AlienVault OSSIM Reviews

Name: AlienVault OSSIM
Brand: AT&T
Rating: 3.7 (30 reviews)

Vendor: AT&T

3.7 out of 5

30 reviews
80% willing to recommend

110 followers

What is AlienVault OSSIM?

AlienVault OSSIM, Open Source Security Information and Event Management (SIEM), provides you with a feature-rich open source SIEM complete with event collection, normalization and correlation. Launched by security engineers because of the lack of available open source products, AlienVault OSSIM was created specifically to address the reality many security professionals face: A SIEM, whether it is open source or commercial, is virtually useless without the basic security controls necessary for security visibility.

Get the AlienVault OSSIM Buyer's Guide and find out what your peers are saying about AlienVault OSSIM, Wazuh, Splunk Enterprise Security and more!

AlienVault OSSIM is the #13 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give AlienVault OSSIM an average rating of 7.4 out of 10. Based on the analysis of the 30 most recent AlienVault OSSIM reviews, the overall sentiment is positive, with a sentiment score of 7.2. AlienVault OSSIM is most commonly compared to Wazuh: AlienVault OSSIM vs Wazuh. AlienVault OSSIM is popular among the large enterprise segment, accounting for 49% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 17% of all views.

Helped 816,192 peers since 2012

Featured reviews

HarshBhardiya

SOC Engineer at Just Dial Limited

The solution is not scalable. It impacts so hard. In the initial stages, AlienVault OSSIM can be suitable for small environments. There may be limitations if the customer expresses a desire to expand and add more devices. In such cases, we would need to either explore additional solutions or work within the constraints of the existing setup. We have set up alerts and configured everything in AlienVault OSSIM. It actively monitors for any security incidents. It provides us with regular updates and notifications about any ongoing activities. Only one person is using the solution. It is the perfect solution for small businesses. I rate the solution’s scalability a three out of ten.

Read full review

Intekhab Ahmad.

Senior System and cyber security administration at Tankeenhr

The tool's security detection is good. It helps us with login tracking and generating reports. We aim to identify potential issues, such as brute-force attacks on user accounts or server-level anomalies. For instance, if I receive a report indicating a server is at an abnormal level, I investigate and address the issue. Regular meetings are conducted every ten to twenty days to update network issues. Due to restrictions, users face challenges when accessing WhatsApp from outside Saudi Arabia. To bypass this, they use VPNs. When a user logs into Office 365 via VPN, the system sends me a notification indicating their login.

Read full review

Aman Aijaz

Assistant Manager Global Security at Convergys Corporation

The area for improvement is a lot. When I started using it on our enterprise side, the issue we faced was, for example, if we were running at that time on AlienVault OSSIM v5.7.4. So, for some orders, we had to install some packages, and when we tried installing that package, some dependencies got upgraded to a new version. Now once that dependency got upgraded, the SQL, since you might be aware that OSSIM uses SQL database, now SQL and all the dependency in everything was not on the same version, and that caused the database to crash. The aforementioned area should be eased out by upgrading the patches and upgrading dependencies. This kind of thing is a disadvantage of OSSIM, and I would like them to work on this. But I have also raised service requests many times and gave it a push on the community section too. However, since it is a local source, they don't reply much over there. That is why I don't like to work on OSSIM because it is unpredictable. Once the storage goes above 50 percent, it starts behaving unpredictably. If you get stuck with a situation, then you need to drill a lockdown into that. Sometimes you get no luck. Then you have to just reimage the server with the new fresh OS of AlienVault. As for additional features, not much because if you move to the newer version, it is kind of getting more stable. But, to make my life easier, then I would say try to give more features. I know it's open source, so they also cannot provide me with more features. But still, if they can provide me with more features because right now it's becoming old. Right now, we are even moving from SIEM to Security Data Lake. So when we move to it, this will be literally outdated. No one can even expect anything out of it. The way security is moving, it will be outdated very soon. They have to also provide something new to keep this going for the future also.

Read full review

AlienVault OSSIM mindshare

As of November 2024, the mindshare of AlienVault OSSIM in the Security Information and Event Management (SIEM) category stands at 4.5%, up from 2.6% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Key learnings from peers

Last updated Nov 14, 2024

Valuable Features

AlienVault OSSIM's strengths include threat alerts, asset discovery, logging capabilities, vulnerability assessment, data correlation, and network traffic analysis. Its integration with various tools and ease of use are praised, as are its user-friendly dashboard and advanced threat policies. Free usage is a major benefit. The architecture and reporting capabilities are appreciated, along with self-paced training. Users value the built-in IDS, threat intelligence, and investigation features for enhancing network security and visibility.

