Skip to main content
TrustRadius
AlienVault USM

AlienVault USM

Overview

What is AlienVault USM?

AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as…

Read more
Recent Reviews

TrustRadius Insights

Users have found AlienVault USM to be a valuable SIEM solution for centralizing and searching log data from a large number of network …
Continue reading

MSSP Review

8 out of 10
October 04, 2021
AlienVault offers a different experience as opposed to other SIEM tools where it can be set up and configured properly in a shorter amount …
Continue reading
Read all reviews

Awards

Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards

Popular Features

View all 7 features
  • Centralized event and log data collection (8)
    8.5
    85%
  • Correlation (8)
    8.5
    85%
  • Event and log normalization/management (8)
    8.0
    80%
  • Custom dashboards and workspaces (8)
    7.0
    70%

Reviewer Pros & Cons

View all pros & cons
Return to navigation

Pricing

View all pricing

Essentials

$1,075

Cloud
per month

Standard

$1,695

Cloud
per month

Premium

$2,595

Cloud
per month

Entry-level set up fee?

  • Setup fee optional
For the latest information on pricing, visithttps://www.alienvault.com/products/pri…

Offerings

  • Free Trial
  • Free/Freemium Version
  • Premium Consulting/Integration Services
Return to navigation

Features

Security Information and Event Management (SIEM)

Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools

8
Avg 7.8
Return to navigation

Product Details

What is AlienVault USM?

AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as well as continuous threat intelligence updates. The vendor states that even for resource-limited IT security teams, AlienVault USM can be affordable, fast to deploy, and easy to use. It eliminates the need to deploy, integrate, and maintain multiple point solutions in the data center.

Smart, automated data collection & analysis: USM Anywhere automatically collects and analyzes data across the attack surface, helping to quickly gain centralized security visibility without the complexity of multiple disparate security technologies.

Automated threat detection powered by AT&T Alien Labs: With threat intelligence provided by AT&T Alien Labs, USM Anywhere is updated automatically to stay on top of evolving and emerging threats, so the security team can focus on responding to alerts.

Incident response orchestration with AlienApps: USM Anywhere supports a growing ecosystem of AlienApps, enabling the user to orchestrate and automate actions towards other security technologies, able to respond to incidents quickly and easily.

AlienVault USM Features

Security Information and Event Management (SIEM) Features

  • Supported: Centralized event and log data collection
  • Supported: Correlation
  • Supported: Event and log normalization/management
  • Supported: Deployment flexibility
  • Supported: Integration with Identity and Access Management Tools
  • Supported: Custom dashboards and workspaces
  • Supported: Host and network-based intrusion detection

Additional Features

  • Supported: AlienVault Open Threat Exchange

AlienVault USM Screenshots

Screenshot of USM Anywhere NIDS Dashboard

AlienVault USM Videos

AlienVault USM Competitors

AlienVault USM Technical Details

Deployment TypesSoftware as a Service (SaaS), Cloud, or Web-Based
Operating SystemsUnspecified
Mobile ApplicationNo
Supported CountriesGlobal

Frequently Asked Questions

Splunk Cloud and Fortinet on IBM Cloud are common alternatives for AlienVault USM.

Reviewers rate Deployment flexibility highest, with a score of 8.6.

The most common users of AlienVault USM are from Mid-sized Companies (51-1,000 employees).
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews and Ratings

(735)

Community Insights

TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!

Users have found AlienVault USM to be a valuable SIEM solution for centralizing and searching log data from a large number of network attached devices. This platform is being used for various use cases such as vulnerability management, scanning, malware detection, and monitoring malicious network traffic. It is considered a good SIEM solution for organizations new to security operational logging or those with a smaller staff and budget. The product has been praised for its integrated feature sets, including HIDS, NIDS, FIM, and security alerting capabilities. The inclusion of features like vulnerability scanning and file integrity monitoring has extended its value for organizations in the early stages of cybersecurity program development. Many users have experienced real-time alerts, enabling them to respond to security incidents and compromised passwords more quickly. Furthermore, AlienVault is used for a range of functions such as SIEM, vulnerability scanning, asset discovery, and investigations. It provides organizations with a centralized log collection site, allowing them to monitor and address new problems more effectively. The platform has been effective in helping organizations meet regulatory compliance requirements and improve SOC operations. Additionally, AlienVault is used to analyze network traffic, Windows Event Logs, and other security events, helping organizations improve network security and protect their customers. It solves security challenges related to device and software visibility, monitoring for anomalous events, and ensuring patch management. Users appreciate the simplicity of deployment and the robustness of the interface. The support team is highly responsive and knowledgeable.

