IBM Log Analysis with LogDNA vs. Security Onion

IBM Log Analysis with LogDNA is well suited if you are using other IBM cloud product ecosystems. It's very mature and supports HIPAA-compliant configurations if you need to store PI/PHI data. We particularly use it for audit requirements but understand the limitation with the retention period is for 30 days only. Also you need to configure if your IBM cloud service doesn't have any log collection or report tool. Log collection agents are widely supported for most of infrastructure in cloud.

Incentivized

Security Onion works well for setting up within a Linux environment. This brings a new platform to run and maintain though. The application its self has helped to keep track of logs and vulnerabilities in the environment. Alert triage and case creation is simple to start and follow through to the end.

• Easier integration with other IBM cloud resources
• Flexible access control setup using RBAC
• Supports other infrastructure as well, like Kubernetes and VMs

Incentivized

• GUI
• Support
• Easy of use

• Ability to create KPI charts and metrics dashboards out of the box

Incentivized

• Requires Linux
• Training

If you use other IBM product ecosystems, IBM Log Analysis with LogDNA is the obvious choice, as it supports seamless integration and better access control with IBM cloud access group setups. IBM Log Analysis with LogDNA was flexible and has wide support for various infrastructure implementations and is also controlled by the same IAM access setup. It can be configured for any IBM cloud services or platform logs or for infrastructure by installing the agent.

Incentivized

Other vendors may have a more robust solution but for our needs, Security Onion was the one to move forward with. We have tested some of the others but the cost of those platforms makes the ROI not as desirable. There is a learning curve with Security Onion but it is worth it for the value provided.

• Most of IBM cloud services support easier integration for log analysis.
• We are able to achieve compliance with various audit log reports, which improves governance and control over various cloud resources we have.
• Also IBM Log Analysis with LogDNA helps in troubleshooting and analysis for application logs in real time. This helps with improved issue resolution timings.

Incentivized

• Makes Alert Triage easier to handle
• Analysis of threats simple