LogRhythm NDR vs Vectra AI comparison

Read 42 Vectra AI reviews

8,868 Views
4,434 Comparison Views

97% willing to recommend

LogRhythm NDR

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between LogRhythm NDR and Vectra AI based on real PeerSpot user reviews.

Find out in this report how the two Network Detection and Response (NDR) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed LogRhythm NDR vs. Vectra AI Report (Updated: October 2024).

LogRhythm NDR vs. Vectra AI

Download the complete report

Helped 814,763 peers since 2012

Categories and Ranking

LogRhythm NDR

Ranking in Network Detection and Response (NDR)

16th

Average Rating

8.0

Number of Reviews

Ranking in other categories

No ranking in other categories

Vectra AI

Ranking in Network Detection and Response (NDR)

2nd

Average Rating

8.6

Number of Reviews

Ranking in other categories

Intrusion Detection and Prevention Software (IDPS) (2nd), Extended Detection and Response (XDR) (9th), Identity Threat Detection and Response (ITDR) (5th), AI-Powered Cybersecurity Platforms (4th)

Mindshare comparison

As of November 2024, in the Network Detection and Response (NDR) category, the mindshare of LogRhythm NDR is 0.9%, down from 1.2% compared to the previous year. The mindshare of Vectra AI is 20.2%, up from 19.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Network Detection and Response (NDR)

Featured Reviews

AshishDubey

Product manager at Tata Communications Ltd

Oct 18, 2023

A scalable and stable tool that offers users a great GUI

Though I have not extensively worked on LogRhythm NDR, I know the need for a compute side since, in the past, we had required the compute side to deploy the solution in one of our company's client's infrastructure. The product's setup phase was easy and not complicated. The deployment process of LogRhythm NDR can vary between three and four weeks, depending on the skill set of the people involved in the deployment process. For deployment of the product, you have to purchase the license from LogRhythm, and you have to ensure that the compute side is ready for LogRhythm. After you deploy NDR and sensors in the premises of our company's customer on the SPAN and TAP port, and once the logs go through throughput, you can see the logs coming to LogRhythm NDR's console.

Read full review

Tony Whelton

Director IT at Wellington College

Mar 7, 2023

Integrates well with other security solutions and provides good technical support

The biggest feature for us, because we are heavy Microsoft users, is its integration with Office 365. On top of Vectra AI, we use all of the Microsoft security platforms, such as Defender ATP and Sentinel. Having full integration and a central platform to look at all of the threats that are coming through from the different platforms is a huge benefit for us. With one nice front dashboard, we can look at the high-volume threats rather than all of the noise. We do get a lot of noise as our students all own their own devices. With Vectra AI, we can look at threats in a controlled manner, which saves us an extraordinary amount of time. Even if I doubled the manpower, I doubt that I would still have the same visibility that I have with the correct security platform. Vectra AI's Threat Detection and Response platform has done remarkably well. We're well-versed in using the security dashboard from Microsoft Defender, and we're at the stage where we are checking both. We haven't fully switched to relying on only the Vectra dashboard yet. In terms of Vectra AI Attack Signal Intelligence for empowering security analysts within our organization, we have complete faith in the data that's coming through from Vectra. If we could also have what's happening at the front-end, that is, the firewall, then it would give us the complete security front dashboard.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The solution doesn't require the creation of rules or use cases from scratch, which assists our delivery team in installation and deployment. Its dashboard is user-friendly."

"It's an excellent security tool with a user-friendly interface that's easy for anyone to use."

"It is a stable solution...It is a scalable solution."

"The most valuable feature for Cognito Detect, the main solution, is that external IDS's create a lot of alerts. When I say a lot of alerts I really mean a lot of alerts. Vectra, on the other hand, contextualizes everything, reducing the number of alerts and pinpointing only the things of interest. This is a key feature for me. Because of this, a non-trained analyst can use it almost right away."

"Some valuable features of Vectra AI are that it is very intuitive and that there are only a small amount of false positives. Therefore, it's an effective solution."

"One of the most valuable features of the platform is its ability to provide you with aggregated risk scores based on impact and certainty of threats being detected. This is both applied to individual and host detections. This is important because it enables us to use this platform to prioritize the most likely imminent threats. So, it reduces alert fatigue follow ups for security operation center analysts. It also provides us with an ability to prioritize limited resources."

