Which SIEM supports FIPS compliant logging in air-gapped environments?

Several SIEM platforms can support FIPS-compliant logging in air-gapped environments, but the answer depends on what you mean by “support”:

• Splunk Enterprise Security — can be deployed on-premises / air-gapped, and on supported hardened/FIPS-capable platforms it can be used in FIPS-aligned environments.
• IBM QRadar — supports air-gapped on-prem deployments and is commonly used in regulated/FIPS-oriented environments.
• Microsoft Sentinel is not a fit for fully air-gapped environments because it is cloud-native.
• Elastic Security — can be self-managed and air-gapped, and can be configured to use FIPS-enabled crypto libraries in supported setups.

If you want the safest short answer, IBM QRadar and Splunk Enterprise Security are the most common SIEMs considered for air-gapped, FIPS-conscious deployments.

If you want, I can give you a comparison table of SIEMs by FIPS support, air-gap capability, and deployment model.