms21