Coremetrics / IBM Digital Analytics (discontinued) vs. LogRhythm NextGen SIEM Platform

IBM analytics has continued to improve upon the days of being the original core metrics. After using the updated version for quite some time, it has been great at providing the needed analytics to measure ROI and goal performance for our quarterly KPI's. It has resulted in a great increase in web engagements although we are a midsize company, smaller outfits may not need such an expensive option.

Incentivized

LogRhythm is good for providing a comprehensive view of the environment. It gives a great outline of whatever is going on in our servers and systems regarding security malfunctions. The SIEM sends real-time notifications when there are some occurrences; like creating a new user and inappropriate login attempts. It also avails a good use case that meets our HIPAA compliance.

Incentivized

• IBM CXA comprises an acquisition called Tealeaf. This tool has deep heritage and this is evident in its present-day capabilities.
• The Universal Behaviour Exchange or UBX puts the concept of personalisation at the forefront. The ability to combine physical (analog) and digital transactions to create the complete picture of a customer journey, is a stand out benefit.
• The solution does not have to involve the purchase of software. IBM CXA can be sold as a service bundled with analytics as a service. This not only lowers the cost of ownership, it gets around one of the principal issues. Strong staff with design and analytical capability to drive the solution and deliver tangible benefits.
• The seamless integration of Watson AI services to help with the heavy lifiting. Watson reinforces the analytical focus this solution has and can learn to recognise situations specific to a company.

Incentivized

• LogRhythm NextGen SIEM Platform has an alarm system that generates tickets based on the event and the way it has been configured in the LogRhythm console. Let's say we have a ticket for a malicious email attachment. The ticket will some information like the source of the log, the source IP, destination IP etc. It can be drilled down to obtain specific information like the recipient, source location, file attachment name, SHA hash of the file, source and destination port, time, mac address of the machine that downloaded it etc. This helps the analysts to go to the root of the cause and take actions easily without manually parsing them.
• The second good thing about the LogRhythm NextGen SIEM Platform is that it is very easy to use with its well-structured interface. To use LogRhythm, an user barely require any technical skills. A little overview of IP, CIDR, hash, etc. is enough to get your hands on it. It requires no programming or coding skills, as everything is GUI based. It also provides a beautiful visualization dashboard. There is another beautiful feature that it provides for the classification of events, known as cases. Multiple users working on the same platform can create cases and add events to it. They also help to maintain future reference.
• The third good feature is the search tool which is very powerful. For example, sometimes it is hard to find the users who downloaded a malware from the guest wireless of the institution and not the private network. The search tool helps us in searching the user by automatically correlating the MAC address from the current network logs and the previous logs as the MAC address is the same. It is highly scalable for parsing a large number of logs from various sources.
• I particularly think this is one of the best software available for log parsing in an organization where non-technical users are working on incident response. This tool has a good amount of flexibility. However, it can only be configured with the LogRhythm NextGen SIEM Platform Console.
• In terms of usability, as already mentioned, it is a very easy tool to use, with a GUI based interface.

Incentivized

• The user interface is in Flash, which can be very frustrating and slow at times. Apparently, this is to be transitioned in a future release.
• Can only segment the last 93 days of data. Any historical segmentation beyond the 93 days must be run in Explore (which is credit based, and has its own limitations with the number of credits per month, based on the initial contract with IBM).
• Reports can only display 93 days of data at a given time for custom date ranges. There are pre-programmed date ranges setup with IBM during implementation (last week, last month, last quarter etc.), but are not flexible enough to answer more specific questions.
• Certain reports cannot have segments applied, making answering some simple questions a bit more tricky. For example, I can create a segment around mobile devices and apply it to the marketing channels report, but I can't create a marketing channel segment and apply it to the mobile reports.
• Built in API calls allows for nice report design and automation.

