AlienVault USM: Simplifying Security with Cost-Effective Threat Detection.
Our organization uses AlienVault USM to enhance the security posture and streamline our clients' threat detection and response. The …
Starting at $1,075 per month
View PricingOverview
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as…
Recent Reviews
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Centralized event and log data collection (8)8.585%
- Correlation (8)8.585%
- Event and log normalization/management (8)8.080%
- Custom dashboards and workspaces (8)7.070%
Reviewer Pros & Cons
Pricing
Essentials
$1,075
Cloud
per month
Standard
$1,695
Cloud
per month
Premium
$2,595
Cloud
per month
Entry-level set up fee?
- Setup fee optional
For the latest information on pricing, visithttps://www.alienvault.com/products/pri…
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Features
Return to navigation
Product Details
- About
- Competitors
- Tech Details
- Downloadables
- FAQs
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as well as continuous threat intelligence updates. The vendor states that even for resource-limited IT security teams, AlienVault USM can be affordable, fast to deploy, and easy to use. It eliminates the need to deploy, integrate, and maintain multiple point solutions in the data center.
Smart, automated data collection & analysis: USM Anywhere automatically collects and analyzes data across the attack surface, helping to quickly gain centralized security visibility without the complexity of multiple disparate security technologies.
Automated threat detection powered by AT&T Alien Labs: With threat intelligence provided by AT&T Alien Labs, USM Anywhere is updated automatically to stay on top of evolving and emerging threats, so the security team can focus on responding to alerts.
Incident response orchestration with AlienApps: USM Anywhere supports a growing ecosystem of AlienApps, enabling the user to orchestrate and automate actions towards other security technologies, able to respond to incidents quickly and easily.
AlienVault USM Features
Security Information and Event Management (SIEM) Features
- Supported: Centralized event and log data collection
- Supported: Correlation
- Supported: Event and log normalization/management
- Supported: Deployment flexibility
- Supported: Integration with Identity and Access Management Tools
- Supported: Custom dashboards and workspaces
- Supported: Host and network-based intrusion detection
Additional Features
- Supported: AlienVault Open Threat Exchange
AlienVault USM Screenshots
AlienVault USM Videos
AlienVault USM Competitors
AlienVault USM Technical Details
| Deployment Types | Software as a Service (SaaS), Cloud, or Web-Based |
|---|---|
| Operating Systems | Unspecified |
| Mobile Application | No |
| Supported Countries | Global |
AlienVault USM Downloadables
- Unified Security Management vs. SIEM: a Technical Comparison
- AlienVault USM Anywhere: Datasheet
- AlienVault Fast Facts
- AlienVault USM Anywhere: Datasheet
- Beginner’s Guide to Open Source Intrusion Detection Tools
- SIEM for Beginners: Everything You Wanted to Know About Log Management But Were Afraid to Ask
Frequently Asked Questions
Splunk Cloud and Fortinet on IBM Cloud are common alternatives for AlienVault USM.
Reviewers rate Deployment flexibility highest, with a score of 8.6.
The most common users of AlienVault USM are from Mid-sized Companies (51-1,000 employees).
Comparisons
Compare with
Reviews and Ratings
(735)
Community Insights
TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!
- Business Problems Solved
- Recommendations
Users have found AlienVault USM to be a valuable SIEM solution for centralizing and searching log data from a large number of network attached devices. This platform is being used for various use cases such as vulnerability management, scanning, malware detection, and monitoring malicious network traffic. It is considered a good SIEM solution for organizations new to security operational logging or those with a smaller staff and budget. The product has been praised for its integrated feature sets, including HIDS, NIDS, FIM, and security alerting capabilities. The inclusion of features like vulnerability scanning and file integrity monitoring has extended its value for organizations in the early stages of cybersecurity program development. Many users have experienced real-time alerts, enabling them to respond to security incidents and compromised passwords more quickly. Furthermore, AlienVault is used for a range of functions such as SIEM, vulnerability scanning, asset discovery, and investigations. It provides organizations with a centralized log collection site, allowing them to monitor and address new problems more effectively. The platform has been effective in helping organizations meet regulatory compliance requirements and improve SOC operations. Additionally, AlienVault is used to analyze network traffic, Windows Event Logs, and other security events, helping organizations improve network security and protect their customers. It solves security challenges related to device and software visibility, monitoring for anomalous events, and ensuring patch management. Users appreciate the simplicity of deployment and the robustness of the interface. The support team is highly responsive and knowledgeable.
