The LogRhythm NextGen SIEM Platform, from LogRhythm in Boulder, Colorado, is security information and event management (SIEM) software which includes SOAR functionality via SmartResponse Automation Plugins (a RespondX feature), the DetectX security analytics module, and AnalytiX as a log management solution that centralizes log data, enriches it with contextual details and applies a consistent schema across all data types.
N/A
Spotfire
Score7.8 out of 10
N/A
Spotfire, formerly known as TIBCO Spotfire, is a visual data science platform that combines visual analytics, data science, and data wrangling, so users can analyze data at-rest and at-scale to solve complex industry-specific problems.
N/A
Pricing
LogRhythm NextGen SIEM Platform
Spotfire
Editions & Modules
No answers on this topic
No answers on this topic
Offerings
Pricing Offerings
LogRhythm NextGen SIEM Platform
Spotfire
Free Trial
No
Yes
Free/Freemium Version
No
No
Premium Consulting/Integration Services
No
Yes
Entry-level Setup Fee
No setup fee
No setup fee
Additional Details
—
For Enterprise engagements, contact Spotfire directly for a custom price quote.
Having mostly worked with their on-premises solution, I think it's well-suited for small , medium, and even big organisations. I feel it might be less suited if the customer wants a SIEM with 100% uptime, as it goes down a lot. Or if they want to depend on customer support. I suggest that if you want to go with LR, you have to have your own experienced engineers to work on.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A high level of data integration is available here it supports various data sources and so on. Collaborating features allow users to give access to the dashboard and merge data analytics with other team members. It can meet the demands of both small and large size business enterprises. A customized dashboard and reports are provided to meet the specific needs and get support of extensibility through APIs and customized scripts.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
LogRhythm NextGen SIEM Platform has an alarm system that generates tickets based on the event and the way it has been configured in the LogRhythm console. Let's say we have a ticket for a malicious email attachment. The ticket will some information like the source of the log, the source IP, destination IP etc. It can be drilled down to obtain specific information like the recipient, source location, file attachment name, SHA hash of the file, source and destination port, time, mac address of the machine that downloaded it etc. This helps the analysts to go to the root of the cause and take actions easily without manually parsing them.
The second good thing about the LogRhythm NextGen SIEM Platform is that it is very easy to use with its well-structured interface. To use LogRhythm, an user barely require any technical skills. A little overview of IP, CIDR, hash, etc. is enough to get your hands on it. It requires no programming or coding skills, as everything is GUI based. It also provides a beautiful visualization dashboard. There is another beautiful feature that it provides for the classification of events, known as cases. Multiple users working on the same platform can create cases and add events to it. They also help to maintain future reference.
The third good feature is the search tool which is very powerful. For example, sometimes it is hard to find the users who downloaded a malware from the guest wireless of the institution and not the private network. The search tool helps us in searching the user by automatically correlating the MAC address from the current network logs and the previous logs as the MAC address is the same. It is highly scalable for parsing a large number of logs from various sources.
I particularly think this is one of the best software available for log parsing in an organization where non-technical users are working on incident response. This tool has a good amount of flexibility. However, it can only be configured with the LogRhythm NextGen SIEM Platform Console.
In terms of usability, as already mentioned, it is a very easy tool to use, with a GUI based interface.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
LogRhythm absolutely needs to provide back end support for threat intelligence lists. Performing a linear search on massive lists of IPs on incoming web traffic can bring the SIEM to its knees.
LogRhythm should drop its entire code base for implementing lists and simply turn them into hash tables to avoid the excessive cost associated with referencing lists in rules. I haven't seen the code, but the performance suggests O(n).
The reporting feature is the worst of all SIEMs, luckily reports are not my primary service offering. LogRhythm should definitely revamp its reporting to be more intuitive.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
The donut chart is I guess a powerful illustrations but I hope it should be done quite simple in Spotfire. But in Spotfire there are lots of steps involve just to build a simple donut chart.
Table calculation (like Row or Column Differences) should be made simple or there should be drag and drop function for Table Calculation. No need for scripting.
Information Link should be changed. If new columns are added to the table just refreshing the data should be able to capture the new column. No need extra step to add column
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
LogRhythm is focused on SIEM. That is their core business. Cost of operations, feature set and ease of use. The Log Rhythm support team is outstanding. Overall reliability is good. Reporting module needs some improvement and LR is promising that there will be significant improvements in future releases.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
-Easy to distribute information throughout the enterprise using the webplayer. -Ad hoc analysis is possible throughout the enterprise using business author in the webplayer or the thick client. -Low level of support needed by IT team. Access interfaces with LDAP and numerous other authentication methods. -Possible to continually extend the platform with JavaScript, R scripts, HTML, and custom extensions. -Ability to standardize data logic through pre-built queries in the Information Designer. Everyone in the enterprise is using the same logic -Tagging and bookmarking data allows for quick sharing of insights. -Integration with numerous data sources... flat files, data bases, big data, images, etc. -Much improved mapping capability. Also includes the ability to apply data points over any image.