AlienVault USM Anywhere is used by organizations to easily identify security incidents happening across their infrastructure and comply with PCI-DSS compliance requirements. MSSPs utilize AlienVault USM Anywhere to provide their customers with best-in-class threat monitoring and response services. It is also used to monitor cloud environments, scanning and alerting for any known vulnerabilities or activity on servers. AlienVault helps organizations with auditing purposes by monitoring cloud permissions and changes to security. Additionally, it is deployed to customers for monitoring and is used by NSOCs to monitor their networks. AlienVault has been implemented across organizations, covering server assets and providing granular logging on systems and networks. It helps in raising alarms/alerts and mitigating network-related activities. AlienVault collects and alerts on network and system activity across the entire organization, making it easy to filter for important data. The product centralizes log data and helps perform vulnerability analysis and threat detection. It assists in security patching and monitoring within AWS environments. Users appreciate the ease of use and configuration of the cloud-based panel. AlienVault is implemented and managed for clients as a recommended SIEM solution, collecting and normalizing logs from various data sources. It is used throughout organizations to gain insight into network and server events, manage and correlate logs, and recognize anomalous activity. Users have been able to set up alerts for specific events and policies, effectively managing systems and alerts in place, monitoring multiple client environments, and identifying issues that clients may have missed.

AlienVault USM Anywhere is praised for its cost-effectiveness compared to other SIEM solutions on the market. Users appreciate its threat intelligence capabilities, ease of use, user-friendly interface, and simplicity of deployment. The built-in correlation rules require minimal setup and provide high-quality results. Asset management and scanning features help users stay on top of monitoring assets, including dynamic and static asset lists. The integration of OTX into USM Anywhere allows for up-to-date threat intelligence and pulse subscriptions.

The software plays a crucial role in monitoring and alerting when anomalies occur, aiding in threat detection, compliance management, log collection, and vulnerability scanning. It helps organizations stay up to speed on new vulnerabilities and supports agile business initiatives by aiding analysts in identifying cyber threats and providing access to threat cross-referencing data. AlienVault USM Anywhere is deployed to monitor AWS cloud environments, attain compliance, identify threats, and facilitate auditing of non-emergency configuration changes and vulnerability monitoring.

Overall, AlienVault USM Anywhere provides centralized security monitoring, incident response capabilities, compliance reporting features, vulnerability assessment tools, real-time SIEM functionality, as well as asset discovery and user activity monitoring capabilities. It has been widely adopted across various industries for enhancing security posture and gaining comprehensive visibility into network activities.

Based on user recommendations, AlienVault USM receives the following common recommendations:

  1. AlienVault USM is recommended for cost-conscious companies and small to medium businesses due to its affordability and effectiveness. Users find it to be a great tool for analyzing and reacting to threats, offering excellent value for the price.

  2. Users suggest exploring alternative SIEM choices and discussing functionality and configuration requirements. Logrhythm is mentioned as a possible alternate SIEM choice, especially for high-end functionality needs. It is advised to compare features and select the SIEM system that offers the best cost for desired features.

  3. To maximize the experience with AlienVault USM, users recommend taking advantage of training opportunities provided by AlienVault. Joining official training sessions allows users to learn best practices from other users and gain comprehensive knowledge of the product. Users also recommend utilizing forums, support, webinars, and videos offered by AlienVault to enhance understanding and achieve optimal results.

Overall, AlienVault USM is regarded as a cost-effective solution suitable for organizations with data privacy and security priorities. The product's flexibility, community-created intelligence, and continual improvement are also highlighted by users. While some mention areas for improvement, such as support stability and module quality, the general consensus is that AlienVault USM delivers reliable security enhancements and cost savings.

Attribute Ratings

Reviews

(1-2 of 2)
Companies can't remove reviews or game the system. Here's why
Score 9 out of 10
Vetted Review
Verified User
Incentivized
It'a very good product to manage and monitor the network. It's very powerful; it has to be well configured.
The support is available to help if needed!
It helps to better understand what happens on the network as well.