AlienVault USM Anywhere is used by organizations to easily identify security incidents happening across their infrastructure and comply with PCI-DSS compliance requirements. MSSPs utilize AlienVault USM Anywhere to provide their customers with best-in-class threat monitoring and response services. It is also used to monitor cloud environments, scanning and alerting for any known vulnerabilities or activity on servers. AlienVault helps organizations with auditing purposes by monitoring cloud permissions and changes to security. Additionally, it is deployed to customers for monitoring and is used by NSOCs to monitor their networks. AlienVault has been implemented across organizations, covering server assets and providing granular logging on systems and networks. It helps in raising alarms/alerts and mitigating network-related activities. AlienVault collects and alerts on network and system activity across the entire organization, making it easy to filter for important data. The product centralizes log data and helps perform vulnerability analysis and threat detection. It assists in security patching and monitoring within AWS environments. Users appreciate the ease of use and configuration of the cloud-based panel. AlienVault is implemented and managed for clients as a recommended SIEM solution, collecting and normalizing logs from various data sources. It is used throughout organizations to gain insight into network and server events, manage and correlate logs, and recognize anomalous activity. Users have been able to set up alerts for specific events and policies, effectively managing systems and alerts in place, monitoring multiple client environments, and identifying issues that clients may have missed.
AlienVault USM Anywhere is praised for its cost-effectiveness compared to other SIEM solutions on the market. Users appreciate its threat intelligence capabilities, ease of use, user-friendly interface, and simplicity of deployment. The built-in correlation rules require minimal setup and provide high-quality results. Asset management and scanning features help users stay on top of monitoring assets, including dynamic and static asset lists. The integration of OTX into USM Anywhere allows for up-to-date threat intelligence and pulse subscriptions.
The software plays a crucial role in monitoring and alerting when anomalies occur, aiding in threat detection, compliance management, log collection, and vulnerability scanning. It helps organizations stay up to speed on new vulnerabilities and supports agile business initiatives by aiding analysts in identifying cyber threats and providing access to threat cross-referencing data. AlienVault USM Anywhere is deployed to monitor AWS cloud environments, attain compliance, identify threats, and facilitate auditing of non-emergency configuration changes and vulnerability monitoring.
Overall, AlienVault USM Anywhere provides centralized security monitoring, incident response capabilities, compliance reporting features, vulnerability assessment tools, real-time SIEM functionality, as well as asset discovery and user activity monitoring capabilities. It has been widely adopted across various industries for enhancing security posture and gaining comprehensive visibility into network activities.
Based on user recommendations, AlienVault USM receives the following common recommendations:
-
AlienVault USM is recommended for cost-conscious companies and small to medium businesses due to its affordability and effectiveness. Users find it to be a great tool for analyzing and reacting to threats, offering excellent value for the price.
-
Users suggest exploring alternative SIEM choices and discussing functionality and configuration requirements. Logrhythm is mentioned as a possible alternate SIEM choice, especially for high-end functionality needs. It is advised to compare features and select the SIEM system that offers the best cost for desired features.
-
To maximize the experience with AlienVault USM, users recommend taking advantage of training opportunities provided by AlienVault. Joining official training sessions allows users to learn best practices from other users and gain comprehensive knowledge of the product. Users also recommend utilizing forums, support, webinars, and videos offered by AlienVault to enhance understanding and achieve optimal results.
Overall, AlienVault USM is regarded as a cost-effective solution suitable for organizations with data privacy and security priorities. The product's flexibility, community-created intelligence, and continual improvement are also highlighted by users. While some mention areas for improvement, such as support stability and module quality, the general consensus is that AlienVault USM delivers reliable security enhancements and cost savings.
Attribute Ratings
Reviews
(1-25 of 125)Companies can't remove reviews or game the system. Here's why
Our organization uses AlienVault USM to enhance the security posture and streamline our clients' threat detection and response. The product helps us address critical business problems, such as identifying and mitigating security threats, monitoring network activity, and ensuring compliance with regulations. Our use case involves deploying USM across our network to monitor logs, detect anomalies, and respond to incidents effectively.
- Asset discovery.
- Real-time threat detection.
- Centralized log management.
- Provides actionable insights into emerging threats.
- Intrusion detection.
- Enhancing user interface intuitiveness.
- Granular customization options for alerts and reporting.
