AlienVault USM: Simplifying Security with Cost-Effective Threat Detection.
Our organization uses AlienVault USM to enhance the security posture and streamline our clients' threat detection and response. The …
Starting at $1,075 per month
View PricingOverview
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as…
Recent Reviews
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Centralized event and log data collection (8)8.585%
- Correlation (8)8.585%
- Event and log normalization/management (8)8.080%
- Custom dashboards and workspaces (8)7.070%
Reviewer Pros & Cons
Pricing
Essentials
$1,075
Cloud
per month
Standard
$1,695
Cloud
per month
Premium
$2,595
Cloud
per month
Entry-level set up fee?
- Setup fee optional
For the latest information on pricing, visithttps://www.alienvault.com/products/pri…
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Features
Return to navigation
Product Details
- About
- Competitors
- Tech Details
- Downloadables
- FAQs
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as well as continuous threat intelligence updates. The vendor states that even for resource-limited IT security teams, AlienVault USM can be affordable, fast to deploy, and easy to use. It eliminates the need to deploy, integrate, and maintain multiple point solutions in the data center.
Smart, automated data collection & analysis: USM Anywhere automatically collects and analyzes data across the attack surface, helping to quickly gain centralized security visibility without the complexity of multiple disparate security technologies.
Automated threat detection powered by AT&T Alien Labs: With threat intelligence provided by AT&T Alien Labs, USM Anywhere is updated automatically to stay on top of evolving and emerging threats, so the security team can focus on responding to alerts.
Incident response orchestration with AlienApps: USM Anywhere supports a growing ecosystem of AlienApps, enabling the user to orchestrate and automate actions towards other security technologies, able to respond to incidents quickly and easily.
AlienVault USM Features
Security Information and Event Management (SIEM) Features
- Supported: Centralized event and log data collection
- Supported: Correlation
- Supported: Event and log normalization/management
- Supported: Deployment flexibility
- Supported: Integration with Identity and Access Management Tools
- Supported: Custom dashboards and workspaces
- Supported: Host and network-based intrusion detection
Additional Features
- Supported: AlienVault Open Threat Exchange
AlienVault USM Screenshots
AlienVault USM Videos
AlienVault USM Competitors
AlienVault USM Technical Details
| Deployment Types | Software as a Service (SaaS), Cloud, or Web-Based |
|---|---|
| Operating Systems | Unspecified |
| Mobile Application | No |
| Supported Countries | Global |
AlienVault USM Downloadables
- Unified Security Management vs. SIEM: a Technical Comparison
- AlienVault USM Anywhere: Datasheet
- AlienVault Fast Facts
- AlienVault USM Anywhere: Datasheet
- Beginner’s Guide to Open Source Intrusion Detection Tools
- SIEM for Beginners: Everything You Wanted to Know About Log Management But Were Afraid to Ask
Frequently Asked Questions
Splunk Cloud and Fortinet on IBM Cloud are common alternatives for AlienVault USM.
Reviewers rate Deployment flexibility highest, with a score of 8.6.
The most common users of AlienVault USM are from Mid-sized Companies (51-1,000 employees).
Comparisons
Compare with
Reviews and Ratings
(735)
Community Insights
TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!
- Business Problems Solved
- Recommendations
Users have found AlienVault USM to be a valuable SIEM solution for centralizing and searching log data from a large number of network attached devices. This platform is being used for various use cases such as vulnerability management, scanning, malware detection, and monitoring malicious network traffic. It is considered a good SIEM solution for organizations new to security operational logging or those with a smaller staff and budget. The product has been praised for its integrated feature sets, including HIDS, NIDS, FIM, and security alerting capabilities. The inclusion of features like vulnerability scanning and file integrity monitoring has extended its value for organizations in the early stages of cybersecurity program development. Many users have experienced real-time alerts, enabling them to respond to security incidents and compromised passwords more quickly. Furthermore, AlienVault is used for a range of functions such as SIEM, vulnerability scanning, asset discovery, and investigations. It provides organizations with a centralized log collection site, allowing them to monitor and address new problems more effectively. The platform has been effective in helping organizations meet regulatory compliance requirements and improve SOC operations. Additionally, AlienVault is used to analyze network traffic, Windows Event Logs, and other security events, helping organizations improve network security and protect their customers. It solves security challenges related to device and software visibility, monitoring for anomalous events, and ensuring patch management. Users appreciate the simplicity of deployment and the robustness of the interface. The support team is highly responsive and knowledgeable.
