AlienVault USM: Simplifying Security with Cost-Effective Threat Detection.
Our organization uses AlienVault USM to enhance the security posture and streamline our clients' threat detection and response. The …
Starting at $1,075 per month
View PricingOverview
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as…
Recent Reviews
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Centralized event and log data collection (8)8.585%
- Correlation (8)8.585%
- Event and log normalization/management (8)8.080%
- Custom dashboards and workspaces (8)7.070%
Reviewer Pros & Cons
Pricing
Essentials
$1,075
Cloud
per month
Standard
$1,695
Cloud
per month
Premium
$2,595
Cloud
per month
Entry-level set up fee?
- Setup fee optional
For the latest information on pricing, visithttps://www.alienvault.com/products/pri…
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Features
Return to navigation
Product Details
- About
- Competitors
- Tech Details
- Downloadables
- FAQs
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as well as continuous threat intelligence updates. The vendor states that even for resource-limited IT security teams, AlienVault USM can be affordable, fast to deploy, and easy to use. It eliminates the need to deploy, integrate, and maintain multiple point solutions in the data center.
Smart, automated data collection & analysis: USM Anywhere automatically collects and analyzes data across the attack surface, helping to quickly gain centralized security visibility without the complexity of multiple disparate security technologies.
Automated threat detection powered by AT&T Alien Labs: With threat intelligence provided by AT&T Alien Labs, USM Anywhere is updated automatically to stay on top of evolving and emerging threats, so the security team can focus on responding to alerts.
Incident response orchestration with AlienApps: USM Anywhere supports a growing ecosystem of AlienApps, enabling the user to orchestrate and automate actions towards other security technologies, able to respond to incidents quickly and easily.
AlienVault USM Features
Security Information and Event Management (SIEM) Features
- Supported: Centralized event and log data collection
- Supported: Correlation
- Supported: Event and log normalization/management
- Supported: Deployment flexibility
- Supported: Integration with Identity and Access Management Tools
- Supported: Custom dashboards and workspaces
- Supported: Host and network-based intrusion detection
Additional Features
- Supported: AlienVault Open Threat Exchange
AlienVault USM Screenshots
AlienVault USM Videos
AlienVault USM Competitors
AlienVault USM Technical Details
| Deployment Types | Software as a Service (SaaS), Cloud, or Web-Based |
|---|---|
| Operating Systems | Unspecified |
| Mobile Application | No |
| Supported Countries | Global |
AlienVault USM Downloadables
- Unified Security Management vs. SIEM: a Technical Comparison
- AlienVault USM Anywhere: Datasheet
- AlienVault Fast Facts
- AlienVault USM Anywhere: Datasheet
- Beginner’s Guide to Open Source Intrusion Detection Tools
- SIEM for Beginners: Everything You Wanted to Know About Log Management But Were Afraid to Ask
Frequently Asked Questions
Splunk Cloud and Fortinet on IBM Cloud are common alternatives for AlienVault USM.
Reviewers rate Deployment flexibility highest, with a score of 8.6.
The most common users of AlienVault USM are from Mid-sized Companies (51-1,000 employees).
Comparisons
Compare with
Reviews and Ratings
(735)
Community Insights
TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!
- Business Problems Solved
- Recommendations
Users have found AlienVault USM to be a valuable SIEM solution for centralizing and searching log data from a large number of network attached devices. This platform is being used for various use cases such as vulnerability management, scanning, malware detection, and monitoring malicious network traffic. It is considered a good SIEM solution for organizations new to security operational logging or those with a smaller staff and budget. The product has been praised for its integrated feature sets, including HIDS, NIDS, FIM, and security alerting capabilities. The inclusion of features like vulnerability scanning and file integrity monitoring has extended its value for organizations in the early stages of cybersecurity program development. Many users have experienced real-time alerts, enabling them to respond to security incidents and compromised passwords more quickly. Furthermore, AlienVault is used for a range of functions such as SIEM, vulnerability scanning, asset discovery, and investigations. It provides organizations with a centralized log collection site, allowing them to monitor and address new problems more effectively. The platform has been effective in helping organizations meet regulatory compliance requirements and improve SOC operations. Additionally, AlienVault is used to analyze network traffic, Windows Event Logs, and other security events, helping organizations improve network security and protect their customers. It solves security challenges related to device and software visibility, monitoring for anomalous events, and ensuring patch management. Users appreciate the simplicity of deployment and the robustness of the interface. The support team is highly responsive and knowledgeable.