- Integration with third-party tools and expanding support for emerging threat intelligence sources would be beneficial since the alien app only supports a few.
June 03, 2023
Empowering Security Zenith with Unified Vigilance.
As an IT researcher at a university, we use AlienVault USM for centralized security monitoring, threat detection, incident response, compliance reporting, and vulnerability assessment to enhance our security posture. The scope includes network infrastructure, servers, and critical systems.
- Unified Security Monitoring and Threat Detection.
- Integrated Incident Response.
- Compliance Management and Reporting.
- User Interface and Ease of Use.
- Customization and Flexibility.
- Enhanced Automation and Orchestration.
August 07, 2020
Unbeatable Security Machine
AlienVault is one of many security solutions that we utilize in our network. We use it to monitor unusual traffic and behavior to and from our domain controllers, which we combine with endpoint security and network security to have a granular view of activity throughout our network.
- Extremely customizable and versatile product.
- Useful dashboard and UI is easy to navigate.
- Log plugins parse logs from a variety of sources into a readable format
- AlienApps provide out-of-the-box integration with other solutions.
- The product requires a considerable amount of time to set up.
- Setting up log filters in order to prevent USM from quickly running out of space is very time-consuming.
- The product will stop working if the logs run out of space. There is no way to set retention rules to automatically clean up old logs.
July 13, 2020
AlienVault USM is a really beneficial SIEM solution.
We use Alienvault USM internally in our Security Operations Centre as part of our detection and response capabilities. We use it to monitor our on-premise networks and devices, our cloud servers as well as our cloud SaaS services. It allows us good visibility into our entire infrastructure and the events and alarms that we would otherwise miss.
We also implement and manage AlienVault USM deployments for clients as our recommended SIEM solution.
We also implement and manage AlienVault USM deployments for clients as our recommended SIEM solution.
- Ease of deployment and quick to get operating.
- Wide range of plugins and log receivers to ingest logs from many sources.
- Simple interface and dashboard makes daily operation quick and easy.
- Custom notification templates can be limited - it is not easy to get custom email alert content for example.
- Some network configuration on premise is needed to take full advantage of NIDS (port/traffic mirroring for example).
- Vulnerability scanning and reporting can be a bit sparse if you are used to the likes of Nessus.
Alienvault USM Anywhere touches all endpoints and networks of our organization. Is solves some big problems like:
1) Logging aggregation and actionable insights using log correlation.
2) Threat hunting & intel.
3) Vulnerability management and validation of our separate patch automation software.
4) Security orchestration.
5) Asset discovery and inventory management.
1) Logging aggregation and actionable insights using log correlation.
2) Threat hunting & intel.
3) Vulnerability management and validation of our separate patch automation software.
4) Security orchestration.
5) Asset discovery and inventory management.
- Log Correlation: The engineers at Alienvault/AT&T Cybersecurity have included a great integrated rule set (which continues to grow) to save analysts time on combing through logs and instead executing threat hunts, investigations, and remedial activities.
- Single pane-of-glass for all security activities from the convenience and efficiency of a SaaS web console, being that USM has deep integrations with over a dozen major software platforms (Office 365, GSuite, ZScaler, Box, etc.) and what they call plugins which interpret log and SIEM data from hundreds of vendors and platforms like Meraki, CrowdStrike, Aruba switches and AP's, etc.
- Great value! You can pay the same or more for other big name SIEM vendors that offer less features than this platform. Plus, even if you begin ingesting too much log data, you can filter specifics types of logs (for example, ones that have no impact to security) to bring data ingestion in line with your subscription level. The onboarding team did a great job in right-sizing our subscription plan, so this hasn't been a problem.
- Vulnerability scanning is currently done by authentication into the host over the network, even when the AlienVault USM agent is installed on an endpoint. It would be nice to have near-real-time vulnerability information provided via the agents. This would also delete the need for specially-configured remote-access admin service accounts on endpoints, which is just another account that has to be administered, namely password management and auditing for potential abuse and compromise.
- Endpoint agent support for ARM architecture is just starting to get going -- wide availability across Linux and MS Windows/Server platforms won't be available until possibly circa mid-2021. Fortunately, at least general asset scan info, authenticated vulnerability scans, etc. still provide a good deal of security inspection into these devices.
- Making some UI settings persist across logins on the web console is still lacking. Would also be nice to change a "detailed view" to icons/thumbnails/tiles. UI is very efficient in some aspects but frustrating in others.
