AlienVault OSSIM Reviews

Name: AlienVault OSSIM
Brand: AT&T
Rating: 3.7 (31 reviews)

Vendor: AT&T

3.7 out of 5

31 reviews
80% willing to recommend

111 followers

What is AlienVault OSSIM?

AlienVault OSSIM, Open Source Security Information and Event Management (SIEM), provides you with a feature-rich open source SIEM complete with event collection, normalization and correlation. Launched by security engineers because of the lack of available open source products, AlienVault OSSIM was created specifically to address the reality many security professionals face: A SIEM, whether it is open source or commercial, is virtually useless without the basic security controls necessary for security visibility.

Get the AlienVault OSSIM Buyer's Guide and find out what your peers are saying about AlienVault OSSIM, Wazuh, Splunk Enterprise Security and more!

AlienVault OSSIM is the #10 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give AlienVault OSSIM an average rating of 7.4 out of 10. AlienVault OSSIM is most commonly compared to Wazuh: AlienVault OSSIM vs Wazuh. AlienVault OSSIM is popular among the large enterprise segment, accounting for 49% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 17% of all views.

Helped 831,071 peers since 2012

Featured reviews

Aman Aijaz

Assistant Manager Global Security at Convergys Corporation

The area for improvement is a lot. When I started using it on our enterprise side, the issue we faced was, for example, if we were running at that time on AlienVault OSSIM v5.7.4. So, for some orders, we had to install some packages, and when we tried installing that package, some dependencies got upgraded to a new version. Now once that dependency got upgraded, the SQL, since you might be aware that OSSIM uses SQL database, now SQL and all the dependency in everything was not on the same version, and that caused the database to crash. The aforementioned area should be eased out by upgrading the patches and upgrading dependencies. This kind of thing is a disadvantage of OSSIM, and I would like them to work on this. But I have also raised service requests many times and gave it a push on the community section too. However, since it is a local source, they don't reply much over there. That is why I don't like to work on OSSIM because it is unpredictable. Once the storage goes above 50 percent, it starts behaving unpredictably. If you get stuck with a situation, then you need to drill a lockdown into that. Sometimes you get no luck. Then you have to just reimage the server with the new fresh OS of AlienVault. As for additional features, not much because if you move to the newer version, it is kind of getting more stable. But, to make my life easier, then I would say try to give more features. I know it's open source, so they also cannot provide me with more features. But still, if they can provide me with more features because right now it's becoming old. Right now, we are even moving from SIEM to Security Data Lake. So when we move to it, this will be literally outdated. No one can even expect anything out of it. The way security is moving, it will be outdated very soon. They have to also provide something new to keep this going for the future also.

Read full review

HarshBhardiya

SOC Engineer at Just Dial Limited

The solution is not scalable. It impacts so hard. In the initial stages, AlienVault OSSIM can be suitable for small environments. There may be limitations if the customer expresses a desire to expand and add more devices. In such cases, we would need to either explore additional solutions or work within the constraints of the existing setup. We have set up alerts and configured everything in AlienVault OSSIM. It actively monitors for any security incidents. It provides us with regular updates and notifications about any ongoing activities. Only one person is using the solution. It is the perfect solution for small businesses. I rate the solution’s scalability a three out of ten.

Read full review

Intekhab Ahmad.

Senior System and cyber security administration at Tankeenhr

The tool's security detection is good. It helps us with login tracking and generating reports. We aim to identify potential issues, such as brute-force attacks on user accounts or server-level anomalies. For instance, if I receive a report indicating a server is at an abnormal level, I investigate and address the issue. Regular meetings are conducted every ten to twenty days to update network issues. Due to restrictions, users face challenges when accessing WhatsApp from outside Saudi Arabia. To bypass this, they use VPNs. When a user logs into Office 365 via VPN, the system sends me a notification indicating their login.

Read full review

AlienVault OSSIM mindshare

As of January 2025, the mindshare of AlienVault OSSIM in the Security Information and Event Management (SIEM) category stands at 5.0%, up from 3.1% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

PeerAnalyst reports

Type	Title	Date
Category	Security Information and Event Management (SIEM)	Jan 18, 2025	Download
Product	Reviews, tips, and advice from real users	Jan 18, 2025	Download
Comparison	AlienVault OSSIM vs Splunk Enterprise Security	Jan 18, 2025	Download
Comparison	AlienVault OSSIM vs Wazuh	Jan 18, 2025	Download
Comparison	AlienVault OSSIM vs Microsoft Sentinel	Jan 18, 2025	Download

Title	Rating	Mindshare	Recommending
Wazuh	3.7	15.9%	79%	45 interviews Add to research
Splunk Enterprise Security	4.2	10.8%	93%	303 interviews Add to research

Valuable Features

AlienVault OSSIM is praised for its threat alerts, asset discovery, and log collection. The open vault component and vulnerability assessments are valuable, while the dashboard provides centralized visibility. The integration capabilities are efficient, supporting various solutions and offering automation options. Features like inbuilt IDS and threat intelligence integration highlight its effectiveness. User-friendliness, ease of configuration, logging capabilities, and security detection are key strengths. Its free nature and multilayer architecture make it suitable for diverse organizations.

