The LevelBlue USM Anywhere XDR platform (replacing the former AlienVault USM) delivers threat detection, incident response, and compliance management.
$1,075
per month
Splunk Enterprise
Score 8.5 out of 10
N/A
Splunk is software for searching, monitoring, and analyzing machine-generated big data, via a web-style interface. It captures, indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations.
I have used Splunk before, and they are both good products. I generally like AlienVault more than Splunk, and one of the main reason is cost. For medium-sized managed service providers, cost is a big thing, and justifying that cost to customers is a hard thing to do. I also …
I have used Splunk before and it is also a good product. I feel that AlienVault has a lower learning curve and is easier to setup and query. I would liken the comparison to Splunk is like using command line for setup and normalization where as AlienVault would be using a GUI …
As a SIEM, USM is easier and more user friendly than Splunk. however, Splunk isn't only geared for security. As a network engineering tool, USM isn't a good fit. We use both. Nessus is a great vulnerability scanning tool. But it does not serve the wider purpose of USM, which is …
Splunk's ES is a paid add-on on top of an already pricey product. Finding a MSSP that supports Splunk and isn't a 6 figure annual commitment seems unlikely.
LogRhythm did not have a cloud-based solution when we were considering SIEMs. Fantastic product though and have a good …
We looked at Splunk and compared it to AlienVault USM,but their offerings weren't as friendly both in implementation and pricing. One of the biggest pluses of AlienVault USM is the offering of an on-premise virtual appliance. We are still a shop where we like to be hands-on …
I evaluated Splunk in the past but found the interface and work required to build queries and manage alerting was more work than I was willing to take on. I didn't like having to learn another language just to search for what I wanted. Through a managed service provider I also …
AlienVault was given to us, even though we already had Secureworks. Both SecureWorks and Fireye are more of a Managed solution. It's fine to say we'll use AlienVault but it requires a lot of expertise to get it running and alerting correctly. And even then, if no one is …
AlienVault provides a much simpler implementation than Zabbix but of course the cost is much lower. While both do a good job, AlienVault USM does the best for vulnerability scanning and reporting but Zabbix excels much better with integration with Splunk for alerting.
We already had familiarity with the platform but we needed cloud support so we upgraded to USM. We reviewed a few other options but decided USM was the best fit our requirements and price point.
The tools reviewed were quite sophisticated. The reason for choosing AlienVault USM was mainly inclusiveness (multiple services integrated) of the solution as well as the cost-benefit ratio. Integrating the solution into our current infrastructure also appeared relatively …
Compared to the main competitor's products, the AlienVault USM is particularly good in terms of cost effectiveness. Your company does not need to spend a huge amount of money in the first place just to test out the result. By using AlienVault USM, you can also get great support …
AlienVault was able to provide the same basic functionalities as the other competitors. Open Threat Exchange is a really good feature, and the fact that it came with intrusion detection was a huge plus and key part of why we purchased.
Balancing what each product had to offer, the grade of difficulty of implementation and the investment it represented for our company AlienVault came out as the better option for our infrastructure.
The tool works well compared with the two others. As I said previously, AlienVault USM gives you a lot of visibility right out of the box and with very little configuration.
However, I like the ability to customize pieces, such as log parsers and dashboards, as I see fit without …
Alienvault was the most aggressive in their pricing and marketing of ease of deployment. The ease of deployment was what really aided in their ability to win our business. The ROI was worth the investment for our security at the time. Also being a market leader aided in our …
AlienVault seems to have a better UI and easier integration than the rest of the products. The price was slightly lower and had more features/easier integrations with external components. Overall AlienVault was selected based on the SOC 2 requirements we needed to fill. When …
Honestly, pricing is the main reason. AlienVault was already purchased when I was hired as Director, and the company did not have enough budget for anything else. Implementation was subpar, very disappointing, and renewal was a nightmare.
At this point I'm saying a 4. While the marketing material make it appear to be easy to use and it was relatively easy to set up, as previously mentioned, each event description is based upon the individual asset making it nearly impossible for the administrator to be a SME for each asset. For example, if one of the assets reporting is a router, the administrator monitoring alerts would need to know what the various events are that can be triggered as an event for the particular router; however, if the asset is a workstation, the administrator would need to know the various events that are triggered for workstations.
It's well suited for what I do, which is network security operations. And that's for anything from troubleshooting incidents, troubleshooting performance, troubleshooting for the purpose of a compliance and auditing. It's not best suited for users who are new in terms of they're new to the product and they have expectations that probably Splunk cannot meet.
AlienVault USM is simple and easy to deploy. Sensors can be deployed in as little as 15 minutes through the setup wizard.
The USM UI is easy to understand. I've trained multiple analysts who are able to perform their duties on their first day, in part because of USM Anywhere's ease of use.