AlienVault USM Anywhere is used by organizations to easily identify security incidents happening across their infrastructure and comply with PCI-DSS compliance requirements. MSSPs utilize AlienVault USM Anywhere to provide their customers with best-in-class threat monitoring and response services. It is also used to monitor cloud environments, scanning and alerting for any known vulnerabilities or activity on servers. AlienVault helps organizations with auditing purposes by monitoring cloud permissions and changes to security. Additionally, it is deployed to customers for monitoring and is used by NSOCs to monitor their networks. AlienVault has been implemented across organizations, covering server assets and providing granular logging on systems and networks. It helps in raising alarms/alerts and mitigating network-related activities. AlienVault collects and alerts on network and system activity across the entire organization, making it easy to filter for important data. The product centralizes log data and helps perform vulnerability analysis and threat detection. It assists in security patching and monitoring within AWS environments. Users appreciate the ease of use and configuration of the cloud-based panel. AlienVault is implemented and managed for clients as a recommended SIEM solution, collecting and normalizing logs from various data sources. It is used throughout organizations to gain insight into network and server events, manage and correlate logs, and recognize anomalous activity. Users have been able to set up alerts for specific events and policies, effectively managing systems and alerts in place, monitoring multiple client environments, and identifying issues that clients may have missed.
AlienVault USM Anywhere is praised for its cost-effectiveness compared to other SIEM solutions on the market. Users appreciate its threat intelligence capabilities, ease of use, user-friendly interface, and simplicity of deployment. The built-in correlation rules require minimal setup and provide high-quality results. Asset management and scanning features help users stay on top of monitoring assets, including dynamic and static asset lists. The integration of OTX into USM Anywhere allows for up-to-date threat intelligence and pulse subscriptions.
The software plays a crucial role in monitoring and alerting when anomalies occur, aiding in threat detection, compliance management, log collection, and vulnerability scanning. It helps organizations stay up to speed on new vulnerabilities and supports agile business initiatives by aiding analysts in identifying cyber threats and providing access to threat cross-referencing data. AlienVault USM Anywhere is deployed to monitor AWS cloud environments, attain compliance, identify threats, and facilitate auditing of non-emergency configuration changes and vulnerability monitoring.
Overall, AlienVault USM Anywhere provides centralized security monitoring, incident response capabilities, compliance reporting features, vulnerability assessment tools, real-time SIEM functionality, as well as asset discovery and user activity monitoring capabilities. It has been widely adopted across various industries for enhancing security posture and gaining comprehensive visibility into network activities.
Based on user recommendations, AlienVault USM receives the following common recommendations:
-
AlienVault USM is recommended for cost-conscious companies and small to medium businesses due to its affordability and effectiveness. Users find it to be a great tool for analyzing and reacting to threats, offering excellent value for the price.
-
Users suggest exploring alternative SIEM choices and discussing functionality and configuration requirements. Logrhythm is mentioned as a possible alternate SIEM choice, especially for high-end functionality needs. It is advised to compare features and select the SIEM system that offers the best cost for desired features.
-
To maximize the experience with AlienVault USM, users recommend taking advantage of training opportunities provided by AlienVault. Joining official training sessions allows users to learn best practices from other users and gain comprehensive knowledge of the product. Users also recommend utilizing forums, support, webinars, and videos offered by AlienVault to enhance understanding and achieve optimal results.
Overall, AlienVault USM is regarded as a cost-effective solution suitable for organizations with data privacy and security priorities. The product's flexibility, community-created intelligence, and continual improvement are also highlighted by users. While some mention areas for improvement, such as support stability and module quality, the general consensus is that AlienVault USM delivers reliable security enhancements and cost savings.
Attribute Ratings
Reviews
(151-175 of 390)Companies can't remove reviews or game the system. Here's why
We use AlienVault USM across our entire organization, which includes 5 separate SaaS products. At a basic level, we use the core/default functionality of AlienVault to watch our AWS account. Beyond that, we use it to collect and analyze logs for suspicious activity. The ability to track and respond to suspicious events and document them completely is super key to our organization. The reporting functionality is key in allowing me to demonstrate our processes over time to show we watch and respond to alerts.
- Log analysis, both syslog and AWS cloud trail, and searchability/reporting is actually better than most of our other related tools: All of our systems send log information using rsyslog to our AlienVault USM system. AlienVault is able to alert us of many issues with minimal configuration, including adding/removing users to sensitive groups, creating or removing resources such as EBS volumes, S3 buckets, or security groups.
