1. Home
  2. Security Information and Event Management (SIEM) Software
  3. AlienVault USM Reviews
  4. User Review of AlienVault USM
AlienVault working reliably to protect your office network.
October 29, 2019

AlienVault working reliably to protect your office network.

Anonymous | TrustRadius Reviewer
Score 6 out of 10
Vetted Review
Verified User

Software Version

USM Anywhere (SaaS)

Overall Satisfaction with AlienVault USM

AlienVault is used to monitor traffic in our offices and the VPN for suspicious activity. Additionally, deployed agents monitor event-logs and several streams from our Syslog to ensure we can see any bad-auths. AlienVault helps to identify bad traffic, suspicious user behavior and outdated software on those hosts with the agent deployed.
  • Through the open threat exchange, I get the latest indicators of bad actors and can, on the other hand, add my own indicators if I feel something is missing.
  • Filter-/Alarm-rules are easy to set up, so I can distinguish the important bits from noise in the logs
  • Deploying the agents is very easy through the provided PowerShell scripts.
  • Setting up a working stream of the windows-event-log (not using local agents) seems impossible, and AlienVault's support wasn't very helpful in this matter. We finally decided to drop this (it ran for a while, then stopped for no apparent reason, seemingly a problem with certificates) and use local agents instead.
  • Sometimes agents don't update themselves, and it's hard to diagnose what causes this.
  • Also, the updater of the sensor-appliances doesn't seem to run very reliably. From time to time I have to re-install the sensor-appliance, as it doesn't want to update itself.
Mostly a price matter. In terms of the free version of AlienVault, it's just too much work to set it up properly.
It does a good job of monitoring office-networks with user traffic. As there's still a bunch of false-positives, it likely won't do as good of a job in protecting applications in a datacenter. That would most likely generate too much noise and require too much work, setting up all those custom rules, to actually catch what you want to see. For making sure there's no C&C-traffic and no suspicious authentication behavior, it's working very well. Also, monitoring the software-stack through the local agents works well.