"Cognito Streams gives you a detailed view of what happens in the network in the form of rich metadata. It is just a super easy way to capture network traffic for important protocols, giving us an advantage. This is very helpful on a day-to-day basis."

"The key feature for me for Detect for Office 365 is that it can also concentrate all the information and detection at one point, the same as the network solution does. This is the key feature for me because, while accessing data from Office 365 is possible using Microsoft interfaces, they are not really user-friendly and are quite confusing to use. But Detect for Office 365 is aggregating all the info, and it's only the interesting stuff."

"One of the key advantages for us is we define a 24/7 service around it. We use far more of Vectra alerts than we do with our SIEM product because we understand that when we get an alert from Vectra we actually need to do something about it."

"Scalability wise, we have many sensors, and Vectra AI seems to handle them all very well."

"Vectra produces actionable data using automation. That has helped us. It's less manpower now to look at incidents, which has definitely increased efficiency. Right now, in a lot of cases, our mean time to detection is within zero days. This tells me by the time something happened, and we were able to detect it, it was within the same day."

More Vectra AI pros

Cons

"From an improvement perspective, I would like LogRhythm NDR to reduce the compute size. I would also like LogRhythm NDR to improve the pricing model."

"There are opportunities for improvement, particularly in upgrading the expertise of local professionals and addressing support issues, which could potentially lead to cost reduction."

"The tool has one limitation compared to its competitors. It does have a mobile app for NDR monitoring. Moreover, there is only operational training and not deployment training."

"Some of their integrations with other sources of data, like external threat feeds, took a bit more work than I had hoped to get integrated."

"The solution has not reduced the security analyst workload in our organization because we still need to SIEM. Unfortunately, while Vectra, for us, is a brilliant tool for network investigations, giving wonderful visibility, it doesn't go the whole way to replace our SIEM that is needed for compliance. So, I still have the same amount of alerting and logging that I did before. It gives us more defined ability to see incidents, but it doesn't give us enough information to satisfy a PCI or 27001 audit."

"We are using SMB 3.0, which is an encrypted protocol. When we get some alerts or something, we cannot go deep into the protocol to see what's wrong because it's encrypted. We need to decrypt the protocol in another way, which is quite difficult. We might go back to SMB 2.0 just for this reason, but that's not a good solution."

"What is most important for us is to have one place where we can manage a few brains because we are based on a zero-trust network. As a result, each customer needs to have a separate brain. For the SOC team, we need to have one place where the SOC analyst can go to visit the website and from that site manage all of the customers. Right now, Vectra AI doesn't have this capability, and I would really like to have this feature."

"There could be an option where Vectra manages the solution remotely, and when there is an attack, there could be a notification center to give us information about the attack."

"Vectra is still limited to packet management. It's only monitoring packet exchanges. While it can see a lot of things, it can't see everything, depending on where it's deployed. It has its limits and that's why I still have my SIEM."

"One of the things that we are missing a bit is the capability to add our own rules to it. At the moment, the tech engine does its thing, but we have some cool ideas to make additional rules. There should be an option in the platform to add custom rules, or there should be some kind of user group where we can suggest them for the roadmap and see if they get evaluated and get transparent communication on whether they will be implemented in the product or not."

"It does a little bit of packet capture on alert so you can look at the packet capture activity going on, but it doesn't collect a whole lot of data. Sometimes it's only one or two frames, sometimes it does collect more. That's why they have the addition of their Recall platform, because that really does help expand the capability."

More Vectra AI cons

Pricing and Cost Advice

"There are certain payments to be made towards the licensing costs attached to the product yearly. The pricing of LogRhythm NDR falls under the mid-range, in my opinion."

"The tool costs are two million rupees for 5000 users."

"When looking at the market and comparing it with other vendors, the cost seems relatively high."

"The pricing is very good. It's less expensive than many of the tools out there."

"Vectra's pricing is too high. All schools will not be able to afford it. Vectra will only end up targeting higher education and higher value independence purely because of the price. A lot of schools would love to have a product like Vectra AI, but they simply can't because they struggle to even pay the high E5 licensing from Microsoft. When you're up against that, Vectra AI is never going to be within the sector's price range."

"My company pays for the Vectra AI licensing fee yearly. I know the figure because my company recently renewed the license, and it's okay, at least for the financial sector."

"Vectra is a bit on the higher side in terms of price, but they have always been transparent. The reason that they are this good is that they invest, so they need to charge accordingly."