July 03, 2020
One of the best SIEMs out there
We use AlienVault USM to monitor our network flow and alert us if any of our alarms are triggered. We integrate our Cisco Umbrella and Meraki solutions so that it saves time, having a single dashboard without having to check each instance. We also like the ability to create custom alarms and us the threat exchange to be notified of any day zero vulnerabilities on the software we run in the office.
- Easy intergration using APIs
- Bespoke alarm configuration
- OTX database
- Needs to be fine tuned to get any valuable insight
- Requires alot of resourses when running in VMs
- Cost makes it hard to sell to smaller buisnesses
May 19, 2020
First use of AlienVault USM
AlienVault USM is being used in our area as a monitoring tool. The main problems are due to the OSSEC agents used.
- Customizable
- Easy installation
- Scalable
- NXLog agent compatibility with the Spanish language.
- OSSEC Agent Compatibility
April 24, 2020
AlienVault USM anywhere
It addresses compliance and vulnerability assessments, which are critical in having a holistic view of mission-critical assets. USM also gives the ability to detect network threats before they are exploited by criminals, as well as forensic evidence of what happened when and how it happened. With the help of AlienApps, there is vast integration with existing security solutions.
- Authenticated vulnerability assessment
- Authenticated asset discovery
- Incident response
- Log correlation
- Ability to do an external vulnerability assessment.
- User training awareness through the console for administrators to educate users.
- Allow more remediation options for administrators to endusers.
March 13, 2020
Cybersecurity--Not "un"-achievable
Talos Cybersecurity is an MSSP providing Managed Detection and Response services to our clients. For this, we use AlienVault USM on-premises. It is very easy to deploy and setup and starts providing value as soon as it is plugged into the network. All the needs of asset discovery, file integrity, monitoring of critical assets, vulnerability detection, and SIEM ready to plug and play on the initial setup. A long list of plugins helps to integrate SIEM with a variety of products. Also, it is quite easy to develop new plugins and modify the existing plugins. Being an MSSP enables each analyst to handle multiple incidents in a short span of time as the product correlates major information before any need for human intervention.
- Asset Discovery
- Network SPAN monitoring
- Event correlation of out-of-the-box directives and custom directives
- PCI DSS requirements fulfillment and reporting
- Appliance should have APIs so that data can be exported to smart dashboards and reports.
- Limitation of 1000 EPS in All-In-One is very less even for small to medium organizations.
- Email notification should be smarter and customization for better notifications
January 28, 2020
AlienVault USM Review
We use USM to monitor our organization and we deploy it to our customers so we can monitor them with our NSOC.
- It does a great job of correlating the traffic that it sees and compares it to Open Threat Exchange.
- It's easy to read and set-up.
- When looking at events from a destination IP, the USM doesn't show you the total number of these until you find the last page. It just says "XXXX of 4,000,000".
January 27, 2020
AlienVault USM Review
AlienVault is used as a SIEM with ATT managed security services assisting with monitoring and creating alerts for potential incidents.
- Easy to use rules, events will pre-populate fields for alarm rules allowing for quick creation
- Friendly interface with logical layout of settings and options
- Some room to improve the scaling of sensors. Sensors struggle to handle millions or events which results in dropped events in large environments
- USM is upgraded automatically and there is no way to control when your instance is upgraded. This can result in bugs in features without any way to test and control
January 24, 2020
USM Anywhere - Low maintenance, great support and easy to use.
We currently use USM Anywhere inside of our organisation and are planning to sell the service to other companies. Overall it is easy to use and setup, with this ease of use come some limitations to how much you can customize it. If you want an application that requires little to no effort to manage and setup, I recommend USM Anywhere. If you want more control I would advise to go for USM Appliance.
- Ease of use.
- Cloud based.
- Limitations to customisation.
December 31, 2019
AlienVault USM is good overall
My organization is using AlienVault USM as one of the internal security operation solutions. It helps us to perform operations such as vulnerability analysis and threat detection. It also helps us to centralize the log data to be stored in one place, which is AlienVault Secure Cloud, a certified environment.
- Fast and inexpensive.
- Easy to deploy.
- Tedious in customizing rules.
- Filters are hard to use.
