AlienVault USM vs Palo Alto Networks Threat Protection

• Up to this point, I have had no issues integrating with a system we currently have in production. while AlienVault stays on top with plugin updates.
• Te dashboard is very informative when you figure out how to navigate around it and tweaked to your organization needs.
• Correlation of events is probably my favorite as I normally only need to jump on the AlienVault dashboard to hammer down on network traffic/activity details.

Read full review

• The threat engine has constant updates for important threats.
• Wildfire helps supplement the Threat engine to help protect against 0 day threats.
• The way the threat engine can be added at different levels to different zones and policies helps to ensure business essential traffic can have policies that are tuned to ensure traffic will flow.

Read full review

• Because AlienVault USM combines several well know components, you have to life with the fact, that they are not in their latest version, i.e. the integrated OSSEC, which should be replaced with the OSSEC-Wazuh fork instead.
• Due to the all-in-one approach, the solution is quite resource hungry. You have to have a decent machine to run it.
• The reporting module is nice, but sometimes it is quite a challenge to configure a custom report as you will only get the results you want after a trial and error run.

Read full review

• Visibility into signatures and how they function/what triggers them would be very beneficial.
• Lacking customizability compared to other tools.
• Inability to write custom signatures easily and for traffic with small (less than 8 bit) signatures.

Read full review

• New deployment hasn't been fully calculated yet.
• With the addition of Panorama and central logging, event investigation has become more streamlined.

Read full review