"I recommend it due to the experience of the people running it."
"Network traffic analysis is highly efficient."
"The product is majorly used for threat detection of the agents on servers and endpoints."

Room for Improvement

AlienVault OSSIM requires improvements in integration with cyber intelligence systems and ease of configuration. Users find the interface complex and the log tracing difficult. There are concerns about scalability, false positives, and the need for more dashboard customization. Pricing is considered high and deployment can be challenging. Users desire enhanced threat intelligence, better device integration, and improved user experience. The system struggles under heavy traffic and faces stability issues with on-premise setups.

"The main area where the AlienVault product was lacking around the 2018 timeframe was in its ability to scale."
"There are somewhat more false positives with the user behavior analytics, which could benefit from an additional machine learning model to detect user patterns more rapidly."
"There are somewhat more false positives with the user behavior analytics, which could benefit from an additional machine learning model to detect user patterns more rapidly."

ROI

Users found that AlienVault OSSIM helped reduce time spent on manual log analysis, improved threat detection efficiency, and offered valuable insights into network security. It enhanced compliance reporting and provided cost-effective security management. Some noted that while initial setup required effort, the significant reduction in labor costs and improved threat visibility justified the investment.

Pricing

AlienVault OSSIM offers an open-source version free of charge, making it appealing for budget-conscious enterprises. While additional support and premium features incur costs, many users find it competitively priced when compared to high-end alternatives like IBM or Splunk. Some users mention a high price point for licensing, comparable to Microsoft Sentinel, but others highlight a reasonable return on investment. Those purchasing the non-community edition pay annual licensing fees, with pricing adjusted based on usage and support options.

"I used the paid version of the tool and found it to be expensive. It has been a while since I changed to Securonix. I will have to check whether AlienVault charges per device, user, or log."
"AlienVault OSSIM is expensive compared to its competitors."
"The tool's licensing costs are yearly."

Popular Use Cases

AlienVault OSSIM users employ it for monitoring networks, threat detection, log collection, and incident management. They utilize it for securing traffic and analyzing security events. It supports vulnerability scanning, Network IDS, and local actions. Users in sectors like media and finance leverage AlienVault OSSIM for compliance and event correlation. They benefit from features aiding SOC setups and cyber security for telecommunications. Integration capabilities extend across diverse hardware and operating systems, enhanced by OTX for open-source threat exchange.

Service and Support

AlienVault OSSIM's customer service has mixed evaluations. Some users find support responsive and effective, while others experience significant delays in issue resolution. Paid support gets positive remarks, but those using free versions often rely on community forums. There is inconsistency in documentation and availability of support for on-premises operations, as AT&T emphasizes cloud solutions. Users highlight the option for US-based support at an additional cost and mention minimal training during implementation.

Deployment

Initial setup of AlienVault OSSIM varies in complexity. Some find it straightforward, requiring minimal time and resources, while others report challenges due to infrastructure size or integration needs. Virtualization issues are noted, with workarounds needed. Lack of up-to-date documentation or training can complicate deployment, though the availability of recent documentation aids configuration. Deployment duration ranges from hours to months, influenced by network complexity and organizational expertise. Integration with third-party tools extends implementation time.

Scalability

AlienVault OSSIM has varied scalability feedback. Some mention it is quite scalable, adaptable with a flexible architecture, while others find it limiting for larger enterprises. It supports mid-sized businesses effectively but may face challenges with extensive expansions. Users have noted integration issues and scalability limits, with mixed scores reflecting both strengths and weaknesses. Many use it successfully within capacity, but for substantial scaling, they may consider external solutions.

Stability

AlienVault OSSIM is stable with some experiencing high reliability, comparing it favorably to other platforms like Qradar and Splunk. Many rate its stability positively, though some note potential issues with older versions and server configurations. Most users do not encounter bugs or crashes. The open-source version has certain limitations but remains dependable when adhering to its restrictions. Some face minor stability concerns, while current versions are seen as improved in performance.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our AlienVault OSSIM Buyer's Guide for additional reliable information.