Skip to main content
AlienVault USM

AlienVault USM


What is AlienVault USM?

AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as…

Read more
Recent Reviews

MSSP Review

8 out of 10
October 04, 2021
AlienVault offers a different experience as opposed to other SIEM tools where it can be set up and configured properly in a shorter amount …
Continue reading
Read all reviews


Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards

Popular Features

View all 7 features
  • Centralized event and log data collection (8)
  • Correlation (8)
  • Event and log normalization/management (10)
  • Custom dashboards and workspaces (10)

Reviewer Pros & Cons

View all pros & cons

Video Reviews

Leaving a video review helps other professionals like you evaluate products. Be the first one in your network to record a review of AlienVault USM, and make your voice heard!

Return to navigation


View all pricing



per month



per month



per month

Entry-level set up fee?

  • Setup fee optional
For the latest information on pricing, visit…


  • Free Trial
  • Free/Freemium Version
  • Premium Consulting / Integration Services
Return to navigation


Security Information and Event Management (SIEM)

Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools

Avg 7.8
Return to navigation

Product Details

What is AlienVault USM?

AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as well as continuous threat intelligence updates. The vendor states that even for resource-limited IT security teams, AlienVault USM can be affordable, fast to deploy, and easy to use. It eliminates the need to deploy, integrate, and maintain multiple point solutions in the data center.

Smart, automated data collection & analysis: USM Anywhere automatically collects and analyzes data across the attack surface, helping to quickly gain centralized security visibility without the complexity of multiple disparate security technologies.

Automated threat detection powered by AT&T Alien Labs: With threat intelligence provided by AT&T Alien Labs, USM Anywhere is updated automatically to stay on top of evolving and emerging threats, so the security team can focus on responding to alerts.

Incident response orchestration with AlienApps: USM Anywhere supports a growing ecosystem of AlienApps, enabling the user to orchestrate and automate actions towards other security technologies, able to respond to incidents quickly and easily.

AlienVault USM Features

Security Information and Event Management (SIEM) Features

  • Supported: Centralized event and log data collection
  • Supported: Correlation
  • Supported: Event and log normalization/management
  • Supported: Deployment flexibility
  • Supported: Integration with Identity and Access Management Tools
  • Supported: Custom dashboards and workspaces
  • Supported: Host and network-based intrusion detection

Additional Features

  • Supported: AlienVault Open Threat Exchange

AlienVault USM Screenshots

Screenshot of USM Anywhere NIDS Dashboard

AlienVault USM Videos

AlienVault USM Competitors

AlienVault USM Technical Details

Deployment TypesSoftware as a Service (SaaS), Cloud, or Web-Based
Operating SystemsUnspecified
Mobile ApplicationNo
Supported CountriesGlobal

Frequently Asked Questions

Splunk Cloud and Fortinet on IBM Cloud are common alternatives for AlienVault USM.

Reviewers rate Deployment flexibility highest, with a score of 9.2.

The most common users of AlienVault USM are from Mid-sized Companies (51-1,000 employees).
Return to navigation


View all alternatives
Return to navigation

Reviews and Ratings


Attribute Ratings


(1-25 of 390)
Companies can't remove reviews or game the system. Here's why
October 04, 2021