AlienVault USM Anywhere is used by organizations to easily identify security incidents happening across their infrastructure and comply with PCI-DSS compliance requirements. MSSPs utilize AlienVault USM Anywhere to provide their customers with best-in-class threat monitoring and response services. It is also used to monitor cloud environments, scanning and alerting for any known vulnerabilities or activity on servers. AlienVault helps organizations with auditing purposes by monitoring cloud permissions and changes to security. Additionally, it is deployed to customers for monitoring and is used by NSOCs to monitor their networks. AlienVault has been implemented across organizations, covering server assets and providing granular logging on systems and networks. It helps in raising alarms/alerts and mitigating network-related activities. AlienVault collects and alerts on network and system activity across the entire organization, making it easy to filter for important data. The product centralizes log data and helps perform vulnerability analysis and threat detection. It assists in security patching and monitoring within AWS environments. Users appreciate the ease of use and configuration of the cloud-based panel. AlienVault is implemented and managed for clients as a recommended SIEM solution, collecting and normalizing logs from various data sources. It is used throughout organizations to gain insight into network and server events, manage and correlate logs, and recognize anomalous activity. Users have been able to set up alerts for specific events and policies, effectively managing systems and alerts in place, monitoring multiple client environments, and identifying issues that clients may have missed.
AlienVault USM Anywhere is praised for its cost-effectiveness compared to other SIEM solutions on the market. Users appreciate its threat intelligence capabilities, ease of use, user-friendly interface, and simplicity of deployment. The built-in correlation rules require minimal setup and provide high-quality results. Asset management and scanning features help users stay on top of monitoring assets, including dynamic and static asset lists. The integration of OTX into USM Anywhere allows for up-to-date threat intelligence and pulse subscriptions.
The software plays a crucial role in monitoring and alerting when anomalies occur, aiding in threat detection, compliance management, log collection, and vulnerability scanning. It helps organizations stay up to speed on new vulnerabilities and supports agile business initiatives by aiding analysts in identifying cyber threats and providing access to threat cross-referencing data. AlienVault USM Anywhere is deployed to monitor AWS cloud environments, attain compliance, identify threats, and facilitate auditing of non-emergency configuration changes and vulnerability monitoring.
Overall, AlienVault USM Anywhere provides centralized security monitoring, incident response capabilities, compliance reporting features, vulnerability assessment tools, real-time SIEM functionality, as well as asset discovery and user activity monitoring capabilities. It has been widely adopted across various industries for enhancing security posture and gaining comprehensive visibility into network activities.
Based on user recommendations, AlienVault USM receives the following common recommendations:
-
AlienVault USM is recommended for cost-conscious companies and small to medium businesses due to its affordability and effectiveness. Users find it to be a great tool for analyzing and reacting to threats, offering excellent value for the price.
-
Users suggest exploring alternative SIEM choices and discussing functionality and configuration requirements. Logrhythm is mentioned as a possible alternate SIEM choice, especially for high-end functionality needs. It is advised to compare features and select the SIEM system that offers the best cost for desired features.
-
To maximize the experience with AlienVault USM, users recommend taking advantage of training opportunities provided by AlienVault. Joining official training sessions allows users to learn best practices from other users and gain comprehensive knowledge of the product. Users also recommend utilizing forums, support, webinars, and videos offered by AlienVault to enhance understanding and achieve optimal results.
Overall, AlienVault USM is regarded as a cost-effective solution suitable for organizations with data privacy and security priorities. The product's flexibility, community-created intelligence, and continual improvement are also highlighted by users. While some mention areas for improvement, such as support stability and module quality, the general consensus is that AlienVault USM delivers reliable security enhancements and cost savings.
