I'm Not Saying it's Aliens, but it's AlienVault.

AlienVault has a broad selection of tools all within the same user interface. We have been able to cover several security needs with one product that previously were done with several different tools. This has made it a lot easier to manage as we have to learn one tool rather than many different tools. It was also much more cost effective than it would have been buying a multitude of point products. AlienVault enabled smoother compliance with PCI because we were able to get many of the required security controls in place more easily. In our particular case this was especially because of using the vulnerability scanning, file integrity/host intrusion detection, and network intrusion detection modules within AlienVault.

I have always had excellent experience with AlienVault's support. Any issue I have had they worked with me to resolve quickly. I have also had the opportunity to speak to several individuals within AlienVault to discuss problems I have had with the product or features that I would like to see. They have always listened to me and almost all of the things that I wanted to see have actually been added to the product in the time I have used it. It has improved considerably over the year that I have been using AlienVault. I am quite happy with the ability to give feedback that I know is listened to. In fact I consider this to be one of the best things about this product. It is pretty solid and has quite a bit of usefulness to begin with but no product is ever perfect. We are all aware of products that don't live up to marketing hype. Which of course means having a company that listens to feedback very important so they can constantly improve and refine their solution.

Complete access to the underlying OS. I am not particularly fond of products that limit access to all aspects of the product. It is one thing to have proprietary code it is another to limit root or admin access to a box your company paid for. In AlienVault you can get into the command line anytime you want (it is built on a Linux OS). If you need to do some troubleshooting with which the UI is simply not sufficient, you can! There are issues that I have resolved with support that now I can resolve entirely on my own because I retain the capabilities to fix the problem they have (for support issues it is really a lack of knowledge on my part rather than lack of capability). I have had bad experiences with products that require calling support and waiting for them to do something.

OTX (Open Threat Exchange) went from something that was merely interesting and possibly useful to something that is extremely interesting and very useful for incident response. It has a lot of really good information on the many threats that you would see out in the world. It is really handy in order to hone in on the threats that actually matter to you (plus ignoring threats that do not matter). In our case POS (point of sale) malware represents the greatest current threat. I now have a good idea of the kind of POS malware there is. AlienVault will correlate all of the data from OTX so you will know if any behavior from any of the threats listed in OTX can be found in your environment.