Top-notch built-in compliance templates and reporting features.
Personally, I've wished I could purchase a service that would configure AV for my environment. I get a lot of traffic on a daily basis and I almost need to hire an analyst that just works on AV.
Some of the filters when looking for a specific alert aren't that easy to use.
The centralized logging and retention for PCI compliance was our main driver, and it is meeting that need. Otherwise there has been enough frustration with the lack of documentation and the need to customize through the CLI that I would be open to alternatives.
We are using Splunk extensively in our projects and we have recently upgraded to Splunk version 6.0 which is quite efficient and giving expected results. We keep track of updates and new features Splunk introduces periodically and try to introduce those features in our day to day activities for improvement in our reporting system and other tasks.
Once you are able to navigate the different panels, finding what you need is quite easily. Before getting used it it can be a bit of challenge . Each panel is quite well laid out and the filtering search capabilities are quite strong.
You can literally throw in a single word into Splunk and it will pull back all instances of that word across all of your logs for the time span you select (provided you have permission to see that data). We have several users who have taken a few of the free courses from Splunk that are able to pull data out of it everyday with little help at all.
We do have issues with maintenance on the AlienVault USM as the disk fills up from time to time with other data sources. Sources for scanning logs and net flow data isn't calculated in regular disk maintenance and can easily fill up our disk if we do not keep an eye on it with some custom Nagios plugins. The system does properly trim logging data from logging sources properly.
With the latest release of AlienVault USM overall performance has not been an issue. We have noticed single source events per second does not scale well with the overall system. 2,000eps on a vmware system with a single source produces delays of up to an hour for us. Pages, reporting and even raw log searches are rather quick though.
The support we received from alienvault was excellent. They went above and beyond in making sure everything was working as it needed to be. They REALLY want their product implementation to be a success and our security goals be achieved. They are like a member of our security team.
Splunk maintains a well resourced support system that has been consistent since we purchased the product. They help out in a timely manner and provide expert level information as needed. We typically open cases online and communicate when possible via e-mail and are able to resolve most issues with that method.
I did not have any experience with "in person" training directly. The free online classes offered for a half a day are based on the actual training offered. These little teasers are very good and well worth your time to learn a few quick and dirty ways of getting more information from your SIEM
It was very well organized and helpful in using the product to the fullest extent. The instructor allowed time for folks who were involved with managed services to receive tuning tips in order to better support their customers. In addition, the course materials were automatically updated when the new version came out.
The online course was simple clear and described the main capabilities of the solution. There is also an initial module that can be done for free so anyone can familiarize themselves with the functionality of this solution. On the other hand, however, there could be more free online courses. Maybe even with a certificate, this would broaden the group of people who are familiar with the platform while increasing familiarity with the solution itself.
AlienVault USM was a very simple to implement and get up and running. We started with a trial version and had that up and going within an hour of receiving email instructions from the sales engineer. We never had to contact support to get the system up and going. It was extremely easy to convert over to a full license once we started with a paid version.
Splunk's ES is a paid add-on on top of an already pricey product. Finding a MSSP that supports Splunk and isn't a 6 figure annual commitment seems unlikely. LogRhythm did not have a cloud-based solution when we were considering SIEMs. Fantastic product though and have a good MSSP base. Devo did not have a MSSP partner base when we looked. Their product is fantastic too. AlienVault USM has good partners to choose from as well as an affordable cloud model, that's why we chose it.
I didn't get to fully evaluate Logstash as our corporation was already using Logstash, but both seemed like viable solutions to the problem that we were having. I wanted to evaluate Logstash some more, both did seem like they would work for the business needs that we had, we went with splunk as many teams were already using it.
The AlienVault USM is not very scalable. Some scalability can be achieved by installing additional sensors, but this only offers 500eps per sensor and is still overall limited by the installation type of VM or physical. We have also noticed the EPS (events per second) is rated overall and not towards a single source. A single source on a very healthy VMware partition tops out at 2,000eps for us, no matter how we configure it. Maybe this is a problem of the 5.2 release?
Once you hit the 150 asset mark, you have to jump to their unlimited license. There is no middle ground. We were only 10 or so assets above the 150 so we had to chose to either not monitor those assets or pay the price of the upgrade.
AlienVault brings all the information to one place which makes it much quicker to track down problems.
I don't have any numbers to share but Splunk has positively served as a 24/7 monitoring tool that has saved hours of work by self-detecting, saving statistics and alerting problems in the system or from external interfaces as soon as they happen.
Splunk dashboards does a solid job in collecting, analyzing data and creating reports that contain an entire day's activity and then automatically sent out to the business.
Splunk is very easy to learn and very useful to any program or business application.