Attribute Ratings
Reviews
(1-25 of 163)Companies can't remove reviews or game the system. Here's why
June 01, 2023
Excellent security for your machine
Score 9 out of 10
Vetted Review
Verified User
It's a very effective security level for industries. We had a security breach sometime back and we opted for AlienVault. It looks like high technology since the multi level security is added. It maintains our logs which helps me as a developer to debug if anything required. Since we use connection in VPN it tracks all the websites we have accessed and blocks it if unnecessary.
- Security
- User operations tracking
- Notifications pop up is annoying
- Little more improvement in UI side
October 04, 2021
MSSP Review
Score 8 out of 10
Vetted Review
Verified User
AlienVault offers a different experience as opposed to other SIEM tools where it can be set up and configured properly in a shorter amount of time. The built-in correlation rules are of great quality with little-to-no setup required to switch on. Asset management and scanning is a great feature to keep on top of the list of assets to monitor, as well as dynamic and static asset lists. OTX is one of the best features to implement directly into USM Anywhere, with up-to-date threat intelligence as well as pulses to subscribe to.
- Threat intelligence look-ups
- Asset management
- Vulnerability scanning
- Better UI/workflow for alarms
- Better alarm management (add notes/set status)
Implemented in a SaaS company with resources in colocation and AWS. All server assets are covered however workstations are not. We like that it provides the opportunity of granular logging on all systems and networks.
- UX/UI responsive and easy to navigate.
- Covers wide variety of systems and devices.
- Ease of getting sensors up and running.
- More simplified dashboards would help not overwhelm new users.
- Use more industry-standard terms for items.
- Tech support that actually reads your questions prior to replying with canned responses.
- Update their KBs to reflect real-world scenarios. We've ran across several places where NxLog's settings in the KB were incorrect and support had no idea, kept telling us that we were wrong despite demonstrating to them the correct settings.
November 11, 2020
AlienVault - Not Worth the Price
AlienVault was purchased to provide the security department with a security operations center overview of the infrastructure of our environment. It is currently only being used as a SIEM for the Security Department for client compliance. This is due to the the lack of resources to manage the day to day management of the tool.
- Log collection
- Users cannot share views across an organization.
- Views and reports could be more interchangeable.
- Descriptions of events are based upon each individual asset reporting and not a general grouping of events according to any framework or standards. This makes it difficult for the administrator/user as they would need to know each and every asset and their respective event descriptions.
August 07, 2020
Unbeatable Security Machine
AlienVault is one of many security solutions that we utilize in our network. We use it to monitor unusual traffic and behavior to and from our domain controllers, which we combine with endpoint security and network security to have a granular view of activity throughout our network.
- Extremely customizable and versatile product.
- Useful dashboard and UI is easy to navigate.
- Log plugins parse logs from a variety of sources into a readable format
- AlienApps provide out-of-the-box integration with other solutions.
- The product requires a considerable amount of time to set up.
- Setting up log filters in order to prevent USM from quickly running out of space is very time-consuming.
- The product will stop working if the logs run out of space. There is no way to set retention rules to automatically clean up old logs.
July 09, 2020
Aliens are coming! or are they?
We use AlienVault to monitor our servers for malware or attacks against our network. It's a little difficult to set up initially but once you get it dialed in, it's great! It helps us monitor all of our systems and ensure that we are protected.
- Easy to understand what is going on with the server.
- Works on firewalls.
- Alerts are easy to set up.
- Support isn't always the best.
- Hard to initially set up.
Alienvault USM Anywhere touches all endpoints and networks of our organization. Is solves some big problems like:
1) Logging aggregation and actionable insights using log correlation.
2) Threat hunting & intel.
3) Vulnerability management and validation of our separate patch automation software.
4) Security orchestration.
5) Asset discovery and inventory management.
1) Logging aggregation and actionable insights using log correlation.
2) Threat hunting & intel.
3) Vulnerability management and validation of our separate patch automation software.
4) Security orchestration.
5) Asset discovery and inventory management.
- Log Correlation: The engineers at Alienvault/AT&T Cybersecurity have included a great integrated rule set (which continues to grow) to save analysts time on combing through logs and instead executing threat hunts, investigations, and remedial activities.
