Item: AlienVault USM
Rating: 7
Author: Verified User

Overall Satisfaction with AlienVault USM

Use Cases and Deployment Scope

We use AlienVault USM across our whole organisation. We monitor network traffic and asset vulnerabilities in both our company network and on multiple public cloud provider accounts. We're also tracking Office365 usage. Moreover, several logs (audit, web servers, etc.) are forwarded via syslog to the sensors allowing us to detect attacks.

Pros and Cons

Pros

Vulnerability scans on several different OS.
Intrusion/Attack detection.

Cons

No customisable patterns for log analysis.
Not friendly with autoscaling resources with no possibility to have auto-deletion of assets no more present after a certain amount of time.

Alternatives Considered

I've tried OpenVAS. I've found AlienVault USM to have better usability and to be more up to date with the asset scan vulnerability database.

Likelihood to Recommend

It's quite appropriate for scanning and detecting possible attacks via logs/events. Also, it's good for vulnerabilities analysis. It's not suited for docker container vulnerability scans as there is no easy way to do that. For that scenario, it is currently better to use offline scanning of the docker images.

Comments

Please log in to join the conversation

Tami Andrews
(Vendor Representative) commented 5 years ago
Thank you for your feedback & comments!

Ease the assessment of threats and vulnerabilities with AlienVault USM.

Software Version