"Network traffic analysis is highly efficient."
"The product is majorly used for threat detection of the agents on servers and endpoints."
"It has helped us remediate threats in the past by providing significant events that assisted in identifying suspicious activities, such as logins from multiple countries."

Room for Improvement

AlienVault OSSIM faces challenges with integration, scalability, and user interface complexity. It struggles with handling large deployments and high traffic, has outdated features, and provides insufficient integration with new tools. The system is complex to configure, requires expert knowledge, and offers limited customization options. The threat response time is slow, impacting compliance for sectors like banking. Additionally, improvements are needed in log management, dashboards, and security analytics capabilities. Pricing is also considered high for some users.

"There are somewhat more false positives with the user behavior analytics, which could benefit from an additional machine learning model to detect user patterns more rapidly."
"There are somewhat more false positives with the user behavior analytics, which could benefit from an additional machine learning model to detect user patterns more rapidly."
"AlienVault OSSIM failed to provide our company a full insight, while also giving out a lot of false positives."

ROI

Users found that AlienVault OSSIM helped reduce time spent on manual log analysis, improved threat detection efficiency, and offered valuable insights into network security. It enhanced compliance reporting and provided cost-effective security management. Some noted that while initial setup required effort, the significant reduction in labor costs and improved threat visibility justified the investment.

Pricing

AlienVault OSSIM is predominantly free as it is an open-source solution, with the Community Edition available at no cost. However, licensing fees apply for the premium versions, offering additional features. These fees are charged annually and can sometimes be considered high compared to competitors like Microsoft Sentinel or Splunk. While the solution offers a strong price-performance ratio, enterprises often need to pay extra for support, and costs can range significantly depending on the version and additional services required.

"I used the paid version of the tool and found it to be expensive. It has been a while since I changed to Securonix. I will have to check whether AlienVault charges per device, user, or log."
"AlienVault OSSIM is expensive compared to its competitors."
"The tool's licensing costs are yearly."

Popular Use Cases

AlienVault OSSIM is primarily used for monitoring and threat detection, log collection, incident management, and compliance with industry standards. Users implement OSSIM for securing traffic, analyzing events, vulnerability scanning, and network visibility. It helps identify malicious activities, provides a comprehensive SIEM system, and supports user and network analysis. Businesses use its features such as event correlation, local action, and IDS capabilities in both on-premise and cloud environments for enhancing cybersecurity posture.

Service and Support

AlienVault OSSIM's customer service and support receive mixed feedback. Paid support shows prompt but occasionally delayed responses. Users note good technical assistance, although many handle challenges independently due to sufficient skills or community resources. Documentation is considered lacking, often requiring self-research or community support. The community version lacks formal support, while paid versions suggest significant improvement. AT&T's focus on cloud services impacts the on-premise documentation and support experience. Overall, users appreciate responsiveness but identify room for improvement.

Deployment

Users' experiences with AlienVault OSSIM's initial setup vary. Some find it straightforward and quick, likening it to installing a Windows program. Others report complexities due to integration challenges, outdated documentation, or lack of team expertise. Network size and infrastructure scale affect deployment time, ranging from minutes to months. Integration with third-party tools and custom configurations for certain network devices may also extend implementation time, especially in large environments.

Scalability

AlienVault OSSIM exhibits varying scalability levels, managing different setups efficiently, from mid-size businesses to small networks. Users highlight its flexible architecture and capability to connect multiple sources, with specific limits noted for enterprise demands. Some experience challenges integrating it with network devices or retaining logs. Others mention its suitability for smaller environments, citing its role as a data collector. While many agree it's scalable, opinions differ on its effectiveness under extensive expansion.

Stability

Most users find AlienVault OSSIM stable, often comparing its performance favorably to Qradar and Splunk. It operates reliably on Linux, without crashing or bugs, provided infrastructure limits are respected. The newest version shows improved performance, though older versions may experience occasional crashes. Stability ratings vary, ranging from moderate to excellent. Some users highlight stability issues with UMS and older versions but newer iterations are deemed highly reliable with proper server configurations.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our AlienVault OSSIM Buyer's Guide for additional reliable information.