- Single pane-of-glass for all security activities from the convenience and efficiency of a SaaS web console, being that USM has deep integrations with over a dozen major software platforms (Office 365, GSuite, ZScaler, Box, etc.) and what they call plugins which interpret log and SIEM data from hundreds of vendors and platforms like Meraki, CrowdStrike, Aruba switches and AP's, etc.
- Great value! You can pay the same or more for other big name SIEM vendors that offer less features than this platform. Plus, even if you begin ingesting too much log data, you can filter specifics types of logs (for example, ones that have no impact to security) to bring data ingestion in line with your subscription level. The onboarding team did a great job in right-sizing our subscription plan, so this hasn't been a problem.
- Vulnerability scanning is currently done by authentication into the host over the network, even when the AlienVault USM agent is installed on an endpoint. It would be nice to have near-real-time vulnerability information provided via the agents. This would also delete the need for specially-configured remote-access admin service accounts on endpoints, which is just another account that has to be administered, namely password management and auditing for potential abuse and compromise.
- Endpoint agent support for ARM architecture is just starting to get going -- wide availability across Linux and MS Windows/Server platforms won't be available until possibly circa mid-2021. Fortunately, at least general asset scan info, authenticated vulnerability scans, etc. still provide a good deal of security inspection into these devices.
- Making some UI settings persist across logins on the web console is still lacking. Would also be nice to change a "detailed view" to icons/thumbnails/tiles. UI is very efficient in some aspects but frustrating in others.
July 02, 2020
Limited Use Feedback
In my current position, I offer AlienVault USM Anywhere to businesses as a managed security service provider. The problem/solution use case is for multiple unrelated point solutions without centralized orchestration or a managed SIEM system in place.
- The system is intuitive and easy to navigate.
- Integration with key services like AWS and other cloud applications is crucial.
- Links to MITRE, root cause, and remediation recommendations is also a very nice feature.
- Difficult to configure for initial set up.
- Key features like alarms for brute force attacks or malware should be automatic instead of needing to be created and configured.
- Remediation should be taken one step further past recommendations to actual solutions able to be purchased or assisted by AlienVault.
April 27, 2020
Great introduction to SIEMs
We use AlienVault in our organization to monitor the environment of our clients, all the way from reviewing suspicious activity to performing server health-checks and behavior.
- Great documentation.
- Overall good support.
- Nice UI.
- UI can be wonky at times.
- Log search from the SIEM UI is quite troublesome as every filter applied performs the search again.
- Some features can stop working seemingly out of nowhere, requiring contacting support.
April 03, 2020
Built with security professionals in mind.
I have used AlienVault in a controlled lab environment to assess its power in solving the security challenges of an organization. AlienVault provides a clear picture of the events and incidents throughout the network infrastructure and provides us with a way to mitigate any issue.
- Great log aggregation and management tool.
- Great intrusion detection and investigation tool.
- Very easy to set up and get it going in a very few steps.
- AlienVault can look into providing log collection methods other than using a sensor.
- AlienVault USM capabilities should be replicated to AlienVault OSSIM except that with OSSIM there wouldn't be any support.
February 27, 2020
AlienVault USM Review
AlienVault USM is used to monitor multiple client environments. It allows us to identify issues that the clients may not have picked up on.
- Very easy to filter out alarms and events
- Easy to use and understand interface
- You cannot add a label to an alarm from an event page, which can be annoying since clicking on it changes the page to the alarm.
- An extra tab is opened after clicking on an event in an alarm, and it is blank so it's unnecessary.
February 13, 2020
AlienVault does the trick and the documentation is great
AlienVault keeps an eye on our cloud environments and our mobile endpoints company-wide. It ensures compliance standards are met and alerts us to potential security issues easily and effectively.
- Intrusion detection.
- Alarms.
- Some aspects of the UI require some digging.
- Pre-packaged deployable agents for various OS's.
January 29, 2020
Great product with many features
AlienVault is currently used throughout the whole organization and it solves problems around authentication and old user actions. It has helped us identify certain issues or unusual anomalies that happen from day to day to 24 hrs a day. We are able to set up alerts for certain events and the policies we setup help with managing the systems and alerts in place.