- AWS loadbalancer traffic/log analysis: AlienVault automatically identifies threatening IPs or entries that match suspicious traffic patterns.
- The ability to search the many logs AlienVault collects in a way that even novice users can follow is super valuable. Logs can be quickly sorted by source, log type, and/or keyword searches. There have been many occasions where we were able to find non-security related issues due to the simple yet advanced search abilities of AlienVault. This has led to the challenge of deciding when and how long to allow non-security personnel access for troubleshooting.
- AlienVaults lack of support for Docker may be its undoing at my company. It clearly stands above other products that fit our company, but we are adopting Docker at an ever-increasing rate. I don't want to support multiple security products, so it would be super cool if a solution to this challenge were found quickly.
- Enriching data is super key to allowing us to set up alerts for and filer events. This process is rather painful. This significantly increases the cost of maintaining AlienVault. Specifically, several auditd and standard AWS logs do not allow me to filter based on keywords in the message.
- Here is one example:
- User: arn:aws:sts::2#########:assumed-role/qe-lambda-role/qe-batch-run-dev-frontend_batch_runner is not authorized to perform: logs:CreateLogStream on resource: arn:aws:logs:us-east-1:#########:log-group:/aws/lambda/qe-batch-run-dev-frontend_batch_runner:log-stream:2019/05/30/[$LATEST]########################
- The ability to configure AlienVault to run security scans using SSH on systems is prohibitively difficult to use, especially when using a Bastion.
- Making OSSIM work is a huge pain. I could not find AlienVault documentation that covers how things work and how to properly integrate it.
May 29, 2019
Good tech, poor back office.
USM provides a proactive response to intrusions, threat management, and provides a view of the risk.
- Sensor integration is relatively easy.
- Technical support for unique situations is extremely helpful.
- Billing sucks since AT&T bought AlienVault.
- Accounting takes weeks to do a simple change of address.
- The administrative side is not customer focused and you feel like you are inconveniencing them.
May 28, 2019
It works fine I guess
We use it to monitor a CDE (card data environment) for PCI compliance.
- Integrations, like with Azure, Windows, IIS.
- Notifications/e-mail alerts on changes.
- How many events/data points are recorded and how you can drill down into them.
- Our Azure integration broke at some point because some credentials changed. I didn't set it up originally but I had to fix it. It didn't feel easy to get it back up and running. It wasn't completely straightforward.
- It's sometimes hard to find specific types of events in the reports. Like if I'm looking for all of a specific type of event, it can be hard to know what page to use, what knobs to turn and buttons to push to find what I'm looking for.
- It's hard to find subscription/billing information, like to know when we last paid, how much it was, for what subscription, what were the details of what we paid for. Is it that I don't have access to see this? Is it hard to get to, or is it just that I don't have access to see it? I don't know which one of those it is. I needed to get this information to my manager recently and wasn't able to do it. I'm not sure if they ever got what they needed. Are we going to try to auto-renew with an expired credit card? Who knows.
Alienvault was selected as our SIEM solution to provide cutting-edge monitoring, analytics and alerting, and it has the added benefit of being able to conduct vulnerability assessments and provide endpoint detection and response. There is a lot of noise when deploying any SIEM solution, but Alienvault is unique in that it can be effective, practically right out-of-the-box, and anything required beyond that is satisfied by their great support team and available training. I have found that USM Anywhere can fill a critical gap in your security program, and I would recommend it for both small, medium, and large businesses.
- Anomaly Detection and Identification
- Digital Forensics/Incident Response
- Log Correlation and Built-in Attack Signatures
- Cloud Security Monitoring
- Would be nice to have better error messaging, specifically around credential failures.
May 25, 2019
AlienVault is a great product. It is a must for any organization with security on the brain
AlienVault is currently being used to monitor all servers, work stations, Network, and Office 365 environments. We also are using it to monitor workstation vulnerabilities. We are using it across the entire organization, and all three locations.
- I love the Office 365 integration feature. It allows me to be proactive to all account breach attempts and all administrative changes made in the environment.
- The Meraki integration feature is amazing as well. This shows me more details than the Meraki logs can show.
- The details of the Windows Server logs are very good. The ability to research any issue on The AlienVault OTX portal is great.
- I feel the third party used to help Implement the AlienVault installation could use some improvement. The person that was assigned to help us was just reading from the online material, I could have done that myself, and did. They were not familiar with the product at all.