  • Monitoring: The possibility to monitor all devices of your network with SNMP management
  • Vulnerability scan: Very simple and powerfull feature. It scans your network and gives you all device vulnerabilities on your LAN.
  • Nagios module: Integrated Tools in AlienVault Unified Security Management Platform. Very useful to have all theses tools in one place.
  • False positive: there are still too much false positives detected when we use the alarm module. A lot of packets are caught in severity medium or high but are not threats. It is just standard traffic.
AlienVault Unified Security Management is well suited in a complex LAN infrastructure.
AlienVault Unified Security Management is less appropriate in a small network.
It unifies a lot of network tools in one product including Nagios.
2
System and network administrator and a system and network manager.
We are using the product to supervise the network.
Every time we have needs on the product we have to call the support [team].
  • Security threats
  • Log tracks
  • Alerts
  • To generate attack list before the weekly security meeting
  • Alert every time there is a change in AD or in the firewall
It is complicated and time consuming to configure and use.
No
  • Price
  • Product Features
  • Product Reputation
No change.
  • Implemented in-house
Yes
installation
configuration
quick training
Change management was minimal
  • Configuration on our infrastructure
Our in house technician didn't finish configuring AlienVault.
  • Online training
  • Self-taught
It is a good training, but 1 day is definitely not enough to be able to use the product. 5 days training is from my point of view the minimum to get the minimum knowledge.
According to me, minimum training is inevitable.
I don't think that the product's configurability is too limited or too extensive but for sure it's complex. There is no way to configure it without a proper training.
If there is more than one person using AlienVault in the company I would recommend writing "best practices" documentation to do things the same way.
No - we have not done any customization to the interface
No - we have not done any custom code
I haven't really done any customisation so far. But I certainly will.
Good support
Yes
the support told me that it should be resolved in a future update. Not done yet...
  • List the past attacks
  • Sending an email with understandable details of the event every time it happend
It can be easy to use but it depends what you want to do.
The product's overall scalability seems very good. With this kind of tool, the potential is nearly infinite.