- Tracking
- Auditing
- UI layout
- Ease of use
January 28, 2020
AlienVault USM Review
We use USM to monitor our organization and we deploy it to our customers so we can monitor them with our NSOC.
- It does a great job of correlating the traffic that it sees and compares it to Open Threat Exchange.
- It's easy to read and set-up.
- When looking at events from a destination IP, the USM doesn't show you the total number of these until you find the last page. It just says "XXXX of 4,000,000".
January 27, 2020
AlienVault USM Review
AlienVault is used as a SIEM with ATT managed security services assisting with monitoring and creating alerts for potential incidents.
- Easy to use rules, events will pre-populate fields for alarm rules allowing for quick creation
- Friendly interface with logical layout of settings and options
- Some room to improve the scaling of sensors. Sensors struggle to handle millions or events which results in dropped events in large environments
- USM is upgraded automatically and there is no way to control when your instance is upgraded. This can result in bugs in features without any way to test and control
January 27, 2020
AlienVault appliance review
We use AlienVault USM as the SIEM for a large healthcare organization with numerous disparate sites and a small security team. We also employ a SOCaaS to help optimize and monitor for 24x7 operations.
- Lots of ability to generate reports.
- Solid appliances ingest many sources.
- Default settings are a bit esoteric and require outside expertise for optimization.
- AI isn’t really catching as much as I thought it would.
January 24, 2020
USM Anywhere Review
USM anywhere is extensively used by the IT Security Dept to meet the regulatory compliance requirements and as part of SOC operations.
- Co-relation engine helps where we don't have to spend hours writing rules.
- As a SaaS solution we don't worry about maintaining the system.
- OTX integration
- Having more parsers and AlienVault app. Also, updates the log parsers continuously.
- Option to the users to purge selective data.
- Better Reporting & GUI interface.
December 31, 2019
AlienVault USM is good overall
My organization is using AlienVault USM as one of the internal security operation solutions. It helps us to perform operations such as vulnerability analysis and threat detection. It also helps us to centralize the log data to be stored in one place, which is AlienVault Secure Cloud, a certified environment.
- Fast and inexpensive.
- Easy to deploy.
- Tedious in customizing rules.
- Filters are hard to use.
November 27, 2019
AlienVault USM Anywhere
Our organization provides multiple security services to clients. These services fall into three broad categories: Offensive consulting services, such as penetration tests and vulnerability assessments; Defensive consulting services, like digital forensics and incident response; and security operations, which consist of continuous network and endpoint security monitoring and threat detection. AlienVault USM is one of the many solutions used to perform security operations for our clients.
- AlienVault USM is simple and easy to deploy. Sensors can be deployed in as little as 15 minutes through the setup wizard.
- The USM UI is easy to understand. I've trained multiple analysts who are able to perform their duties on their first day, in part because of USM Anywhere's ease of use.
- Top-notch built-in compliance templates and reporting features.
- Filtering using built-in search statements is difficult to pick up and run with.
- When creating custom rules for reports, there can be too many options, and often have little use for the task at hand.
- You sometimes need product-specific knowledge, like AlienVault field names, to find the information you're after.
November 13, 2019
AlienVault USM for Small Business
The business problem it addresses is derived from governance and compliance set by the USG and the DFARS regulations to have a SEIM. I have experience with paid products such as QRADAR and Splunk, and open source products such as Graylog/Elk/Wazah/security_onion. This is a department tool to consume the whole organization's security related data. We currently use it as the SEIM.
- It's a decent log aggregator.
- Does correlation between events well, if set up correctly.
- Control on attribute mapping within USM Anywhere or fully disclose the mappings between ingested raw logs and attributes those values map to, in order to be searchable, and give power to the end user to create meaningful alerts and queries for the right content.
- Notifications for alerts tend to lack the essentials to make a determination off of the email. Often times alerts within cloud products are benign and part of the user experience and behavior, but get classified as violations, because they meet the criteria of equivalent alerts that are actionable.
November 04, 2019
Cost effective and easy to use
It is being used by our Network Operations Center to monitor potential security alerts and suspicious activity. It is also used as an additional investigation tool if users or customers report potentially malicious activity.
