ConnectWise SIEM

Name: ConnectWise SIEM
Brand: ConnectWise
Rating: 4.5 (68 reviews)

A platform of software & services built for TSPs. Follow us for product updates, company news, business advice and more.

Est 1982|Valuation $1.5B|Raised $6.1B

LinkedIn 225K|Website|Web traffic 1.0M|FTEs 3,409|HQ Tampa, Florida, US

MarketsSecurity Information and Event Management (SIEM)

Platform CoversNetwork Detection & Response (NDR)Security Orchestration, Automation, and Response (SOAR)Infrastructure Monitoring

Published Oct 14, 2026

01Common complaints

- If data portability and bulk export of logs are critical requirements; user feedback cites export limitations. - If the environment is primarily SaaS/cloud with remote users and the organization expects mature cloud-native telemetry handling without additional configuration work. - If highly granular administrative controls and RBAC are required across many tenant accounts; some reviews indicate limited access levels. - If comprehensive turnkey training is a procurement requirement; organizations may need to budget for internal enablement. - If the primary security signal will be EDR/XDR and a vendor-provided MDR/XDR service would better meet operational requirements than a full SIEM program.

Deal disqualifiers (poor fit)

Organizations requiring highly granular RBAC, advanced custom reporting, and straightforward bulk log export for compliance or customer-owned archives.
Organizations that require a cloud-native SIEM with deep Azure/AWS telemetry and substantial in-house SIEM expertise; alternatives such as Sentinel may be a better fit.

Limitations frequently mentioned by users

RBAC/access level limitations affecting large MSP operations.
Report generation and evidence-collection friction.
Lack of easy bulk log export.
Perceived gaps in ticketing system integrations.
Training and enablement gaps that increase internal workload.

Vendor-acknowledged / trust signals

ConnectWise maintains a Trust Center with advisories related to vulnerabilities and component issues, including historical advisories for co-managed deployments. This demonstrates operational transparency but also underscores that SIEM programs depend on timely patching of underlying components.

02Why they buy

Unique selling points supported by evidence (operationally grounded)

MSP-oriented multi-tenancy and packaging: the product’s heritage and marketing consistently emphasize multi-tenant deployment and MSP operational models.
Integration breadth: reviewers have cited a wide integration library with third-party products.
Agent/sensor deployment model: user feedback frequently notes the agent installs/uninstalls without requiring a restart and that IDS sensors can be resilient when configured correctly.

Where competitors have clear advantages

Microsoft Sentinel offers deeper integration with Microsoft telemetry and advanced hunting/query capabilities.
Enterprise SIEM vendors typically provide more mature RBAC, advanced reporting functions, and clearer export/retention controls.
Some SMB-focused alternatives provide simpler pricing and quicker operationalization for small MSPs.

Why customers chose it over alternatives (recurring themes)

Common selection reasons include:

Multi-tenant MSP orientation compared with enterprise SIEM complexity.
Availability of packaged SIEM tiers combined with optional SOC support.
Broad integration library and agent/sensor deployment model that can simplify rollout relative to some legacy SIEM builds.

03Field reports

Review platform availability notes

G2 contains review content with detailed pros and cons.
TrustRadius lists the product but may have limited ratings for an overall score.
Gartner Peer Insights access and listing maturity vary.
PeerSpot and community forums contain additional commentary.
Reddit and MSP community discussions include practical operational critiques referencing Perch heritage.

Positive feedback (examples)

From a G2 review excerpt (user comments): - "The number of integrations with 3rd party products is encouraging." - "The application can ingest a great deal of data and recall it with decent performance capabilities." - "IDS sensors are generally resilient and function well when setup properly." - "The SIEM agent installs and uninstalls without a restart and is generally unobtrusive…" A customer quote on the vendor site referenced consolidated visibility and reduced manual log review burden.

Negative feedback / complaints (examples)

From G2 and community excerpts (user comments): - Concerns that the solution lacks some capabilities for large-scale MSP administration and global control of parameters. - Reports of limited access levels in the portal. - Complaints about ticketing system integrations and report generation workflows. - Difficulties exporting log data and building/delivering reports. - Feedback that training and enablement resources may be limited. From MSP community discussions (Reddit): - Reports that alerting from event logs can be noisy in remote/SaaS-first environments. - Complaints about pricing complexity and delays in provisioning products for trial/evaluation.

Why some customers left / churn risks (recurring themes)

Common churn risks cited by users:

Alert noise and tuning challenges.
Gaps in cloud/SaaS workload visibility reported by some users.
Limitations in reporting and export functionality impacting compliance and customer reporting.
Role/access limitations that impede multi-admin MSP operations.

Vendor case study examples

ConnectWise publishes vendor-authored SIEM and SOC case studies (for example, an anonymized partner story about migrating from a custom approach to the vendor’s SIEM and managed SOC). Critical evaluation: - Vendor case studies are promotional by nature and should be treated as directional. - Buyers should request metrics, baselines, and methodology when assessing vendor claims in case studies (for example, how alert volume reduction and MTTR improvements were measured).

Vendor performance/ROI claims to scrutinize

The vendor has published relative response-time and automation claims linked to AI/automation features. Public materials do not include detailed measurement methodologies; organizations should validate such claims during proof-of-concept (POC) tests using their own telemetry and operational baselines.

04Best fit

Company size (practical ICP)

MSPs: small-to-midsize managed service providers managing a broad range of endpoints across SMB customers.
End-customer SMBs served by MSPs: small-to-midsize businesses where MSPs can package security services for those customers.

Strong-fit industries

MSP client bases frequently include professional services, small healthcare clinics, local government, finance/insurance agencies, and manufacturing SMBs.

Roles and personas

Decision makers: MSP owner/CEO, VP of operations, security practice lead, SOC manager.
Day-to-day users: security analysts, escalation engineers, service desk leads (especially where the SIEM integrates with ticketing and PSA workflows).

Pain points the product addresses

Limited internal around-the-clock monitoring capacity
Tool fragmentation and alert overload for MSP-managed customers
Need to present security operations outcomes to SMB customers through packaged services

Qualification criteria (good fit)

MSPs that have standardized on the ConnectWise ecosystem (PSA/RMM/security products) and seek operational alignment across those tools.
MSPs that require multi-tenant SIEM capabilities with optional managed SOC augmentation and packaged retention options.

05The pitch

What the product does (core value proposition)

ConnectWise SIEM is a multi-tenant security information and event management offering aimed primarily at managed service providers (MSPs). It collects telemetry across multiple customer environments, correlates events, and provides investigation and response workflows. ConnectWise describes the product as incorporating AI/ML features, and offers optional 24/7 SOC support as a managed service. Product tiers are described as “SIEM Essentials” and “SIEM Pro.” In practice, “ConnectWise SIEM” reflects a product lineage: - It is historically rooted in Perch Security (a SIEM and MSP-focused SOC) acquired by ConnectWise in 2020. - ConnectWise has referenced StratoZen (automation/data analysis) and Asio (platform layer) in relation to the SIEM’s evolution.

Target market and market positioning

Primary buyer: Managed Service Providers (MSPs) and MSP-adjacent security practices.
Positioning: presented as a SIEM designed for MSP scale, emphasizing multi-tenancy, packaged tiering, and optional SOC services to reduce the need for deep in-house SIEM expertise.
Typical environments: Windows endpoints, Microsoft 365, and common MSP security stack tools; the higher tier stresses broader SaaS/network integrations and extended retention.

Get a comprehensive analysis of ConnectWise SIEM including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →