Auvik vs. LogicMonitor vs. LogRhythm NextGen SIEM Platform

Auvik is well suited for managed service customers and small-scale SMB customers who do not have enough technical resource to manage and monitor their network. Also for customer who has distributed networks spreaded across worldwide or nation wide, Auvik is well suited since it does not need any on-premise setup at each site except for a collector. For customer who has already adopted and used cloud network and hosting services, Auvik is better as Auvik is also fully cloud based offering

Incentivized

The example I will give will explain my rating for it. One employee left our company due to a personal issue, and at that time, our team was working on a highly secure project. He wanted to take revenge on our company, so he began hacking our systems from the outside. Since it appears that someone without authorization is attempting to access our systems, LogicMonitor simultaneously alerted our team to the problem. We stopped that threat with LogicMonitor.

Incentivized

Having mostly worked with their on-premises solution, I think it's well-suited for small , medium, and even big organisations. I feel it might be less suited if the customer wants a SIEM with 100% uptime, as it goes down a lot. Or if they want to depend on customer support. I suggest that if you want to go with LR, you have to have your own experienced engineers to work on.

Incentivized

• Auvik is the big pic tool of choice for network diagramming, helps layout of our network infrastructure, and we'll know immediately the status of the devices that are successfully communicating, and those that may have, for example, credentials issues.
• Auvik's "Traffic Insights" are key accelerators for intuitively isolating and resolving traffic-related issues quickly and easily, and the historical information makes it simpler to deduce what aspects may need replacement, capacity improvement, or possibly even re-architecture.
• Auvik integration tools are excellent solution enhancers - that are of particular interest to our company, as we make use of MS Teams and Connectwise products; we would like to see some features to integrate to ServiceNow as well.

Incentivized

• It shows us system issues right away so we can fix them fast.
• It finds new devices on its own, so we do not miss anything.
• It alerts us only when something really unusual happens.
• Its dashboards make it easy for everyone to see system health.
• It helps us see trends so we are ready for busy times.

Incentivized

• LogRhythm NextGen SIEM Platform has an alarm system that generates tickets based on the event and the way it has been configured in the LogRhythm console. Let's say we have a ticket for a malicious email attachment. The ticket will some information like the source of the log, the source IP, destination IP etc. It can be drilled down to obtain specific information like the recipient, source location, file attachment name, SHA hash of the file, source and destination port, time, mac address of the machine that downloaded it etc. This helps the analysts to go to the root of the cause and take actions easily without manually parsing them.
• The second good thing about the LogRhythm NextGen SIEM Platform is that it is very easy to use with its well-structured interface. To use LogRhythm, an user barely require any technical skills. A little overview of IP, CIDR, hash, etc. is enough to get your hands on it. It requires no programming or coding skills, as everything is GUI based. It also provides a beautiful visualization dashboard. There is another beautiful feature that it provides for the classification of events, known as cases. Multiple users working on the same platform can create cases and add events to it. They also help to maintain future reference.
• The third good feature is the search tool which is very powerful. For example, sometimes it is hard to find the users who downloaded a malware from the guest wireless of the institution and not the private network. The search tool helps us in searching the user by automatically correlating the MAC address from the current network logs and the previous logs as the MAC address is the same. It is highly scalable for parsing a large number of logs from various sources.
• I particularly think this is one of the best software available for log parsing in an organization where non-technical users are working on incident response. This tool has a good amount of flexibility. However, it can only be configured with the LogRhythm NextGen SIEM Platform Console.
• In terms of usability, as already mentioned, it is a very easy tool to use, with a GUI based interface.

Incentivized

• The map is not easy to quickly zoom in and out of or pan around. Usually requires a lot of filter toggling. Keyboard shortcuts for this would be nice.
• Better global settings that can be pushed to multiple client organizations
• Security groups/RBAC for user permissions across multiple clients
• Ability to change the URL

Incentivized

• Segmentation at an instance level not just the resource when clients are sharing the same device but shouldn't see each other's relevant data
• ARM CPU support for collectors to allow for a lighter weight appliance deployment
• WMI collection with a Linux collector so a windows collector would not be needed or a virtual appliance template that can be used to deploy collectors

Incentivized

• LogRhythm absolutely needs to provide back end support for threat intelligence lists. Performing a linear search on massive lists of IPs on incoming web traffic can bring the SIEM to its knees.
• LogRhythm should drop its entire code base for implementing lists and simply turn them into hash tables to avoid the excessive cost associated with referencing lists in rules. I haven't seen the code, but the performance suggests O(n).
• The reporting feature is the worst of all SIEMs, luckily reports are not my primary service offering. LogRhythm should definitely revamp its reporting to be more intuitive.

Incentivized

Because it's an amazing product.