- Easy to set up/use
- Cost-effective
- Interface is slow and quirky
- Lacks functionality compared to other products
- Documentation (both troubleshooting and informative) is lacking detail
- Ease of use also has downfalls in that when detailed information is needed it's harder to obtain when investigating/troubleshooting
We use AlienVault across the org, with accumulator appliances in two offices and in our cloud infrastructure. These devices are syslog targets and are used to scan traffic in each location. In addition, I also have deployed the AlientVault USM agent script to all servers and user systems. AlienVault sometimes notifies me of problems within integrated systems such as Sophos before that service itself. Notifications as simple as an improperly configured SSH config or something as significant as signs of SPECTRE traffic are delivered to my inbox so I may deal with these alerts ASAP.
- Alienvault USM is THOROUGH. We have a highly integrated workspace that's most SAAS, and I monitor those integrations and their security with AV. If I am trying to track the uptime of a laptop, I don't go to VPN or our Directory Services... I go to AV.
- As I mentioned before, we use Sophos to protect our laptops. If a questionable file shows up on someones laptop, I hear about it from AlienVault before I hear about it from our Sophos service.
- The OTX Pulse feature is a built-in feature that lets you subscribe to industries and you are notified about new threats that affect that industry on a daily basis. The pulse alerts are added to your AV watchlist.
- Personally, I've wished I could purchase a service that would configure AV for my environment. I get a lot of traffic on a daily basis and I almost need to hire an analyst that just works on AV.
- Some of the filters when looking for a specific alert aren't that easy to use.
October 29, 2019
AlienVault. Your SIEM solution from another world.
AlienVault is used to monitor and assess corporate resources to help maintain system integrity and PCI compliance. We use it to monitor critical system files and resources and to help analyze multiple event logs in a single user easy to manage interface. It gives our administrators the ability to set up alerts so that we are notified of potential security vulnerabilities.
- PCI compliance scanning: AlienVault USM gives you the ability to scan assets using different variations of PCI policies.
- Event log management: AlienVault USM allows you to easily collect and search event log data across multiple systems of different variations.
- The event log filter rules are another strong feature of AlienVault USM. It allows for easy filtering of non-essential data.
- I would like to have the ability to restore a deleted sensor. I ran into an issue where a sensor was deleted and we had to rebuild our setup.
- A nice feature to have would be the ability to create read-only users with a custom view built for them.
- When a vulnerability is found, you are directed to an external site for (OTX and others) more information. Suggested fixes and patches should work directly in the USM interface.
October 29, 2019
AlienVault working reliably to protect your office network.
AlienVault is used to monitor traffic in our offices and the VPN for suspicious activity. Additionally, deployed agents monitor event-logs and several streams from our Syslog to ensure we can see any bad-auths. AlienVault helps to identify bad traffic, suspicious user behavior and outdated software on those hosts with the agent deployed.
- Through the open threat exchange, I get the latest indicators of bad actors and can, on the other hand, add my own indicators if I feel something is missing.
- Filter-/Alarm-rules are easy to set up, so I can distinguish the important bits from noise in the logs
- Deploying the agents is very easy through the provided PowerShell scripts.
- Setting up a working stream of the windows-event-log (not using local agents) seems impossible, and AlienVault's support wasn't very helpful in this matter. We finally decided to drop this (it ran for a while, then stopped for no apparent reason, seemingly a problem with certificates) and use local agents instead.
- Sometimes agents don't update themselves, and it's hard to diagnose what causes this.
- Also, the updater of the sensor-appliances doesn't seem to run very reliably. From time to time I have to re-install the sensor-appliance, as it doesn't want to update itself.
October 25, 2019
My Experience using AlienVault
In our organization we use AlienVault USM for threat detection and to keep up to date with patches needed to cover for known vulnerabilities in our servers.
- Threat Detection
- Scanning for Vulnerabilities in servers
- Event handling
- Integration with other product like Google Suite to create security reports.
- When handling alarms, I'd like to be able to select all the resulting alarms at once after filtering and not by groups of 100 like it's possible now.
- I think filtering could be improved in the Alarms and Events sections.