MaxPatrol SIEM
MaxPatrol SIEM helps security teams see activity across IT infrastructure and detect incidents.
What MaxPatrol SIEM is
MaxPatrol SIEM helps security teams see activity across IT infrastructure and detect incidents. It collects data actively and passively from more than 300 types of systems, and alerts operators to unavailable sources, unusual event distributions, or delayed data. Teams can choose from 20 dashboard widgets or create their own, and a visual rule constructor creates detection rules without code or a rule language. The system maps network topology and updates it as the network changes. Its Behavioral Anomaly Detection module uses 49 machine-learning models to identify targeted attacks and previously unknown anomalies. Expertise packs provide detection rules, collection and incident-handling parameters, response recommendations, and reputation lists. The product uses PDQL and supports authenticated scans and real-time alerting. It is available as self-hosted software for Linux and Windows environments, as well as web. Pricing is on request, and the vendor invites organizations to request a pilot. Displaying asset vulnerability information requires a separate MaxPatrol Vulnerability Management license.
Good
- Collects data from more than 300 system types.
- Visual rule builder does not require coding.
- Topology mapping updates as infrastructure changes.
- Behavioral detection uses 49 machine-learning models.
- Vendor offers a pilot.
Watch out
- Pricing is available on request.
- Vulnerability display requires a separate license.
- Warranty support applies during the update access period.
Who it suits
MaxPatrol SIEM suits security staff seeking infrastructure visibility, incident detection, and customizable rules across many data sources. It is intended for organizations prepared to evaluate a self-hosted deployment and request a pilot or pricing.
Verdict
MaxPatrol SIEM combines broad data collection, alerting, rule creation, and behavioral detection for infrastructure monitoring. Organizations should account for its self-hosted deployment and the separate license needed to display asset vulnerability information.
Plans and prices
From MaxPatrol SIEM's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| MaxPatrol SIEM | Priced on request | Pricing by consultation; vendor offers a pilot |
The facts
Each one read from MaxPatrol SIEM's own pages, with the date it was checked.
What it does
- Asset visibility
- Maintains asset history including installed software, events, vulnerabilities, configuration, and topology.checked 9 Oct 2026
- Behavioral detection
- Its Behavioral Anomaly Detection module uses 49 machine-learning models to detect targeted attacks and previously unknown anomalies.checked 9 Oct 2026
- Dashboards
- Users can choose from 20 default dashboard widgets or create their own.checked 9 Oct 2026
- Data collection
- It collects data actively and passively from more than 300 types of systems.checked 9 Oct 2026
- Data sources
- Collects data actively and passively from over 300 types of systems.checked 9 Oct 2026
- Deployment
- The help portal lists Linux distributions including Astra Linux Special Edition 1.7 and Debian 10, and supports some components on specified Windows Server versions.checked 9 Oct 2026
- Integration limit
- Displaying asset vulnerability information requires a MaxPatrol Vulnerability Management license, according to the vendor's version 6.1 release notes.checked 9 Oct 2026
- Integrations
- The product page describes MaxPatrol NAD Sensor as a component that analyzes network traffic, collects asset data, and detects attacks.checked 9 Oct 2026
- Intended users
- The maker describes the product as helping security staff gain infrastructure visibility and detect incidents across IT infrastructure.checked 9 Oct 2026
- Network analysis
- The MaxPatrol NAD Sensor analyzes network traffic, passively collects asset data, and detects attacks including attempts to contact command-and-control servers.checked 9 Oct 2026
- Network visibility
- The product maps network topology automatically and updates it as the network changes.checked 9 Oct 2026
- Pilot
- The product page invites organizations to request a pilot.checked 9 Oct 2026
- Purpose
- MaxPatrol SIEM provides visibility into infrastructure and detects security incidents.checked 9 Oct 2026
- Rule creation
- A visual rule constructor lets users create incident detection rules without learning a language or writing code.checked 9 Oct 2026
- Source monitoring
- Operators are alerted to unavailable data sources, event-distribution anomalies, or delays in event data.checked 9 Oct 2026
- Support
- Positive Technologies says warranty support for valid product licenses is available during the update access period.checked 9 Oct 2026
- Threat detection
- Its BAD module uses 49 machine-learning models and can independently detect targeted attacks and previously unknown anomalies.checked 9 Oct 2026
- Threat intelligence
- Expertise packs include detection rules, collection and incident-handling parameters, response recommendations, and reputation lists.checked 9 Oct 2026
- Threat knowledge
- Expertise packs provide new detection rules, updated collection and incident-handling parameters, response recommendations, and reputation lists.checked 9 Oct 2026
The company
- Founded
- 2002checked 28 Sep 2026
- Headquarters
- Moscow, Russiachecked 28 Sep 2026
Alternatives to MaxPatrol SIEM
- 1
Wazuh
Free planOpen sourceWebAPILinuxmacOS8.4From $571 a month - 2
Blumira
Free planAndroidiOSWebAPI8.2Free plan - 3
UTMStack
Open sourceWebAPILinuxmacOS7.9From $238.80 a month - 4
Sumo Logic
Free planWebAPILinuxmacOS7.6Free plan - 5
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 6
Vigil
Free planOpen sourceWebAPILinuxmacOS7.5Free plan