November 27, 2019
AlienVault USM Anywhere
Our organization provides multiple security services to clients. These services fall into three broad categories: Offensive consulting services, such as penetration tests and vulnerability assessments; Defensive consulting services, like digital forensics and incident response; and security operations, which consist of continuous network and endpoint security monitoring and threat detection. AlienVault USM is one of the many solutions used to perform security operations for our clients.
- AlienVault USM is simple and easy to deploy. Sensors can be deployed in as little as 15 minutes through the setup wizard.
- The USM UI is easy to understand. I've trained multiple analysts who are able to perform their duties on their first day, in part because of USM Anywhere's ease of use.
- Top-notch built-in compliance templates and reporting features.
- Filtering using built-in search statements is difficult to pick up and run with.
- When creating custom rules for reports, there can be too many options, and often have little use for the task at hand.
- You sometimes need product-specific knowledge, like AlienVault field names, to find the information you're after.
November 14, 2019
AlienVault USM Anywhere Review
We utilize the AlienVault USM Anywhere solution for threat detection in our corporate networks. The new cloud-based panel is great! Very easy to use and configure.
- Easy to Install
- Cloud Alert Console
- Relevancy of Data/Alerting
- Adding additional plugins and applications can be difficult
- Extensive filtering required to streamline event collection
We use AlienVault across the org, with accumulator appliances in two offices and in our cloud infrastructure. These devices are syslog targets and are used to scan traffic in each location. In addition, I also have deployed the AlientVault USM agent script to all servers and user systems. AlienVault sometimes notifies me of problems within integrated systems such as Sophos before that service itself. Notifications as simple as an improperly configured SSH config or something as significant as signs of SPECTRE traffic are delivered to my inbox so I may deal with these alerts ASAP.
- Alienvault USM is THOROUGH. We have a highly integrated workspace that's most SAAS, and I monitor those integrations and their security with AV. If I am trying to track the uptime of a laptop, I don't go to VPN or our Directory Services... I go to AV.
- As I mentioned before, we use Sophos to protect our laptops. If a questionable file shows up on someones laptop, I hear about it from AlienVault before I hear about it from our Sophos service.
- The OTX Pulse feature is a built-in feature that lets you subscribe to industries and you are notified about new threats that affect that industry on a daily basis. The pulse alerts are added to your AV watchlist.
- Personally, I've wished I could purchase a service that would configure AV for my environment. I get a lot of traffic on a daily basis and I almost need to hire an analyst that just works on AV.
- Some of the filters when looking for a specific alert aren't that easy to use.
October 29, 2019
AlienVault. Your SIEM solution from another world.
AlienVault is used to monitor and assess corporate resources to help maintain system integrity and PCI compliance. We use it to monitor critical system files and resources and to help analyze multiple event logs in a single user easy to manage interface. It gives our administrators the ability to set up alerts so that we are notified of potential security vulnerabilities.
- PCI compliance scanning: AlienVault USM gives you the ability to scan assets using different variations of PCI policies.
- Event log management: AlienVault USM allows you to easily collect and search event log data across multiple systems of different variations.
- The event log filter rules are another strong feature of AlienVault USM. It allows for easy filtering of non-essential data.
- I would like to have the ability to restore a deleted sensor. I ran into an issue where a sensor was deleted and we had to rebuild our setup.
- A nice feature to have would be the ability to create read-only users with a custom view built for them.
- When a vulnerability is found, you are directed to an external site for (OTX and others) more information. Suggested fixes and patches should work directly in the USM interface.
October 29, 2019
AlienVault working reliably to protect your office network.
AlienVault is used to monitor traffic in our offices and the VPN for suspicious activity. Additionally, deployed agents monitor event-logs and several streams from our Syslog to ensure we can see any bad-auths. AlienVault helps to identify bad traffic, suspicious user behavior and outdated software on those hosts with the agent deployed.
- Through the open threat exchange, I get the latest indicators of bad actors and can, on the other hand, add my own indicators if I feel something is missing.
- Filter-/Alarm-rules are easy to set up, so I can distinguish the important bits from noise in the logs
- Deploying the agents is very easy through the provided PowerShell scripts.
- Setting up a working stream of the windows-event-log (not using local agents) seems impossible, and AlienVault's support wasn't very helpful in this matter. We finally decided to drop this (it ran for a while, then stopped for no apparent reason, seemingly a problem with certificates) and use local agents instead.
- Sometimes agents don't update themselves, and it's hard to diagnose what causes this.
- Also, the updater of the sensor-appliances doesn't seem to run very reliably. From time to time I have to re-install the sensor-appliance, as it doesn't want to update itself.