- I would like to see a Module that scans for PHI on workstations and file share server, with detailed reports.
Used to monitor the internal environment as well as providing managed security services to our customers. Provide SOC as a service and incident management and response services utilizing USM Central and USM Anywhere. It solves the problem for companies who can’t afford to implement the technology themselves and to hire a full-time team or analyst to provide internal SOC capabilities.
- Simplifying the process to perform end to end security monitoring triage and response.
- Unifying security capabilities such as log management, SIEM, HIDS/NIDS, and Vulnerability Management.
- A product that scales well.
- The search interface in event page could be improved.
AlienVault USM is being used for compliance purposes and as a central system and event log repository. We decided to utilize the hosted version for simplicity and ease of use. In addition, the hosted solution allowed for easy setup and configuration. AlienVault USM is currently being used by the Information Technology department. Events and logs are reviewed when needed. The solution allows us to now have one location for all the various applications and devices to deposit logs.
- We found AlienVault USM very easy to configure and get running.
- The user interface is very intuitive, allowing most IT staff to use with little training.
- Many useful features included.
- Custom reports are difficult to configure.
May 24, 2019
Great product to meet many SIEM requirements
We use AlienVault to help manage PCI compliance within our AWS infrastructure. AlienVault is used for intrusion detection, file integrity monitoring, monitoring of VPC flow logs, WAF logs and more. We also utilize the reporting.
- Integrating with other applications.
- Satisfies several PCI requirements.
- Nice customization for the dashboard.
- Support is very good.
- The UI is slow to load. Not extremely slow, but noticeably.
- I have found no way to easily move a suppression rule to a filtering rule.
- Needs more tiers for data usage. You can only go up in increments of 500gb which can be expensive and overkill for smaller businesses.
- Sales teams and pricing for renewals - Huge price increase after the 1st year.
May 20, 2019
AlienVault USM Anywhere - Protecting AWS environment for a small healthcare SaaS company
We're using USM Anywhere as our security monitoring and SIEM platform. We have two AWS accounts with about 150 servers (Linux & Window). The USM is used to monitor the servers, virtual firewalls, other various virtual appliances, and the AWS VPC network itself. There are virtual AlienVault sensor appliances hosted within the AWS accounts, to collect log data.
- Deployment and management of the product is much simpler than other SIEM platforms, making it ideal for small IT teams who don't have a bunch of SIEM gurus on staff.
- It does a very good job of providing useful, meaningful, and relevant alerts.
- Searching through log & event data is fast and easy using all the built-in query tools.
- I love the OTX (Open Threat Exchange) integration, identifies malicious IPs communicating with your systems.
- I'm not a fan of the shady sales tactics and price increases. We originally signed a one-year contract. Our account rep contacted us about 6 months into the contract, saying that there would be a big price increase in the coming months, but he could get us last years pricing on our renewal if we signed the renewal within 30 days (with Net30 payment terms).
- Translation - we sold you a 12 month subscription, but you have to pay for another 12 month subscription after only 8 months if you don't want to price to go up.
- The exact same thing happened the following year, so this was not one-time thing. During the most recent yearly renewal, the price was going to nearly double if we didn't do early renewal. These type of sales shenanigans feel an awful lot like extortion to me.
- Tech support isn't that great. Thankfully we haven't had many problems with the product, but when we have had issues, support can take a long time to address the problems.
May 20, 2019
Works good, but overpriced
Used by the DevOps team to oversee and maintain PCI Level 1 compliance and certification.
- Centralizing Windows OS Events.
- Alerting to atypical changes in the AWS infrastructure.
- Overview of systems in use.
- Cost
- Inclusion of specific Windows events even if not meeting the generic filter of event types.
It is being used by the Operations group to address PCI compliance.
- Notification of changes to security settings.
- Very good out of the box settings.
- Ability to setup reports that are sent to email distributions.
May 18, 2019
Alienvault is beaming with quality and security.
We use Alienvault USM for our cloud environment. We use it for requirements for PCI compliance. We currently have two sensors to track configuration changes, vulnerabilities in our servers and applications, and for network scanning. Alienvault USM alerts us when anyone changes or reconfigures our network environment, when a user is added or removed, or when a potential attack is happening.
- Alerting when a person changes a routing table in our cloud network.
- Alerting when someone fails to login after many attempts.
- Vulnerability scans.
- Finding results after scanning an environment for vulnerabilities.
- Installing a sensor into an environment.
