I am working on a Classified IS that has been up and running for several years. The IS runs Windows and Cisco equipment with a Nessus for vulnerability scanning. We are looking into adding a SIEM tool to upgrade our logging and correlation efforts. We need the tool to be an on-premise air gapped system that can run on windows OS.

Right now we are looking into ELK and LogRhythm.

1. Are there any other recommended products we should be looking at?

2. Do you have any experience in the 2 previously mentioned?

thanks in advance