AWS Elastic Beanstalk is the platform-as-a-service offering provided by Amazon and designed to leverage AWS services such as Amazon Elastic Cloud Compute (Amazon EC2), Amazon Simple Storage Service (Amazon S3).
$35
per month
LogRhythm NextGen SIEM Platform
Score 7.1 out of 10
N/A
The LogRhythm NextGen SIEM Platform, from LogRhythm in Boulder, Colorado, is security information and event management (SIEM) software which includes SOAR functionality via SmartResponse Automation Plugins (a RespondX feature), the DetectX security analytics module, and AnalytiX as a log management solution that centralizes log data, enriches it with contextual details and applies a consistent schema across all data types.
N/A
Pricing
AWS Elastic Beanstalk
LogRhythm NextGen SIEM Platform
Editions & Modules
No Charge
$0
Users pay for AWS resources (e.g. EC2, S3 buckets, etc.) used to store and run the application.
I have been using AWS Elastic Beanstalk for more than 5 years, and it has made our life so easy and hassle-free. Here are some scenarios where it excels -
I have been using different AWS services like EC2, S3, Cloudfront, Serverless, etc. And Elastic Beanstalk makes our lives easier by tieing each service together and making the deployment a smooth process.
N number of integrations with different CI/CD pipelines make this most engineer's favourite service.
Scalability & Security comes with the service, which makes it the absolute perfect product for your business.
Personally, I haven't found any situations where it's not appropriate for the use cases it can be used. The pricing is also very cost-effective.
LogRhythm is good for providing a comprehensive view of the environment. It gives a great outline of whatever is going on in our servers and systems regarding security malfunctions. The SIEM sends real-time notifications when there are some occurrences; like creating a new user and inappropriate login attempts. It also avails a good use case that meets our HIPAA compliance.
Getting a project set up using the console or CLI is easy compared to other [computing] platforms.
AWS Elastic Beanstalk supports a variety of programming languages so teams can experiment with different frameworks but still use the same compute platform for rapid prototyping.
Common application architectures can be referenced as patterns during project [setup].
Multiple environments can be deployed for an application giving more flexibility for experimentation.
LogRhythm NextGen SIEM Platform has an alarm system that generates tickets based on the event and the way it has been configured in the LogRhythm console. Let's say we have a ticket for a malicious email attachment. The ticket will some information like the source of the log, the source IP, destination IP etc. It can be drilled down to obtain specific information like the recipient, source location, file attachment name, SHA hash of the file, source and destination port, time, mac address of the machine that downloaded it etc. This helps the analysts to go to the root of the cause and take actions easily without manually parsing them.
The second good thing about the LogRhythm NextGen SIEM Platform is that it is very easy to use with its well-structured interface. To use LogRhythm, an user barely require any technical skills. A little overview of IP, CIDR, hash, etc. is enough to get your hands on it. It requires no programming or coding skills, as everything is GUI based. It also provides a beautiful visualization dashboard. There is another beautiful feature that it provides for the classification of events, known as cases. Multiple users working on the same platform can create cases and add events to it. They also help to maintain future reference.
The third good feature is the search tool which is very powerful. For example, sometimes it is hard to find the users who downloaded a malware from the guest wireless of the institution and not the private network. The search tool helps us in searching the user by automatically correlating the MAC address from the current network logs and the previous logs as the MAC address is the same. It is highly scalable for parsing a large number of logs from various sources.
I particularly think this is one of the best software available for log parsing in an organization where non-technical users are working on incident response. This tool has a good amount of flexibility. However, it can only be configured with the LogRhythm NextGen SIEM Platform Console.
In terms of usability, as already mentioned, it is a very easy tool to use, with a GUI based interface.
Limited to the frameworks and configurations that AWS supports. There is no native way to use Elastic Beanstalk to deploy a Go application behind Nginx, for example.