May 18, 2019
Security is not an Alien
AlienVault is used by our IT department as part of our SIEM centralizing logs, correlating events, analyzing behaviors and triggering alerts.
The reporting capabilities are used by our compliance group to support their initiatives and certifications.
- Cloud environment connectivity
- Event correlation
- User behavior visibility
- Pricing of Storage
- Customer support
- Account management
- Log storage capacity
May 17, 2019
AlienVault USM..making sense
The USM is being used by the IT department as a SIEM, giving our organization a 360 view of what's going on in the network infrastructure, and more focus on the critical infrastructures which has been plugged-in to send all their log activities. The AlienVault USM has made it simple by the creation of plugins which makes it easier to express the logs in simple expression for easy understanding.
- Large plugin base to accommodate different devices.
- Easy to deploy.
- Easy management.
- Makes network monitoring and actionable steps clear and simple.
- Updating the appliance to a newer version.
- More control over which devices will be allowed to log into a database and which ones that should just appear, so that the database will not get filled up quickly.
May 16, 2019
USM AlienVault Review
Score 10 out of 10
Vetted Review
Verified User
USM is being used by our new Information Security department to identify and investigate potential security issues across our corporate network and all of our branches. The major problems it is helping us address is identifying potential system compromises, account manipulations, malicious traffic, and other forms of attack against our corporate computers, accounts, and other network devices.
- USM is very good at detecting suspicious activity/traffic and generating alarms for these events. Even though many times they end up being false positives, it is still better to know and investigate rather than not be made aware of the potentially malicious activity at all.
- Eliminating false positives is very easy with suppression and filtering rules.
- The breakdown of logs from events in easy to read format really helps with quickly investigating an issue and figuring out the source.
- When creating an alarm or notification rule I think the "Event name" should be one of the default fields instead of having to add the condition every time.
AlienValut USM is deployed throughout our entire server and database architecture primarily in the cloud in Linux environments. It's managed and orchestrated by one department but secures data integral to the entire business.
- Data analysis at the endpoint
- Functions independent of directory services if necessary
- Well-rounded approach to data gathering (e.g. asset discovery, vulnerability assessment, intrusion detection, behavioral monitoring, etc.)
- They nickel and dime you on the processing of data, and you have to create different kinds of filtering rules and purge rules so that you don't hit your data limits. It's not uncommon to charge for data processing in this industry. That's not what I have a problem with. Most data analytics tools will do that, but the way they tier it (at least when we looked at it) was pretty aggravating. You really couldn't use their lowest tier unless you weren't planning on retaining and processing much of the data, which defeats the whole purpose.
- The way the different rules (e.g. filter vs purge) are laid out and configured isn't very intuitive. Their UX guys have a lot of work to do.
- "Sensors" aren't just sensors. They do the bulk of the heavy lifting. I'm not a fan of allocating those kinds of resources on an endpoint to an agent (sensor). I would much rather the agents be lightweight and funneling the info back to a server that does the computing. If you want a cloud-deployable and managed solution, and you want quick, thorough analysis, it has to be done on the endpoint instead of the management server in the cloud. I wish that weren't the case and would love to see that workload shifted off of my endpoints if possible.
May 13, 2019
Value for money!
It's used as an SIEM and vulnerability management solution across the whole organisation. We are also leveraging the dark web monitoring module as part of our current subscription.
- Correlation of logs between different applications
- Executive Dashboard view
- Rather having two different systems for SIEM and Vulnerability management, AlienVault delivers seamless
- Reporting
- Dashboard view
AlienVault is being used internally for testing purposes and is implemented for MSP functionality across our clients. USM provides our clients with central logging and correlated security alerting.
- Logging
- Correlation Rules
- Interoperability
- Compliance
- Customization can always be improved with more AlienApps / Plugins
- Better guidance on what a good baseline of logs should be brought in
- Better estimates about how many devices a given environment can support.
May 13, 2019
Out of this World, Out-of-the-Box
AlienVault USM Anywhere is a perfect fit for the protective monitoring of our organisation's web facing services. It was important for us to have a real-time monitoring solution in place which could be accessed remotely by analysts such as myself. Our offices are geographically separated from our data centre so we do not have direct access to the network infrastructure. AlienVault USM helps to keep us informed of anything suspicious or unexpected which may require further investigation and more recently, with the launch of the new Investigations function, it has become even more useful as a tool for cataloguing and responding to potential incidents.