LogRhythm does a rather decent job of making the functionality advanced (allowing for advanced keyword & field searching, use of "AND" as well as "OR" statements in the search bar) while keeping it accessible (by not requiring a specific syntax to do quick searches). This combined with a user interface that has headings and labels that are intuitive is very helpful.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Basic tasks like generating meaningful information from large sets of raw data are very easy. The next step of linking to multiple live data sources and linking those tables and performing on the fly analysis of the imported data is understandably more difficult.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
Even though, it's a rather stable and predictable tool that's also fast, it does have some bugs and inconsistencies that shut down the system. Depending on the details, it could happen as often as 2-3 times a week, especially during the development period.
Generally, the Spotfire client runs with very good performance. There are factors that could affect performance, but normally has to do with loading large analysis files from the library if the database is located some distance away and your global network is not optimal. Once you have your data table(s) loaded in the client application, usually the application is quite good performance-wise.
While LogRhythm support is generally quick to respond, the initial response is usually from a first line support engineer with general knowledge of the product. Any advanced or complex issues have always required the assistance of a higher tier of support, directly or indirectly. For a few occasions we actually used our PS hours to work on the issue.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Support has been helpful with issues. Support seems to know their product and its capabilities. It would also seem that they have a good sense of the context of the problem; where we are going with this issue and what we want the end outcome to be.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
The instructor was very in depth and provided relevant training to business users on how to create visualizations. They showed us how to alter settings and filter views, and provided resources for future questions. However, the instructor failed to cover data sources, connecting to data, etc. While it was helpful to see how users can use the data to create reports, they failed to properly instruct us on how to get the dataset in to begin with. We are still trying to figure out connections to certain databases (we have multiple different types).
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
The online training is good, provides a good base of knowledge. The video demonstrations were well-done and easy to follow along. Provided exercises are good as well, but I think there could be more challenging exercises. The training has also gone up in price significantly in the last 3 years (in USD, which hurts us even more in Canada), and I'm not sure it is worth the money it now costs (it is worth how much it cost 3 years ago, but not double that.)
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
The original architecture I created for our implementation had only a particular set of internal business units in mind. Over the years, Spotfire gained in popularity in our company and was being utilized across many more business units. Soon, its usage went beyond what the original architectural implementation could provide. We've since learned about how the product is used by the different teams and are currently in the middle of rolling out a new architecture. I suggest:
Have clearly defined service level agreements with all the teams that will use Spotfire. Your business intelligence group might only need availability during normal working hours, but your production support group might need 24/7 availability. If these groups share one Spotfire server, maintenance of that server might be a problem.
Know the different types of data you will be working with. One group might be working with "public" data while another group might work with sensitive data. Design your Library accordingly and with the proper permissions.
Know the roles of the users of Spotfire. Will there only be a small set of report writers or does everyone have write access to the Library?
ALWAYS add a timestamp prompt to your reports. You don't want multiple users opening a report that will try and pull down millions of rows of data to their local workstations. Another option, of course, is to just hard code a time range in the backing database view (i.e. where activity_date >= sysdate - 90, etc.), but I'd rather educate/train the user base if possible.
This probably goes without saying, but if possible, point to a separate reporting database or a logical standby database. You don't want the company pounding on your primaries and take down your order system.
LogRhythm was simpler to set up and configure as well as extract information from. It also was less intrusive in terms of how many appliances were needed to implement. We were up and running within 5 hours to start accepting log sources. We selected LogRhythm as well since support is based in the USA in Colorado.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Spotfire is significantly ahead of both products from an ETL and data ingestion capability. Spotfire also has substantially better visualizations than Power BI, and although the native visualizations aren't as flexible in Tableau, Spotfire enables users to create completely custom javascript visaualizations, which neither Tableau or Power BI has. Tableau and Power BI are likely only superior to Spotfire with respect to embedded analysis on a website.
In an enterprise architecture, if Spotfire Advanced Data services(Composite Studio),data marts can be managed optimally and scalability in a data perspective is great. As the web player/consumer is directly proportional to RAM, if the enterprise can handle RAM requirement accomodating fail over mechanisms appropraitely, it is definitely scalable,
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
