First, I would like to preface that this is alpha and should not replace anything in prod at the moment.

What I like about how SIEMatic is built:

* Django (personal familiarity)

* Agent, Indexer, crawlers and web all share a codebase with separate settings

* Search language is built around django orm, built-in jinja2 and ast.literal_eval makes it very versatile, I will be writing some tutorials soon

* search commands designed to handle dataframes, Django Querysets and records (lists of dicts) with predictable conversion between them (you can filter early in you search pipeline)

* from local on sqlite (rundev command) to distributed on postgres with scaling/tuning tips

* comes out of the box ready to monitor your host and provide dashboards and savedsearches

* crawlers handle data retention, alerting, summary event generation and more

There's a bunch more, but again, this is alpha software.