AlienVault® Unified Security Management®
(USM) delivers threat detection, incident response, and compliance
management in one unified platform. It is designed to combine all the essential security
capabilities needed for effective security monitoring across cloud and
on-premises environments, including SIEM, intrusion detection, vulnerability
management, as well as continuous threat intelligence updates. The vendor states that even for resource-limited IT
security teams, AlienVault…
$1,075
per month
Ivanti Neurons for MDM
Score 7.6 out of 10
N/A
Ivanti Neurons for MDM is a cloud‑Based Mobile Device Management. Ivanti Neurons for MDM enables secure access to data and apps on any device across the Everywhere Workplace.
At this point I'm saying a 4. While the marketing material make it appear to be easy to use and it was relatively easy to set up, as previously mentioned, each event description is based upon the individual asset making it nearly impossible for the administrator to be a SME for each asset. For example, if one of the assets reporting is a router, the administrator monitoring alerts would need to know what the various events are that can be triggered as an event for the particular router; however, if the asset is a workstation, the administrator would need to know the various events that are triggered for workstations.
For devices that require single-app mode (iOS) deployments are easy to manage. We are also able to control which OS features are available at a very granular level. What is often lacking are good guides illustrating how to implement certain features - for example, setting up single-app mode for the first time is not intuitive and should not require opening service requests with the helpdesk.
The tools for remote support require a lot of effort and have made implementation of this capability a financial decision instead of a technical one. By this I mean that it's better to request budget for professional services than to invest mine or my team's time, which makes it far less likely to get implemented. Things that cost money and require justifications to the finance team are disadvantaged from the word go.
AlienVault USM is simple and easy to deploy. Sensors can be deployed in as little as 15 minutes through the setup wizard.
The USM UI is easy to understand. I've trained multiple analysts who are able to perform their duties on their first day, in part because of USM Anywhere's ease of use.
Top-notch built-in compliance templates and reporting features.
MobileIron has a very easy to deploy architecture. We reviewed other products before making our business decision to deploy MobileIron, and one of the reasons we selected MobileIron was due to the ease of deployment, the low footprint, and the ease of configuration.
MobileIron has a broad range of customizations and add-on products that make it an ideal product for a number of additional use cases. None of these use cases got business backing at BH Media, but Docs@Work and Apps@Work are two features that would make MobileIron an ideal tool for a customer who needs to allow BYOD or company devices the ability to access documents or applications without VPN.
MobileIron is supported by a large number of devices and their operating systems. In a company which allows BYOD devices, you can't always control what device a user is going to bring in. MobileIron has support for older devices and OS versions and is also quick to adopt newer devices, so a new device isn't shut out in the cold waiting for a vendor to update their software.
Personally, I've wished I could purchase a service that would configure AV for my environment. I get a lot of traffic on a daily basis and I almost need to hire an analyst that just works on AV.
Some of the filters when looking for a specific alert aren't that easy to use.
Documentation is hard to find. Most of MobileIron's (MI) documentation can only be accessed through an MI account. This, in itself, is not a problem. The problem is locating specific information. Typically with other MDMs, a quick google search will point you to the location of the documentation within the official website. The way MI has their documentation locked down, I cannot find anything I'm looking for through a google search. Also, there were times documentation is locked by permissions and links provided by support are inaccessible to me due to these restrictions.
Sales - The sales team can sometimes come off as not genuine. I understand the purpose of sales is to sell and make money for the company, but the approach sometimes feels artificial; they say they have to company's best interest in mind, but the push for a sell like a car salesman.
Many of the automation options are not explicitly available into MobileIron Core. I have to use a special scripting language to make MI do the things I need it to do, such as automatically retire devices that have been inactive for 60 days.
The centralized logging and retention for PCI compliance was our main driver, and it is meeting that need. Otherwise there has been enough frustration with the lack of documentation and the need to customize through the CLI that I would be open to alternatives.
