Datadog vs LogRhythm NextGen SIEM Platform

• APIs, the ability to interact with the data we pull into data dog is key. We port the information over to Servicenow, so the ability to pull everything into DataDog, then Servicenow, is a key component of our success here at Wayfair.
• Simple Interface - clean, useful, effective. Allows users to use DataDog for one reason, get work done.
• Lightweight agent on hosts

Read full review

• LogRhythm is a great SIEM to learn content on because the building blocks are very intuitive and easy to implement. All of the concepts relevant to content development are literally represented as drag and drop building blocks that can be easily manipulated.
• The statistical building blocks contain powerful anomaly detection capabilities that are extremely difficult to implement in other SIEMs or not possible at all.
• LogRhythm does better event classification than any other SIEM by far. My team typically drops all classification schemes from default installations of SIEMs and rebuilds them from scratch. I can actually use LogRhythms event classifications in rules without worrying about excessive partial matches or correlating unwanted events.

Read full review

• User interface could be improved in some areas, looking for host information and the agent install link takes a bit of time.
• Configuration of the agent is generally done via a config file which is a pro and a con. It would be nice to have some UI to configure various agent options.
• Billing isn't entirely straightforward, they could use more reports to figure out the source of your monthly costs.

Read full review

• While searching for log events is quick, the interface isn't as user-friendly as other SIEM products.
• Many of the administrative/management functions are only available through the full LogRhythm desktop console, not through the web console.
• The LogRhythm agent, when used for FIM and RIM, is very memory intensive.

Read full review

• One of our critical production databases went down a couple of weeks back. Just because we had the Datadog monitoring enabled for that database, Datadog sent the alerts to PagerDuty and we were instantly notified via pager and email alert. We could act right away and bring up the database within a few mins.
• Ability to create custom screenboards have allowed us to track the critical and warning alerts in front of our eyes all the time

Read full review

• The ability to search through logs in a centralized location really helps us to provide RCA (Root Cause Analysis) to management for outages. This helps us to quickly identify the cause of outages and thus saves money due to reduced downtime.
• Being able to configure the alarms to provide real-time notification (and responses) to security events helps to prevent potential loss due to compromises (such as a fraudulent wire transfer).
• The initial investment in LogRhythm SIEM is somewhat expensive, however, the appliance is built to your specific needs so you won't have to constantly be upgrading the device as your company grows.

Read full review