October 25, 2019
Get it!!
It is used by the Security Team in IT Department for log collection and correlation. Currently we feed logs from all our security devices including on-cloud, cloudtrail, cloudwatch, s3 access and Load balancer event logs, we've also incorporated other external vendor sources e.g end point protection, web content filtering logs using proxies.
- great search and filtering capabilities
- Alarm filtering capabilities
- Easy deployment
- Multiple plugins
- For SaaS deployments, it would be nice to give customers the capability to create custom plugins
October 25, 2019
Good for startups
We use alienvault as our SIEM, by collecting all events coming from the physical network and the cloud one, allowing us to overview everything (from a server, a firewall down to an endpoint).
It is primarily used by the security team.
It is primarily used by the security team.
- integration with the cloud providers
- ability to manage big log files
- threat intelligence
- support is not so great
- plugins are not always up to date
October 16, 2019
AlienVault USM Anywhere for PCI-DSS Compliance! - Try it out
AlienVault USM is being used as a SIEM solution in our organization for internal use within the company. It's helping us to easily identify security incidents happening across our infrastructure and helps us comply with PCI-DSS compliance requirements.
- Easy and straightforward implementation.
- Comprehensive logging solution with good notifications.
- Easy tuning, based on received events/alarms.
- Customization/creation of plugins
- Custom parsing of specific fields of the raw message
- Customization of FIM folders/files
October 14, 2019
Not very customizable but provides a lot of value for less.
We use it to monitor security logs across our various SaaS apps. It is the central hub for our security incident program. It is primarily being used by our Information Security Department. This tool addresses our need to be able to make actionable decisions, across various SaaS platforms, from a single pane of glass.
- Correlate logs from different sources into actionable intelligence.
- Provide an easy to use interface to interact with Alarms and Events.
- Integrate with our alerting tools to make sure when an incident is happening, the right people know about it quickly.
- Being able to make custom plugins for internal tools.
- Being able to have a webhook plugin to send logs directly to the cloud appliance.
- Make the management of suppression rules better. Maybe include a suppression rule visualizer to make sure your suppression rule is doing exactly what you would like it to do.
September 12, 2019
AlienVault is easy to deploy and manage
I am working for an MSSP as a managed SOC for my clients. AlienVault USM is addressing all security events of my customers.
- Main strength is the OTX community and all the IOC provided through this.
- Transparent upgrades of the product.
- Plugins and parser creation and updates handled by AlienVault so there's no need to develop our own parsers.
- NIDS and vulnerabilities scanner already included in the license with no additional cost.
- Many correlation rules (maybe too many) and we don't know what the real coverage of the risks is.
- Any ability to customize log parsers.
- Investigation system not really easy to use.
- No backups available so if I want to change the SIEM or have a problem with my licensing, I lose everything.
September 11, 2019
Augmenting Security Effectiveness with a SIEM Automation Platform
I have implemented USM Anywhere as our company SIEM. Additionally, I as working to extend it's functionality with Gartner's SOAR principles. The primary business drivers (problems) include controlling costs, mitigation of risk, and supporting agile business initiatives. It is utilitzed by the security team to monitor all business information systems.
- Deployment is quick
- Normalization of log data and threat identification is effective and simple to understand.
- Vulnerability analysis along with CVE identification is better than Nessus
- Investigations feature is robust
- Cloud sensor depoyment and capabilities is robust
- Custom Plugin creation/modification by the user is missing. If log data is unknown to the platform, the processing of getting a new plugin developed is lengthy. It would be ideal if the user could create custom plugins for their own platform.
- Asset discovery adds every IP address in a subnet even if no host is present. The detection method is flawed. I don't have this issue on the same network with other asset discovery tools.
- SaaS performance can be slow. When listing items more than 20 at a time, the UI refresh can be painfully slow.
September 10, 2019
AlienVault USM is a proactive solution to threat monitoring.
AlienVault USM is used as our SIEM to monitor the network for potential threats. We use AlienVault USM to mitigate risk and respond to potential threats.
- The setup of plugins and sensors is not difficult.
- Response from customer service is fairly fast.
- Automatic updates to sensors are nice.
- The SIEM and search queries are nice.
- The vulnerability scans would be better if there was a way to exclude services instead of ports.
- Sometimes when reading the alarms, it's hard to determine which event took place first by the way the alarms are ordered.