Item: AlienVault USM
Rating: 6
Author: Verified User

Use Cases and Deployment Scope

We use AlienVault's UTM to help with our PCI compliance. We need a system that can centrally receive and inspect system logs, as well as run 'FIM' (file integrity monitoring) and provide an alert when something out of the ordinary occurs. AlienVault also has a built-in vulnerability scanner 'OpenVAS' that we use to scan for vulnerabilities within our Windows and Linux servers.

Pros and Cons

Overview of Log information from multiple sources (Trends, frequency, types)
Vulnerability scanning
Ticketing and Alerting

Extremely hard to set up
Hard to configure log filtering

Alternatives Considered

We looked at LogRhythm, LogLogic and Splunk. LogRhythm and LogLogic are great products, but too expensive for a small environment; Splunk requires a lot of investment in time to set up and configure, so we went instead for AlienVault.

Likelihood to Recommend

AlienVault UTM is great for smaller organisations that need to meet compliance requirements, however it cannot be stressed enough that the cost of configuring the product should be considered as part of the initial purchase price. AlienVault does offer professional services for this very purpose, however their daily rate is high.

Users and Roles

2 - Security and compliance

Support Headcount Required

2 - General IT abilities, plus we run AlienVault inside VMware so a basic ability to troubleshoot the VM.
In an ideal world, someone with IT security knowledge, and experience working with log files is the kind of person you need.

Business Processes Supported

Central log collection
Log & event analysis
Alerting
File integrity monitoring

Future Planned Uses

Network Intrusion Detection System
Vulnerability Assessment

Likelihood to Renew

It's the best product available to us right now, it gives us a lot of functionality that we need to meet compliance requirements at a reasonable price.

Support Rating

They seem to really care, and take my questions seriously. I've never been left without a response and they track issues really well. In addition they can dial-in to our system and perform remote diagnosis.

AlienVault USM Customer Support Pros and Cons

Pros	Cons
Quick Resolution Good followup Knowledgeable team Problems get solved Kept well informed No escalation required Support understands my problem Support cares about my success	Difficult to get immediate help

Premium Support

Yes - It is a mandatory element when purchasing the product.

Exceptional Examples of AlienVault USM Support

On one particular issue I wanted to do something that wasn't strictly supported, but the support agent gave me their 'unofficial' solution anyway - and it worked [like] a treat!

Usability

The UI looks great, but I think that a certain amount of knowledge is assumed. There is a lack of explanation built-into the UI so you have to know roughly how to do something in AlienVault before you begin.
Anything other than the basic configuration is a nightmare.

Usability Pros and Cons

Pros	Cons
Like to use Consistent	Unnecessarily complex Difficult to use Requires technical support Slow to learn Feel nervous using Lots to learn

Easy Tasks

Looking at log files received by the system
Vulnerability scanning
System Updates

Difficult Tasks

Setting up Alerting
Generating Custom Reports

Purchased & Installed for Compliance

Overall Satisfaction with AlienVault Unified Security Management