So far we have been very pleased with MobileIron and it has accomplished many of our goals. We are looking forward to continued improvements on Windows 8 platforms and Android PIM solutions. The only way that we would leave is if a solution came out that was better suited to work with Lotus Notes
Once you are able to navigate the different panels, finding what you need is quite easily. Before getting used it it can be a bit of challenge . Each panel is quite well laid out and the filtering search capabilities are quite strong.
We do have issues with maintenance on the AlienVault USM as the disk fills up from time to time with other data sources. Sources for scanning logs and net flow data isn't calculated in regular disk maintenance and can easily fill up our disk if we do not keep an eye on it with some custom Nagios plugins. The system does properly trim logging data from logging sources properly.
With the latest release of AlienVault USM overall performance has not been an issue. We have noticed single source events per second does not scale well with the overall system. 2,000eps on a vmware system with a single source produces delays of up to an hour for us. Pages, reporting and even raw log searches are rather quick though.
The support we received from alienvault was excellent. They went above and beyond in making sure everything was working as it needed to be. They REALLY want their product implementation to be a success and our security goals be achieved. They are like a member of our security team.
I have been using MobileIron for years. As with any company, they suffered the constraints of growth. I don't normally deal with call-in support, but in the few instances that I have the level of support has gotten inherently better. My usual support experience is from a dedicated individual(s) from professional services. This is mainly because of the size of the deployment. This offers a resource that is thoroughly familiar with your environment. Another benefit is that you can contact them directly, which eliminates the handing off and starting over with multiple individuals. As a company they are extremely committed in their support structure and making it better. They send out audits and welcome any interaction and if there is a complaint they follow up with efficacy
I did not have any experience with "in person" training directly. The free online classes offered for a half a day are based on the actual training offered. These little teasers are very good and well worth your time to learn a few quick and dirty ways of getting more information from your SIEM
It was very well organized and helpful in using the product to the fullest extent. The instructor allowed time for folks who were involved with managed services to receive tuning tips in order to better support their customers. In addition, the course materials were automatically updated when the new version came out.
It is online based, after learning content you can take a test and if you don't pass you get two other chances to pass. Once you pass the test you can print out your certification or save it
AlienVault USM was a very simple to implement and get up and running. We started with a trial version and had that up and going within an hour of receiving email instructions from the sales engineer. We never had to contact support to get the system up and going. It was extremely easy to convert over to a full license once we started with a paid version.
Splunk's ES is a paid add-on on top of an already pricey product. Finding a MSSP that supports Splunk and isn't a 6 figure annual commitment seems unlikely. LogRhythm did not have a cloud-based solution when we were considering SIEMs. Fantastic product though and have a good MSSP base. Devo did not have a MSSP partner base when we looked. Their product is fantastic too. AlienVault USM has good partners to choose from as well as an affordable cloud model, that's why we chose it.
We've evaluated a number of other MDM solutions before finally deciding on MobileIron as our choice. These included AirWatch, Good, Citrix and IBM. None came close to the cost price point offered by MobileIron providing the same solutions. The initial setup/configuration was provided for free and training classes were exceptional. Other vendors did not offer the same level of support provided by MobileIron.
The AlienVault USM is not very scalable. Some scalability can be achieved by installing additional sensors, but this only offers 500eps per sensor and is still overall limited by the installation type of VM or physical. We have also noticed the EPS (events per second) is rated overall and not towards a single source. A single source on a very healthy VMware partition tops out at 2,000eps for us, no matter how we configure it. Maybe this is a problem of the 5.2 release?
Once you hit the 150 asset mark, you have to jump to their unlimited license. There is no middle ground. We were only 10 or so assets above the 150 so we had to chose to either not monitor those assets or pay the price of the upgrade.
AlienVault brings all the information to one place which makes it much quicker to track down problems.
MobileIron initially was a positive part of our mobile stack. However after two years, we are exploring in-house solutions as Mobile Iron has not been stable enough for our needs. We had a MobileIron-related outage last year that took a week to resolve and cost our business substantially.
I believe MobileIron is more effective with Android devices than iOS.
MobileIron seems better suited to devices that need to be updated/managed infrequently (~ 1/week or less often). For tablets that need daily MDM interactions, MobileIron was not sufficiently reliable.
