Overview

What is AlienVault OSSIM?

OSSIM leverages the power of the AlienVault Open Threat Exchange by allowing users to both contribute and receive real-time information about malicious hosts. AlienVault OSSIM is an open source Security Information and Event Management (SIEM) product. It is a unified…

Learn from top reviewers

Lego block SIEM

Rating: 6 out of 10

November 24, 2021

IncentivizedVetted Review

As an organization, we leveraged alien vault as a SIEM solution for ourselves and also as a managed services offering for our customers. The scope was to support environments ...

Verified user

Executive

4 years of experience

Alienvault - the friend from another world

Rating: 8 out of 10

November 4, 2021

IncentivizedVetted ReviewVerified User

AlienVault [OSSIM] is being used across the entire organization. It has an intelligent analytic engine to determine potential threats in our network. The dashboard provides a ...

Verified user

Professional

5 years of experience

A dinosaur aging gracefully!

Rating: 7 out of 10

February 11, 2020

IncentivizedVetted ReviewVerified User

We're currently on a migration path to eliminate AlienVault OSSIM but it was our only SIEM when I first arrived on location. We use it to collect and analyze security data fro...

John Keenan

Director - Information Technology

Director of Information Security

Memorial Hospital of Gulfport

2 years of experience

AlienVault OSSIM is the bomb!

Rating: 8 out of 10

October 15, 2019

IncentivizedVetted ReviewVerified User

AlienVault OSSIM is being used across the entire organization. We use the tools to assist in computer security, intrusion detection, and prevention. It provides effective thre...

Laurie Keith

Manager - Information Technology

Help Desk Manager

Black Hills Federal Credit Union

4 years of experience

AlienVault OSSIM: Best Bang for Your Buck Hands Down!

Rating: 10 out of 10

October 9, 2019

IncentivizedVetted ReviewVerified User

Anyone who works in a K12 public school district knows you have just as many threats inside your network as outside. Think about it, what else do 7 through 12 graders have but...

Matthew Frederickson

Executive - Information Technology

Director of Information Technology

Council Rock School District

3 years of experience

Log in with LinkedIn to see content from your network

Return to navigation

Pricing

View all pricing

AlienVault OSSIM

N/A

Unavailable

What is AlienVault OSSIM?

OSSIM leverages the power of the AlienVault Open Threat Exchange by allowing users to both contribute and receive real-time information about malicious hosts. AlienVault OSSIM is an open source Security Information and Event Management (SIEM) product. It is a unified platform…

Entry-level set up fee?

No setup fee

Offerings

Free Trial
Free/Freemium Version
Premium Consulting/Integration Services

Would you like us to let the vendor know that you want pricing?

25 people also want pricing

Alternatives Pricing

AlienVault USM

$1,075

per month

What is AlienVault USM?

AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments,…

Trellix Helix

Free

What is Trellix Helix?

Trellix Helix (formerly FireEye Helix) is a SIEM solution providing a non-malware threat detection solution.

Return to navigation

Product Demos

Archie Webster - AlienVault OSSIM Demo

YouTube

Explore OSSIM - demo HIDS

YouTube

OSSIM Demo (5.1) - Improved Threat Detection, Security Visibility, and Usability

YouTube

Return to navigation

Features

Security Information and Event Management (SIEM)

Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools

7.5

Avg 7.8

9.4
Centralized event and log data collection
(9) Ratings
Effectiveness of real-time centralized event and log data collection
6.9
Correlation
(10) Ratings
Correlation of logs and events to pinpoint significant threats
8.1
Event and log normalization/management
(10) Ratings
Ability to normalize event syntax so that logs can be compared and are machine-understandable
8.2
Deployment flexibility
(10) Ratings
Ability to tune system to maximize threat detection and minimize false positives
9.3
Integration with Identity and Access Management Tools
(6) Ratings
Integration with access control tools like Active Directory and LDAP
9.4
Custom dashboards and workspaces
(9) Ratings
dashboards that can be customized to meet the needs of specific groups
9.2
Host and network-based intrusion detection
(9) Ratings
Ability to detect both endpoint intrusion and network ingress detection
5.3
Data integration/API management
(2) Ratings
Ease and quality of data integrations between SIEM and other systems
5.4
Behavioral analytics and baselining
(2) Ratings
How effectively activity and behavior baselines are established and maintained
5.3
Rules-based and algorithmic detection thresholds
(3) Ratings
Effectiveness of manually-established rules and algorithmically-determined detection thresholds
6.3
Response orchestration and automation
(2) Ratings
Quality of built-in response orchestration and automation in Next-Gen SIEM
8.4
Reporting and compliance management
(4) Ratings
Ease and quality of reporting and compliance functions
6.4
Incident indexing/searching
(3) Ratings
Effectiveness of searching across structured and unstructured events and incidents within SIEM

Return to navigation

Product Details

About
Tech Details

What is AlienVault OSSIM?

OSSIM leverages the power of the AlienVault Open Threat Exchange by allowing users to both contribute and receive real-time information about malicious hosts. AlienVault OSSIM is an open source Security Information and Event Management (SIEM) product. It is a unified platform providing:

Asset discovery
Vulnerability assessment
Intrusion detection
Behavioral monitoring
SIEM

OSSIM provides the basis for AlienVault's proprietary Unified Security Management (USM) product.

It also leverages the power of the AlienVault Open Threat Exchange by allowing users to both contribute and receive real-time information about malicious hosts.

AlienVault OSSIM Technical Details

Operating Systems	Unspecified
Mobile Application	No

Return to navigation

Comparisons

View all alternatives

Compare with

Reviews From Top Reviewers

View all reviews

(1-5 of 9)

Sort By *

A dinosaur aging gracefully!

Rating: 7 out of 10

Incentivized

February 11, 2020

JK

John Keenan

Director of Information Security

Memorial Hospital of Gulfport (Medical Practice, 5001-10,000 employees)

Vetted Review

Verified User

2 years of experience

View profile

Pros

It integrates with a bunch of different platforms.
Collects tons of data from all integrated platforms provided the right level of logging is enabled.

Cons

The reports are clunky and a bit tedious to parse through.
Sometimes there's so much noise it's hard to tell what a true positive is. There are lots of false ones that trigger alerts but are normal behavior in many environments.

AlienVault OSSIM is the bomb!

Rating: 8 out of 10

Incentivized

October 15, 2019

LK

Laurie Keith

Help Desk Manager

Black Hills Federal Credit Union (Banking, 201-500 employees)

Vetted Review

Verified User

4 years of experience

Pros

Threat analysis. It can correlate different events happening to detect a pattern or an attack.
Dashboard provides a clean, single location to see what is going on in our environment.
Up to date open threat exchange means everything new popping up out there is included and watched for in our environment.

Cons

Reporting is not the greatest. I had internal developers take data and create some reports that better fit my needs.
Navigation through the vulnerability scans is not ideal.
Asset management is also cumbersome to navigate through.

AlienVault OSSIM: Best Bang for Your Buck Hands Down!

Rating: 10 out of 10

Incentivized

October 09, 2019

MF

Matthew Frederickson

Director of Information Technology

Council Rock School District (Education Management, 1001-5000 employees)

Vetted Review

Verified User

3 years of experience

Pros

Scan network for anomalies once you've established a baseline.
Excellent job of showing unusual connections or file transfers
Excellent job of showing the health of network, congestions, etc.

Cons

It only comes with 10 canned reports. These reports are good, but a little more flexibility would be nice. The data is stored in a database, so it is possible to roll your own reports, just very clunky.
Log ingestion. The OSSIM product doesn't have a separate log server, so you either have to have a really, really beefy system to do both analysis and log ingestion, or just do log ingestion with something else.
Aggregation of data. Actually, it does this really well, but if you have more then two sites, it can slow your analysis down a little.