"The license is based on the concurrent IP addresses that it's investigating. We have 9,800 to 10,000 IP addresses."

"Vectra AI's pricing is cheaper than that of Darktrace."

"Its cost is too much. It's an investment that we can afford. It's a lot, but it's worth it."

"The solution's pricing was 50 percent lower than the other vendors shortlisted."

More Vectra AI pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Network Detection and Response (NDR) solutions are best for your needs.

See recommendations

814,763 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

32%

Government

Financial Services Firm

Manufacturing Company

Computer Software Company

17%

Financial Services Firm

12%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

Questions from the Community

What do you like most about LogRhythm NDR?

It is a stable solution...It is a scalable solution.

What is your experience regarding pricing and costs for LogRhythm NDR?

The tool costs are two million rupees for 5000 users.

What needs improvement with LogRhythm NDR?

The tool has one limitation compared to its competitors. It does have a mobile app for NDR monitoring. Moreover, there is only operational training and not deployment training.

What is the biggest difference between Corelight and Vectra AI?

The two platforms take a fundamentally different approach to NDR. Corelight is limited to use cases that require the eventual forwarding of events and parsed data logs to a security team’s SIEM or ...

What do you like most about Vectra AI?

The solution is currently used as a central threat detection and response system.

What is your experience regarding pricing and costs for Vectra AI?

The licensing is on annual basis.

Darktrace vs LogRhythm NDR

Comparisons

Compared 72% of the time

Lumu vs LogRhythm NDR

Compared 28% of the time

More LogRhythm NDR Competitors

Darktrace vs Vectra AI

Compared 35% of the time

ExtraHop Reveal(x) vs Vectra AI

Compared 12% of the time

Cisco Secure Network Analytics vs Vectra AI

Compared 6% of the time

Arista NDR vs Vectra AI

Compared 5% of the time

Corelight vs Vectra AI

Compared 5% of the time

More Vectra AI Competitors

Product Reports

Network Detection and Response (NDR)

Download LogRhythm NDR product report

Download Vectra AI product report

Also Known As

LogRhythm MistNet

Vectra Networks, Vectra AI NDR

Learn More

Video not available

LogRhythm

Overview

Securing your network against advanced persistent threats (APTs) requires greater visibility to detect actors and their actions so that you can reduce your response time. As threats increase, real-time network detection and response (NDR) solutions are more critical than ever.

While other NDR solutions rely solely on machine learning (ML) based threat detection, LogRhythm uses hybrid analytics that combine machine learning, rules-based detection, and threat intelligence to analyze network, user, and host activity. This holistic approach provides a true representation of all activity within the enterprise domain, making it possible to detect lateral movement, exfiltration, malware compromise, ransomware, and other threats in real time.

Vectra AI is used for detecting network anomalies and potential malicious activities, providing visibility into network traffic and enhancing threat detection across environments.

Organizations deploy Vectra AI mainly on-premises with additional cloud components. It helps with compliance, incident response, security monitoring, detecting insider threats, and correlating network events. Vectra AI captures and enriches network metadata, provides detailed dashboards, reduces false positives, and supports cross-environment behavioral analysis to enhance threat detection and prioritization. While valued for its high accuracy and alert aggregation, it has room for improvement in UI/UX, packet management, and integration with SIEMs and other tools. It is noted for expensive pricing and limited proactive threat response features.

What are Vectra AI's most valuable features?

High accuracy in identifying threat locations
Aggregation of alerts into single incidents
24/7 threat detection
Visibility into the entire attack lifecycle
Risk score aggregation
Effective triaging of alerts
Integration with other tools

What benefits or ROI should users look for?

Enhanced threat detection and prioritization
Comprehensive network visibility
Reduction in false positives
Better incident response capabilities
Improved compliance monitoring

In specific industries, Vectra AI is deployed to monitor complex networks and alleviate challenges in threat detection. It is particularly effective in sectors requiring stringent compliance and security measures, offering insights and capabilities crucial for protecting sensitive data and maintaining operational integrity.

Sample Customers

EMW, Conduent, University of Massachusetts, Deloitte Canada, Central Bank of Barbados, Coalfire

Tribune Media Group, Barry University, Aruba Networks, Good Technology, Riverbed, Santa Clara University, Securities Exchange, Tri-State Generation and Transmission Association

LogRhythm NDR vs. Vectra AI