Incentivized

This product has met virtually all of our needs. It was easy to implement and has been simple to support. Customization has been intuitive with many options available. They keep adding features and expanding available options. The future of LogicMonitor looks even better than it is today which is very promising. The management and support teams at LogicMonitor are always helpful

Incentivized

LogRhythm is focused on SIEM. That is their core business. Cost of operations, feature set and ease of use. The Log Rhythm support team is outstanding. Overall reliability is good. Reporting module needs some improvement and LR is promising that there will be significant improvements in future releases.

Incentivized

The program can be a bit unwieldy at times, however the majority of information is displayed in a readable and friendly way. The maps and popup information box from the bottom can be harder to use on a smaller screen but on a 1080p+ display tends to work fine.

Incentivized

Set up is super easy. Just stand up a small Linux or Windows server to act as a collector. There are no agents to install on monitored devices and all you need is SNMP or WMI access. When creating dashboards, all you have to do is find the widget on the device you want to show up and choose the menu option to add it.

Incentivized

LogRhythm does a rather decent job of making the functionality advanced (allowing for advanced keyword & field searching, use of "AND" as well as "OR" statements in the search bar) while keeping it accessible (by not requiring a specific syntax to do quick searches). This combined with a user interface that has headings and labels that are intuitive is very helpful.

Incentivized

We have never had a major outage or impact that was noticeable.

Incentivized

Pages can be slow to load on larger sites but tends to be fine for most clients.

Incentivized

Fast response and knowledgeable. If the technician does not know, they will look for the information and get back to you.

Incentivized

The sales team support we received was top notch. They worked hand in hand to make sure the product met all expectations. So far we have not really had to work with support that much; we have worked with setup team after purchase to deploy product fully. No issues so far and we are four weeks in.

Incentivized

While LogRhythm support is generally quick to respond, the initial response is usually from a first line support engineer with general knowledge of the product. Any advanced or complex issues have always required the assistance of a higher tier of support, directly or indirectly. For a few occasions we actually used our PS hours to work on the issue.

Incentivized

Add good training

Incentivized

The training is good but room to improve

Incentivized

I did not truly dedicate myself to implementing LogicMonitor. However, I overheard the IT team members explain that "LogicMonitor is perfect for us as it has made most of the work automated, and implementation and training sessions were perfect for us." Thus, I can state that everything went smoothly with our implementation.

Incentivized

• Buy professional services.
• Buy and implement the system if possible.
• Remember that the end point log configuration may require other teams in your company to assist you in getting the desired logs from all resources.
• Attend the end user and daily operations training after a period of usage so you are not overwhelmed with information on concepts not yet seen.
• Don't be afraid to call for help during your first months of use.
• Don't close any ticket until you are sure the expected results are verified.
• Use the community forums to discuss issues with your peers.
• Watch the training videos offered by L R University.

Incentivized

Auvik can stand up against any of the big network management and monitoring solutions on the market. I've implemented and used SolarWinds at many organizations for over 15 years. The paradigm that SolarWinds, PRTG, Prime, etc., work under is completely different than Auvik. It's apparent that Auvik was aiming to solve a different problem and built that solution from the ground up. For any organization responsible for multiple other organizations' infrastructure, Auvik is invaluable in comparison to the other products listed.

Basically, we did not have any idea about it and how to choose, but we asked one of our former bosses, as they were very experienced with it, so they helped us by clarifying a few things between New Relic and LogicMonitor, as they told us that if you are looking for an automated option, then there is no better option than LogicMonitor.

Incentivized

LogRhythm was simpler to set up and configure as well as extract information from. It also was less intrusive in terms of how many appliances were needed to implement. We were up and running within 5 hours to start accepting log sources. We selected LogRhythm as well since support is based in the USA in Colorado.

Incentivized

Pricing seems to be getting more and more aggressive, I worry that it's going to turn into ServiceNow or SAP and everything minor feature will be an extreme cost that prices out us and our customers

Incentivized

Auvik has worked on sites with 15+ offices connected with VPN's and we have not encountered any issues with the monitoring. On larger sites the map can be a bit cumbersome to read however it can be cleaned up easily with device filters.

Incentivized

Haven't really used it but our initial onboarding PS was disappointing. Felt like we were being told what we needed to cover as opposed to what we wanted to cover. In addition, we were pushed into using the PS in tight time frames and we were not ready to do so.

Incentivized

• the ROI for Auvik comes from the time it saves in updating documentation and onboarding, new clients. We no longer have to spend a day investigating a network and documenting it, this is life and up to date so you always have true information for reporting and troubleshooting.

Incentivized

• We Eliminated an on-prem monitoring tool which was in excess of 25 servers
• A decrease in time to response from our Network Operations Center resulted in a more consistent client experience
• Dynamic alert thresholds helped reduce alerting by about 10 to 15% as soon as we turned it on for volatile metrics like CPU and memory

Incentivized

• It gives the overall view of the environment so we are always aware of our security position.
• It has created operational effectiveness; we are able to rapidly detect threats and resolve it fast.
• We have been able to track inappropriate login attempts through tickets.

Incentivized