AlienVault Unified Security Management is definitely available when I need it. The only problem is the glitch with the vulnerability scan that works only once and then you need to restart the appliance to run a second time. It's not really handy when you want to scan your network. The support team said that it should be fixed in a future version.
AlienVault Unified Security Management's overall performance is good.
Reports complete in a reasonable time frame.
AlienVault Unified Security Management integrates with any other software or systems, and does not tend to slow them down.
  • Active directory
  • Firewall
  • Switch
All logs are routed to AlienVault.
  • SNMP traps of all network devices
Yes
  • Single Signon
It is very complicated to configure
Do the training before you use it.
They answer all questions
Price
Yes
It went smoothly and with minimal down time.
There were no unexpected impacts.
  • fix glitches
  • fix the glitches still not fixed.
No
No
Score 7 out of 10
Vetted Review
Verified User
Incentivized
We are currently using AlienVault Unified Security Management for our infrastructure security needs. Both our servers are end users and are being scanned with the OpenVAS integrated scanner. All traffic is being analyzed from our Palo Alto firewalls and all servers have the FIM agent installed. We are also using the system to store net flow data.
  • Traffic Analysis
  • OTX feed intelligence
  • File Integrity Monitoring
  • Threat Scanning
  • Asset Management depends too much on DNS
  • Threat scanner could have more functionality
For small and medium sized businesses the AlienVault Unified Security Management SIEM can be a great fit. Installation and configuration was on par or easier as with other more expensive systems. Larger organizations with additional infosecurity staff might find the system's lack of customization a bit of a hinderance. Overall the product is sound and has made great strides in the 5.x version.
The AlienVault Unified Security Management is much more affordable than the above mentioned products. Installation and configuration is simplistic and provides much of the same dashboards and raw log viewing. The AlienVault USM does not include extra parts such as specific database connectors or the "events per second" as the bigger products, but sometimes that isn't needed.
2
The infosecurity team utilizing the AlienVault USM system.
2
We have not yet developed the proper logging and alerting protocols to support a "NOC" operation. Our company is working on maturing the product with additional logging sources and enhanced intelligence triggers.
  • Log Analysis
  • File Integrity Management
  • Threat Scanning
  • Alerting on large file transfers from net flow
  • Asset Management
  • Enhanced Threat Management
As our company grows we need additional features such as an API, integration with an ELK stack and pivot tables. Unfortunately those are not the strongest points of AlienVault.
Not Sure
  • Price
  • Product Features
  • Positive Sales Experience with the Vendor
The ease of setup and price were the two biggest factors in purchase. During our selection process the AlienVault sales team was very responsive to our questions. The sales team also involved the tech support folks to help troubleshoot an issue we had with agentless FIM and linux systems to help finalize our purchase. The dashboard was easy for all team members to understand and automated reporting helps keep an eye on what is going on in the environment.
At the time the AlienVault system was the right choice as it provides an easy transition to an SIEM product without the high prices and complicated setup. During our decision process no other vendor provided us with actual techsupport during the POC process. I would not change my decision from a year ago. The newest version of AlienVault 5.x has vastly improved the capabilities of the SIEM with speed and usability improvements.
  • Implemented in-house
Yes
We had also purchased a few remote sensors with the AlienVault USM product. Our first phase was the USM with basic log analysis with raw data retention. The second phase was setting up the asset management correctly. The third phase was setting up network scanning with the primary threat scanner. The fourth phase was setting up FIM (File Integrity Monitoring). The fifth and final phase was on boarding the remote sensors for remote FIM (File Integrity Monitoring) and scanning for additional VLANs.
  • File Integrity Monitoring -- Agent Rollout
  • Disk IO during logger rollout
I would plan on the initial setup taking longer than expected. File Integrity Monitoring does not have an automated way of rolling agents out with known keys. This does not work well with the asset management portion of AlienVault as systems will have an unknown state if a key does not get generated with the agent.
  • Online training
  • In-person training
  • Self-taught
I did not have any experience with "in person" training directly. The free online classes offered for a half a day are based on the actual training offered. These little teasers are very good and well worth your time to learn a few quick and dirty ways of getting more information from your SIEM
The online training is based on the in-person training and is well worth your time. The teachers are well informed and can answer many advanced questions without needing to "get back" to you after the class. This approach is very well received and everyone is very engaged during the training and seem generally excited to be learning the AlienVault USM device.
The key to the system is logging sources, enabling the plugins and watching the data flow into the SIEM is quite easy. The asset management setup was easy; just identify your networks and set up a basic asset scan all in a wizard like approach. The other easier setup was an unauthenticated scan of your internal networks, as most of the information provided in the asset scan is used to set up a threat scan.
The AlienVault USM is a network centered SIEM and does not offer many advanced integration points such as API's, sending alerts to other systems or reporting engines. As long as you stay in between the lines the product offers a good amount of configuration items such as reporting, correlation events and dashboard customization.
The best recommendation would be to understand the correlation (called intelligence) menu. Without further customization the AlienVault USM will only have limited functionality for alerts. This really isn't a knock on AlienVault as many of the other SIEM vendors require high touch analysis configuration. Another recommendation would be to understand and properly size your AlienVault USM, without doing so could lead to missed or late arriving events. Sensors can help distribute the load.
No - there is no facility to customize the interface
Yes - we have added extensive custom code
We needed some additional functionality and integration with another security product. This is not a very easy thing to do, as each version of AlienVault USM will require us to push our code back to the box. There is no documented API, which is a shame as integration will get the system a longer shelf life at our business.
