Likelihood to Recommend If this is your first experience with a SIEM, this one can get you started. Take the time to learn the ins and outs of the product and you'll most likely be satisfied with it if your company is an SMB. If you need compliance reports, OSSIM is too small for you, you'll need to go with USM or USM Anywhere.
Read full review The Symantec IT Management Suite is used throughout the company (global). It is efficient and reports via email any type of problem found, from threats to attacks. The update on the clients is carried out without being noticed. When the system is doing some sort of scan, older computers are slow. Other than that, I believe it is an ideal software for monitoring the entire infrastructure.
Read full review Pros Asset discovery. Once installed in a centric, network-accessible server, OSSIM can poll all your endpoints with common protocols (SSH, SNMP, WMI) to detect and discover site-wide assets to monitor. You only need to group them by your own criteria once added to the product. SIEM Event Correlation. You can define quite complex correlation rules to detect possible suspicious or malicious actions or attempts in your network, in order to categorize them as real threats or as false positives, thus streamlining your risk assessment and management. Ease of installation. The entire AlienVault OSSIM is self-contained in an ISO file, which can be burned into a DVD or just mounted in your server of choice (physical or virtual) for deployment. The installation process is automated and quote verbosed, with options for static IP, email messaging and others. Ease of access. Being AlienVault OSSIM a self-contained appliance, it can be accessed via web by any device that supports a web browser, being that desktops, workstation, mobile devices, etc. The OSSIM dashboard and other features are automatically rearranged to adapt to the particular device being in use. Read full review End to end workstation imaging with a 45 minute average for OS, drivers and base software with only 1 technician touch to name the workstation. Application usage reporting on what software is being used and how much - broken down by site, department and user. 5% of managed workstations were patched. IT lifecycle reports were automated with live inventory feeds to enable purchase reports. Read full review Cons Creating custom rules is a bit complicated Reporting could be improved Agent has caused conflicts with a couple of our other applications Read full review Increased memory consumption Older machines can not support the program Read full review Usability AlienVault OSSIM is far easy to use and manage - provided you know what you're doing. As any SIEM application, there is some background knowledge required in order to take advantage of the product's functionalities, such as the log correlation and analysis. Other than that, the application is quite usable and robust.
Read full review I am bit biased after using Symantec ITSM for 10 plus years. However, I found its ability to wrap everything into one console for at a view enterprise health a powerful tool for my department and others. The ability to provide self healing of software packages to workstations was especially powerful. The ability to customize data connections to other tools and automate those inputs and outputs let us provide the business data to support enterprise decisions on Hardware and software usage.
Read full review Support Rating Everything is done through MSSP and installation pro services. Once those hours are burned up, then you're on your own without a lot of help. Typically the pro services hours aren't enough to get past 60 days and MSSP are hit and miss. We had a miss for installation helpers.
Read full review With the Blue Coat acquisition the question remains on how much support Symantec is going to give the ITSM suite. Its just not that sexy anymore to have to support a product that touches all the hardware anymore. A few of the really good support reps have gone the way of private which is very concerning.
Read full review Alternatives Considered Originally my organization leveraged alien value due to the lower cost of entry and ability to manage it as a service provider. Unfortunately, after several years of working with this tool, it became unwieldy to use as it felt that almost every useful report had to be created by hand. As other tools have come out with the ability to do automated responses such as
Stellar Data processor, we have begun to evaluate alternatives.
Read full review We evaluated Norton and Kaspersky, we chose Symantec to provide more options and more guarantees. In addition, we have used the tool for more than 10 years in the company (the time I am working). It has an interface with all monitoring data and statistics. A specific display of each piece of connected equipment in the network, making monitoring easy and, in case of a threat, it notifies us.
Read full review Return on Investment It satisfied a requirement of our audit team (internal and external). Custom written alerts allow us to be proactive for some events. Stable product means we don't spend a lot of time keeping it up and running. Read full review Reduction of virus infections Greater clarity in the reports Monitoring the network and infra Read full review ScreenShots