Item: AlienVault USM
Rating: 7
Author: Ranjith R

Overall Satisfaction with AlienVault USM

Use Cases and Deployment Scope

We have procured AlienVault USM Anywhere for Monitoring and Triggering alarms/notification on the suspicious traffic and attacks. It is being used within the infosec/infra department to take necessary actions on the security events. It majorly helps us to find the real-time attack and traffic events to our organisational assets and also it helps us on finding the vulnerabilities on a specific asset.

Pros and Cons

Pros

AlienVault USM has the potential to identify the attack patterns by the traffic events through their sensors which is already built-in with their own correlation rules.
USM Anywhere sensor reduces the load for SOC analyst on writing the new set of rules.
And also provides an option for slack integration which myself felt very nice for an immediate action.

Cons

When we talk about the forensics investigation the user interface and experience is not that great as expected, when we sent an alarm/event for investigation it doesn't provide any investigation results.
The USM sensor doesn't have the capability of handling more jobs, It does restarts the sensor if certain limit of jobs are configured
The log reports are not getting downloaded when we try to attempt via safari browser

Alternatives Considered

No Idea, it is already bought by our company

Likelihood to Recommend

It is well suited for a Cloud environment like AWS and Azure, since GCP is a new player in cloud, AlienVault has to improve a lot in terms of support with the data and log sync of instance asset mapping and sensor capability to handle more jobs to get out of unavailability issue among other competitors like Splunk, Sumo Logic and LogRhythm

Comments

Please log in to join the conversation

Tami Andrews
(Vendor Representative) commented 5 years ago
Ranjith - Thank you for your feedback!

Review for AlienVault USM Anywhere AWS and GCP Approaches

Software Version