• LogRhythm absolutely needs to provide back end support for threat intelligence lists. Performing a linear search on massive lists of IPs on incoming web traffic can bring the SIEM to its knees.
• LogRhythm should drop its entire code base for implementing lists and simply turn them into hash tables to avoid the excessive cost associated with referencing lists in rules. I haven't seen the code, but the performance suggests O(n).
• The reporting feature is the worst of all SIEMs, luckily reports are not my primary service offering. LogRhythm should definitely revamp its reporting to be more intuitive.

Incentivized

IBM Digital Analytics is a great solution for our clients and I believe they offer the best solution for the retail space. We have access to IBM support via email or live chat and they can answer many of the reporting questions that come up. IBM is receptive to our feedback of the product so I am confident they will continue making improvements

LogRhythm is focused on SIEM. That is their core business. Cost of operations, feature set and ease of use. The Log Rhythm support team is outstanding. Overall reliability is good. Reporting module needs some improvement and LR is promising that there will be significant improvements in future releases.

Incentivized

Very easy to implement and use.

LogRhythm does a rather decent job of making the functionality advanced (allowing for advanced keyword & field searching, use of "AND" as well as "OR" statements in the search bar) while keeping it accessible (by not requiring a specific syntax to do quick searches). This combined with a user interface that has headings and labels that are intuitive is very helpful.

Incentivized

Never had any issues

As reports are templated, the system is pretty quick. Sometimes you have to wait a bit for a report to render. Or you might have to re-load the page. But there is no real issue here and the system is on par with other similar systems.

Overall, the level of support is very good and I would say it is a strong asset of the solution. However, you can sometimes feel that there is a difference of level among the support team.

While LogRhythm support is generally quick to respond, the initial response is usually from a first line support engineer with general knowledge of the product. Any advanced or complex issues have always required the assistance of a higher tier of support, directly or indirectly. For a few occasions we actually used our PS hours to work on the issue.

Incentivized

Online training is really great. One of the best assets that they have. Lots of great videos, pop quizzes at the end of each module. Fantastic. Other tools have similar features, but not as good.

See previous comment: reading and understanding the encyclopedic implementation guide is a must.

• Buy professional services.
• Buy and implement the system if possible.
• Remember that the end point log configuration may require other teams in your company to assist you in getting the desired logs from all resources.
• Attend the end user and daily operations training after a period of usage so you are not overwhelmed with information on concepts not yet seen.
• Don't be afraid to call for help during your first months of use.
• Don't close any ticket until you are sure the expected results are verified.
• Use the community forums to discuss issues with your peers.
• Watch the training videos offered by L R University.

Incentivized

Much of the work we did in IBM Digital Analytics could have been answered through Google Analytics, a much simpler, agile and FREE solution set. Not mention, given the vast number of Google Analytics USERS, free and actionable support is simply a click away ... this compared to IBM Digital Analytics fractured and often absent support service.

LogRhythm was simpler to set up and configure as well as extract information from. It also was less intrusive in terms of how many appliances were needed to implement. We were up and running within 5 hours to start accepting log sources. We selected LogRhythm as well since support is based in the USA in Colorado.

Incentivized

This solution can support large amount of data and transaction. The way that user management features are built, it shows it is meant for large organizations.

• We spend too much time trying to work around bugs on the new UI.
• We spend too much time trying to figure out how to make certain segments work because support and the knowledge center are lackluster.
• Our sales rep is very unresponsive and leaves us searching for a lot of answers on our own, including what other products we may benefit from that IBM offers.

Incentivized

• The ability to search through logs in a centralized location really helps us to provide RCA (Root Cause Analysis) to management for outages. This helps us to quickly identify the cause of outages and thus saves money due to reduced downtime.
• Being able to configure the alarms to provide real-time notification (and responses) to security events helps to prevent potential loss due to compromises (such as a fraudulent wire transfer).
• The initial investment in LogRhythm SIEM is somewhat expensive, however, the appliance is built to your specific needs so you won't have to constantly be upgrading the device as your company grows.

Incentivized