- Alarms - These are one of the products strengths in that they provide detailed breakdowns of the information that a security analyst is looking for in order to understand what is happening on the network
- Investigations - The best feature of the product is the ability to create investigations, assign events and alarms to them, and then gather evidence, make a determination and react/respond based on the nature of the incident
- Dashboard - This gives a useful at-a-glance summary of the current security posture and recent trends in alarms
- The main criticism I had with USM Anywhere was that initially it was lacking the Investigations functionality which often meant that alarms were investigated but there was no record of this work that could serve for audit purposes or to look at long term trends. Now that this has been added I have very little to criticise about the product and I use it more than ever.
AlienVault is being used to aggregate error log information across the organization from servers, networking equipment and client machines. It then allows searching of that information, categorizing it and applying rules to notify engineering and department management should anomalies occur. These notifications can take a variety of forms and are then acted upon by the appropriate technical staff, thus meeting technical and processing needs.
- Data aggregation is reliable and relatively easy to set up.
- The product is flexible in the way it can be configured to record and aggregate activity.
- Alerts are easily configurable.
- It is easy to demonstrate the product to satisfy auditors.
- There are a plethora of possible rules configurations. These could be better categorized.
- More readily available examples for particular configurations, like comprehensive Exchange monitoring for example.
- Online at your own speed training would be an excellent addition.
May 10, 2019
AlienVault USM Review and how it works for us.
We use AlienVault only in IT department as a SIEM software, is our first place to see what happens with our security.
- The upgrade of the sensors is automatic, which is great! We never had to do nothing extra in that aspect.
- We're always being informed about the new security risks that appear in any place.
- The automatic vulnerability scan of assets is really useful, as we can keep updated about our security risks and can take corrective actions based on those reports.
- We would be glad to see more flexibility to manage the rules, to list all of them, or export them for a more detailed analysis.
- In the same line, a better manager of the alerts would be great. It's complicated to manage events when there are a lot.
- The price could be more friendly.
We use AlienVault USM across our entire organization. It was purchased to help us improve our ability to respond to cyber security threats by keeping up with patching and tracking down vulnerabilities on our network. We took these steps after paying to have penetration testing done on our network.
- AlienVault USM helps our IT staff stay on top of patches.
- AlientVault USM makes it easier for our IT staff to track down vulnerabilities.
- AlienVault USM provides steps to correct any vulnerabilities that may arise.
- AlienVault's staff were very helpful in setting up their product on our network. There was plenty of opportunity for training.
- AlienVault USM can be cumbersome for a small IT staff to manage. We still use AlienVault USM but now pay a third party to help us manage it.
We currently use AlienVault USM with our managed service provider division to provide security and visibility for our services provided to our customers. We're SOC2 certified and AlienVault USM is a key part of maintaining that certification with the data it gives us about what is happening with our services and the infrastructure that supports those services.
- The network IDS of AlienVault USM Anywhere is easy to set up with our network and provides excellent visibility into the network traffic.
- We use the host-based IDS agent on each of our servers so that we can get detailed server actions and analyze anything unusual.
- The web interface of AlienVault USM does an excellent job of providing the right level of information and not overloading us with raw data.
- Some flexibility of how we can use the data from the host agent ISD would be a good improvement.
May 08, 2019
Alienvault is wonderful
AlienVault USM Anywhere is being used across the entire organization, for full network monitoring of all systems including election systems. We also are using AlienVault in our Azure environment for monitoring of applications and virtual machines that are housed in the cloud. This is through firewall logs and the AlienVault Agents.
- Normalization of logs that it receives
- Know threat alerts
- Amount of data it keeps track of
- Easier connection with the Cisco Umbrella system
- Better systems integrations
- Simpler log clean ups and alerts
We were evaluating various SIEM systems and decided to use AlienVault USM due to the product's offerings and the price point. We started using AlienVault USM last year. The first phase was with initial monitoring of events from development servers and then we gradually moved it to other devices. It is currently used for monitoring of devices for some departments and we may gradually extend the
SIEM tool to rest of the organization.
- The plug and play feature of AlienVault USM is very helpful to get started with the product and reduce set-up and implementation time.
- The use of Office 365 Management API to monitor user and administrate activities has been very helpful as a part of our migration to MO356.
- Another useful feature is AlienVault’s integrated threat intelligence with OTX community, as AlienVault OTX daily emails are considered a helpful additional source of information.
- The setup and configuration of the VMware port mirroring for virtual switches and port monitoring are very challenging.