AlienVault OSSIM (discontinued) vs. Apple Business Essentials

The most obvious scenario in which OSSIM is well suited is in a single office/home office (SOHO) or small business, in which budget is reduced but asset discovery and vulnerability management are greatly needed and appreciated. OSSIM is lightweight and free, so the real challenge to face is to hire or assign an administrator to manage and operate it, instead of any investment on an expensive appliance. Also, as resellers, promoting usage of OSSIM to customers charging for professional services for installation, administration, and maintenance (remember that OSSIM doesn't have official support from AlienVault) is a great asset for the organization.

Incentivized

Fleetsmith is well suited for companies with a lot of Macs, Mac minis, Apple tvs, etc., that are all over the place (different offices, states, countries, floors, remote employees, etc). It makes the management of these central where it would be almost impossible otherwise.

Incentivized

• Threat analysis. It can correlate different events happening to detect a pattern or an attack.
• Dashboard provides a clean, single location to see what is going on in our environment.
• Up to date open threat exchange means everything new popping up out there is included and watched for in our environment.

Incentivized

• Fleetsmith does a great job of being unobtrusive on managed devices. After initial deployment, one might never know it’s there except when it prompts to enforce a software update.
• Fleetsmith has sensible defaults and relatively few decisions for the administrator to make; for most applications and configurations, it’s sufficient to enforce a minimum version. For more complex use cases, I suggest falling back on Fleetsmith’s ability to install tools such as Puppet and run arbitrary shell commands.

Incentivized

• Creating custom rules is a bit complicated
• Reporting could be improved
• Agent has caused conflicts with a couple of our other applications

Incentivized

• We were told that this was in the works and it would be implemented at the beginning of the year 2019. That has still not happened and whenever we ask about this functionality we cannot get a good answer.
• Management of devices that are already in the field—we were told that in order to use Fleetsmith as we would like (pushing apps to devices) we would have to get each device and set them up from a Mac.
• Integration with Windows.

AlienVault OSSIM is far easy to use and manage - provided you know what you're doing. As any SIEM application, there is some background knowledge required in order to take advantage of the product's functionalities, such as the log correlation and analysis. Other than that, the application is quite usable and robust.

Incentivized

It's very simple to use. Sometimes a little too simple, so it can be tempting to fiddle around or tweaks settings that might have annoying downstream impacts. But it's easy to rollback or disable changes anyway. My only wish is that each option set should have its own deeper explanation about the impact of the options on real-world users or security concerns.

Everything is done through MSSP and installation pro services. Once those hours are burned up, then you're on your own without a lot of help. Typically the pro services hours aren't enough to get past 60 days and MSSP are hit and miss. We had a miss for installation helpers.

Incentivized

Fantastic support. I have had a few queries on how to go about doing things in the best way and the support at Fleetsmith was always very quick to reply and with excellent advice and detail to solve the problem and lead is into our best use of their product.

AlienVault OSSIM as the first experience with a SIEM is very fine, especially if your company is an SMB. Every SIEM shares some features in common with other products, features such as log retrieval and normalization. So if you stick with principles, you can learn other SIEM products as well. If your environment is not of a minimum size, LogRhythm might be overkill for your network, same with McAfee Enterprise Security Manager.

Incentivized

I include Samsung Knox as a competitor in this field because you can have a similar setup with any Samsung devices purchased through a reseller as well. We have gone down this route for a few devices that have needed to be Android and the difference between the two platforms is night-and-day. Apple Business Essentials Manager is much easier to use and manage.

Incentivized

• OSSIM and the installers didn't really help us optimize at installation. OSSIM went without optimization for almost two years before that fact was noticed. I think this decreased ROI.
• Finding and researching incidents is much faster with all data available. Sometimes too much data, though.

Incentivized

• Lesser cost for managing device, instead of getting more manpower to do it manually.
• Lesser security threats (which will cause financial damage) as all devices are configured according the the company security policies, such as firewalls, media management, app security updates.

Incentivized