We have done some customization via the command line, such as puppet and net flow parsing. This unfortunately means we can not upgrade the system as easily as we would like. This is also true for many of the other SIEM providers, but it would be nice to see the AlienVault USM be more friendly towards customization.
Yes
We pay for the very quick turn around with issues of our AlienVault system. I am very satisfied with the amount of knowledge the support staff have, as they have to be trained in multiple software technologies that make up the entire AlienVault system. The price for premium support is very affordable and is well worth it.
Every time we have opened a ticket with AlienVault they have managed to get us an answer. At times they are not what we want to hear, but I do appreciate the "drive it home" attitude of tech support. I believe the other SIEM competitors could learn a lesson from AlienVault.
No
We currently have an issue with a firewall sending too many "events per second". The tech support person did a lot of research on how to remediate the problem and took it upon himself to escalate the ticket to the developer team. We now have a phone call lined up with a developer so he can better understand the problems we are facing with a single source of too many "events per second".
  • Reviewing Alerts
  • Dashboard graphs
  • File Integrity Monitoring
  • Menu systems
  • Threat menu and scheduling
  • OTX maps
  • Netflow setup
  • Advanced Threat Management
  • Asset Management
  • File Integrity agent setup
  • Correlation Event setup
No
The menus are well laid out for the most common functions of log management, File integrity monitoring and log analysis. The dashboards with graphs are easy to understand and is perfect for the casual glance aka single pane of glass look at your overall security rating. The product looks and feels like many of the other larger SIEM players, but at a much more affordable price. Each version from 3.x to 5.x have been a major improvement, which is free if you have paid professional contract in place.
The AlienVault USM is not very scalable. Some scalability can be achieved by installing additional sensors, but this only offers 500eps per sensor and is still overall limited by the installation type of VM or physical. We have also noticed the EPS (events per second) is rated overall and not towards a single source. A single source on a very healthy VMware partition tops out at 2,000eps for us, no matter how we configure it. Maybe this is a problem of the 5.2 release?
We do have issues with maintenance on the AlienVault USM as the disk fills up from time to time with other data sources. Sources for scanning logs and net flow data isn't calculated in regular disk maintenance and can easily fill up our disk if we do not keep an eye on it with some custom Nagios plugins. The system does properly trim logging data from logging sources properly.
With the latest release of AlienVault USM overall performance has not been an issue. We have noticed single source events per second does not scale well with the overall system. 2,000eps on a vmware system with a single source produces delays of up to an hour for us. Pages, reporting and even raw log searches are rather quick though.
  • SocVue software
  • ELK (elastic search, logstash and kibana)
Integration has been very difficult without and official API. We have it mostly working, but are apprehensive on upgrading the system for fear of breaking integration with the products mentioned above.
Our other vendors do support integration with API keys for grafana, elasticsearch, logstash and kibana. AlienVault USM only offers direct database access, or you end up being a detecting and decode the API yourself.
  • File import/export
  • API (e.g. SOAP or REST)
Direct database access is also used to integrate with our ELK (elasticsearch, logstash and kibana) stack. This has not been easy without an API key. We are also using the file import/export to get data from our 3 scan engines into the ELK stack for better correlation with other 3rd party devices.
I believe AlienVault USM is one of the worst systems for integration. For most customers I would imagine this is not an issue, but when you get to be an enterprise level company this could be a major factor in replacing the system. With current configuration management software puppet, ELK and even grafana it is a shame AlienVault couldn't be part of the integrated stack of any of those products.
My overall opinion as of AlienVault USM 5.2 is to not integrate with other products. As long as you stay within the painted lines, the AlienVault USM works quite well for most of our needs. For advanced correlation you might need to look elsewhere or put in additional feature requests to get a real documented API in a future release.
The sales team is top notch and very responsive to all types of requests (including tech support!). AlienVault accepts all types of payments and it was very easy to interface with the accounting team to get the PO paid on time. Our first renewal was just due and it was properly discounted without us bartering down the list price, which is very refreshing. Again it was very easy to renew as we just gave the accounting team the payment info and it was done.
From time to time our AlienVault account representative contacts us with new products and to see how we are doing with the product. He also recommends new training and volunteers his tech support resources if we are stuck with any issues. They respect my time and I feel they have not wasted it with needless phone calls or emails.
Our terms for training and price were met with very little bartering. It is nice to get some online training thrown in with a large purchase of your AlienVault USM it can help the on-boarding with new employees. The overall purchase was discounted fairly and did not require us to spend weeks haggling over price.
We are completely satisfied with the AlienVault sales team. I would just recommend being honest with them with timelines and prices, I am sure they will work with you to make the AlienVault USM happen. At certain times of the year (year end) the discounts could be higher, so it could be worth the wait!
Yes
We have upgraded from version 3.x to 4.x and recently from 5.x. Each one of the major upgrades went without issue and had only 10-15 minutes of downtime. This is much better than most of the other SIEM vendors as it could lead to hours of downtime, unless you have clustered systems. Remote sensors store the logs, while the database is being updated. The database update takes the longest, but is completely "hands off" and as long as you pass the free disk space check, is seamless.
  • Performance
  • Dashboard
  • Log Analysis
  • Documented API
  • Asset management
  • Better plugin correlation support
Yes
during our POC we started off with the "free" version of AlienVault USM. For the first month we stayed with the free version to better understand the limitations and features of the product. The paid version is well worth the money for the speed improvements and phone tech support. The technicians can save you many hours of time, their troubleshooting skills are top notch.
No
Return to navigation