It's not always clear what's changed on an underlying system when AWS updates an EB stack; the new version is announced, but AWS does not say what specifically changed in the underlying configuration. This can have unintended consequences and result in additional work in order to figure out what changes were made.
LogRhythm absolutely needs to provide back end support for threat intelligence lists. Performing a linear search on massive lists of IPs on incoming web traffic can bring the SIEM to its knees.
LogRhythm should drop its entire code base for implementing lists and simply turn them into hash tables to avoid the excessive cost associated with referencing lists in rules. I haven't seen the code, but the performance suggests O(n).
The reporting feature is the worst of all SIEMs, luckily reports are not my primary service offering. LogRhythm should definitely revamp its reporting to be more intuitive.
As our technology grows, it makes more sense to individually provision each server rather than have it done via beanstalk. There are several reasons to do so, which I cannot explain without further diving into the architecture itself, but I can tell you this. With automation, you also loose the flexibility to morph the system for your specific needs. So if you expect that in future you need more customization to your deployment process, then there is a good chance that you might try to do things individually rather than use an automation like beanstalk.
LogRhythm is focused on SIEM. That is their core business. Cost of operations, feature set and ease of use. The Log Rhythm support team is outstanding. Overall reliability is good. Reporting module needs some improvement and LR is promising that there will be significant improvements in future releases.
It is a great tool to manage your applications. You just need to write the codes, and after that with one click, your app will be online and accessible from the internet. That is a huge help for people who do not know about infrastructure or do not want to spend money on maintaining infrastructure.
LogRhythm does a rather decent job of making the functionality advanced (allowing for advanced keyword & field searching, use of "AND" as well as "OR" statements in the search bar) while keeping it accessible (by not requiring a specific syntax to do quick searches). This combined with a user interface that has headings and labels that are intuitive is very helpful.
As I described earlier it has been really cost effective and really easy for fellow developers who don't want to waste weeks and weeks into learning and manually deploying stuff which basically takes month to create and go live with the Minimal viable product (MVP). With AWS Beanstalk within a week a developer can go live with the Minimal viable product easily.
While LogRhythm support is generally quick to respond, the initial response is usually from a first line support engineer with general knowledge of the product. Any advanced or complex issues have always required the assistance of a higher tier of support, directly or indirectly. For a few occasions we actually used our PS hours to work on the issue.
- Do as many experiments as you can before you commit on using beanstalk or other AWS features. - Keep future state in mind. Think through what comes next, and if that is technically possible to do so. - Always factor in cost in terms of scaling. - We learned a valuable lesson when we wanted to go multi-region, because then we realized many things needs to change in code. So if you plan on using this a lot, factor multiple regions.
We also use Heroku and it is a great platform for smaller projects and light Node.js services, but we have found that in terms of cost, the Elastic Beanstalk option is more affordable for the projects that we undertake. The fact that it sits inside of the greater AWS Cloud offering also compels us to use it, since integration is simpler. We have also evaluated Microsoft Azure and gave up trying to get an extremely basic implementation up and running after a few days of struggling with its mediocre user interface and constant issues with documentation being outdated. The authentication model is also badly broken and trying to manage resources is a pain. One cannot compare Azure with anything that Amazon has created in the cloud space since Azure really isn't a mature platform and we are always left wanting when we have to interface with it.
LogRhythm was simpler to set up and configure as well as extract information from. It also was less intrusive in terms of how many appliances were needed to implement. We were up and running within 5 hours to start accepting log sources. We selected LogRhythm as well since support is based in the USA in Colorado.
The ability to search through logs in a centralized location really helps us to provide RCA (Root Cause Analysis) to management for outages. This helps us to quickly identify the cause of outages and thus saves money due to reduced downtime.
Being able to configure the alarms to provide real-time notification (and responses) to security events helps to prevent potential loss due to compromises (such as a fraudulent wire transfer).
The initial investment in LogRhythm SIEM is somewhat expensive, however, the appliance is built to your specific needs so you won't have to constantly be upgrading the device as your company grows.