MSSP Review

Score 8 out of 10
Vetted Review
Verified User
  • Threat intelligence look-ups
  • Asset management
  • Vulnerability scanning
  • Better UI/workflow for alarms
  • Better alarm management (add notes/set status)
Score 7 out of 10
Vetted Review
Verified User
  • UX/UI responsive and easy to navigate.
  • Covers wide variety of systems and devices.
  • Ease of getting sensors up and running.
  • More simplified dashboards would help not overwhelm new users.
  • Use more industry-standard terms for items.
  • Tech support that actually reads your questions prior to replying with canned responses.
  • Update their KBs to reflect real-world scenarios. We've ran across several places where NxLog's settings in the KB were incorrect and support had no idea, kept telling us that we were wrong despite demonstrating to them the correct settings.
Thomas Young | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
  • AlienVault makes following real-time threats very simple with its graphics interface.
  • AlienVault is also easy to work with, and customer support is great.
  • AlienVault works mainly automatically, which makes using it easy. If it required too much effort, the software tool would be replaced.
  • The logs of AlientVault are harder to read through than other logs.
  • Support is good, but not great.
  • Resources for using the product could be made easier to search and understand.
Score 4 out of 10
Vetted Review
Verified User
  • Log collection
  • Users cannot share views across an organization.
  • Views and reports could be more interchangeable.
  • Descriptions of events are based upon each individual asset reporting and not a general grouping of events according to any framework or standards. This makes it difficult for the administrator/user as they would need to know each and every asset and their respective event descriptions.
Score 8 out of 10
Vetted Review
Verified User
  • Deployment is straight forward
  • AlienVault USM forensic and response app is great. You can create rules to shut down, disable networking, etc. automatically if Windows becomes infected.
  • AlienVault allows seamless integration with third-party products like Cisco, Office365 etc.
  • A lot of false-positive alarms
Score 8 out of 10
Vetted Review
Verified User
  • Extremely customizable and versatile product.
  • Useful dashboard and UI is easy to navigate.
  • Log plugins parse logs from a variety of sources into a readable format
  • AlienApps provide out-of-the-box integration with other solutions.
  • The product requires a considerable amount of time to set up.
  • Setting up log filters in order to prevent USM from quickly running out of space is very time-consuming.
  • The product will stop working if the logs run out of space. There is no way to set retention rules to automatically clean up old logs.
Score 8 out of 10
Vetted Review
Verified User
  • Identifies possible spurious identify (Windows AD) changes and manipulation.
  • Identifies installation of possible malware.
  • Analyzed all activities and filters for only those with a potential negative security impact.
  • Closing an Investigation does not close the attached alarms.
  • Vulnerability Scanning interfaces/process is complicated to use.
  • Vulnerability Scanning allows far too many assets to be specified at once, resulting in timeouts and ambiguous results.
Score 7 out of 10
Vetted Review
Verified User
  • Consolidation of logs from various sources.
  • Alerting on particular activities.
  • Alerting on anomalous activities.
  • Time consuming implementation that requires professional services.
  • Pricing model based on the amount of data can be expensive.
  • Training for the product is available, but at additional expense.
Score 9 out of 10
Vetted Review
  • Ease of deployment and quick to get operating.
  • Wide range of plugins and log receivers to ingest logs from many sources.
  • Simple interface and dashboard makes daily operation quick and easy.
  • Custom notification templates can be limited - it is not easy to get custom email alert content for example.
  • Some network configuration on premise is needed to take full advantage of NIDS (port/traffic mirroring for example).
  • Vulnerability scanning and reporting can be a bit sparse if you are used to the likes of Nessus.
Score 9 out of 10
Vetted Review
Verified User
  • Log Correlation: The engineers at Alienvault/AT&T Cybersecurity have included a great integrated rule set (which continues to grow) to save analysts time on combing through logs and instead executing threat hunts, investigations, and remedial activities.
  • Single pane-of-glass for all security activities from the convenience and efficiency of a SaaS web console, being that USM has deep integrations with over a dozen major software platforms (Office 365, GSuite, ZScaler, Box, etc.) and what they call plugins which interpret log and SIEM data from hundreds of vendors and platforms like Meraki, CrowdStrike, Aruba switches and AP's, etc.
  • Great value! You can pay the same or more for other big name SIEM vendors that offer less features than this platform. Plus, even if you begin ingesting too much log data, you can filter specifics types of logs (for example, ones that have no impact to security) to bring data ingestion in line with your subscription level. The onboarding team did a great job in right-sizing our subscription plan, so this hasn't been a problem.
  • Vulnerability scanning is currently done by authentication into the host over the network, even when the AlienVault USM agent is installed on an endpoint. It would be nice to have near-real-time vulnerability information provided via the agents. This would also delete the need for specially-configured remote-access admin service accounts on endpoints, which is just another account that has to be administered, namely password management and auditing for potential abuse and compromise.
  • Endpoint agent support for ARM architecture is just starting to get going -- wide availability across Linux and MS Windows/Server platforms won't be available until possibly circa mid-2021. Fortunately, at least general asset scan info, authenticated vulnerability scans, etc. still provide a good deal of security inspection into these devices.
  • Making some UI settings persist across logins on the web console is still lacking. Would also be nice to change a "detailed view" to icons/thumbnails/tiles. UI is very efficient in some aspects but frustrating in others.
Score 10 out of 10
Vetted Review
  • The system is intuitive and easy to navigate.
  • Integration with key services like AWS and other cloud applications is crucial.
  • Links to MITRE, root cause, and remediation recommendations is also a very nice feature.
  • Difficult to configure for initial set up.
  • Key features like alarms for brute force attacks or malware should be automatic instead of needing to be created and configured.
  • Remediation should be taken one step further past recommendations to actual solutions able to be purchased or assisted by AlienVault.
Angel Meza | TrustRadius Reviewer
Score 7 out of 10
Vetted Review
Verified User
  • Great documentation.
  • Overall good support.
  • Nice UI.
  • UI can be wonky at times.
  • Log search from the SIEM UI is quite troublesome as every filter applied performs the search again.
  • Some features can stop working seemingly out of nowhere, requiring contacting support.
Arther Magaya | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
  • Authenticated vulnerability assessment
  • Authenticated asset discovery
  • Incident response
  • Log correlation
  • Ability to do an external vulnerability assessment.
  • User training awareness through the console for administrators to educate users.
  • Allow more remediation options for administrators to endusers.
Return to navigation