Use Network Intelligence on the project I'm currently on. Depends on your criteria (obviously) and what you intend to collect events from.

We've found custom integration quite fiddly, once you go above standard OS events via Syslog.

I don't have any experience with other SIM products so can't recommend (or not) NI but it's not bad, certainly worth evaluating. They have quite a good looking roadmap last time I looked and are constantly updating the system (is that a good or bad thing?).

Sometimes it still has the feel of a beta product but it has held up pretty well. Also now they are under the EMC/RSA umbrella then I would expect it to be well supported.