Try our new research platform with insights from 80,000+ expert users

LogRhythm SIEM vs Trellix ESM comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 18, 2024
 

Categories and Ranking

LogRhythm SIEM
Ranking in Security Information and Event Management (SIEM)
6th
Average Rating
8.4
Reviews Sentiment
6.5
Number of Reviews
172
Ranking in other categories
Log Management (10th)
Trellix ESM
Ranking in Security Information and Event Management (SIEM)
22nd
Average Rating
7.4
Number of Reviews
36
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of November 2024, in the Security Information and Event Management (SIEM) category, the mindshare of LogRhythm SIEM is 3.3%, down from 4.5% compared to the previous year. The mindshare of Trellix ESM is 0.8%, down from 1.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM)
 

Q&A Highlights

AS
May 07, 2015
 

Featured Reviews

Joseph W. - PeerSpot reviewer
Oct 18, 2022
Has pre-built pieces for third party vendors and does not take a long time to implement
One of the main features that I like about LogRhythm SIEM is that there are a lot of pre-built pieces. Like with our AV, we didn't have to tell it how to read the logs; they already had it pre-made. So, we essentially just had to follow their guide to get the logs imported in and set up some rules for it. We've only had to manually create the parsing rules for a few of our vendors so that we could interpret the logs correctly. Most of them had already been pre-created for us. We use the Event Log Filtering feature a lot. We use it for simple troubleshooting tasks like when a user is logged out, to more important tasks like trying to investigate a threat. As far as its effect on productivity, we can go and search instead of trying to troubleshoot and guess what is causing an error. We can identify what the program is or where the hiccup is. LogRhythm helped us to identify a lot of blind spots. Originally, we didn't have a SIEM tool. We had auditors say that this is something that we should be doing. My management team asked me to go and find a product, and I researched a bunch of them and found LogRhythm. It really opened our eyes to see how much traffic we have, whether it's other IP addresses that are scanning us or external users trying to hit certain ports that could then get closed. It helped us tighten down some of those firewall rules that may have been left open unintentionally through other changes. It helped us a lot early on to identify who was trying to communicate with us or, essentially, who was trying to attack us. As far as our overall security posture, our SIEM tool was the initial push that really got us going into identifying where all of our threats were. We expanded over the seven years that we've had it, and I implemented at least eight other products that are all security related because the SIEM tool indicated the need to identify other risks. It really helped us as an organization to identify risks and move forward to a more secure environment.
Daniel Durian - PeerSpot reviewer
Aug 19, 2024
Helps to monitor and detect cyberattacks
I use Trellix ESM to monitor inbound communication from known threat hosts and detect cyberattacks. It's also useful for outbound communication, but we block threat communication via a firewall The tool's effectiveness depends on how you define your log sources. To build visibility of incoming…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"LogRhythm NextGen SIEM covers all our primary security analysis needs. It makes it easier for us to analyze threats and improves our response times. It's a versatile platform that performs queries fast compared to other SIEM solutions."
"The dashboards in the LogRhythm SIEM really help us as a starting point. It gives us a starting point we can go to every day. We walk through several dashboards to see anomalous activity for further investigation."
"Their customer support is friendly and willing to help."
"The PCI compliance pieces that help us produce reports for our external auditor, and their support."
"Technical support is very helpful and responsive."
"I find LogRhythm's log management capabilities to be beneficial."
"We use this solution to examine disparate log sources and provide a cohesive method to search for anomalous behavior."
"What I found most valuable in LogRhythm NextGen SIEM is that it's user-friendly. I also like its dashboard, which shows all the logs and information I want to see."
"The most valuable feature is that if the scanning does find something, it quarantines it. Then you can decide what you are going to do with it."
"It is easy to use."
"The support I have received from the vendor has been great."
"It is user-friendly. The notification part of McAfee ESM is very easy."
"The solution is 100% stable. We really have had a great time working with it. It hasn't let us down."
"Trellix ESM is very user-friendly."
"The product’s most valuable feature is log monitoring."
"The most valuable feature in ESM is its search and reporting feature. It's really nice."
 

Cons

"In the next release, I would certainly like to see more HIPAA compliance. I would also like to see more integration with Palo Alto Networks, particularly their Traps, which is their endpoint solution."
"I would like to suggest that they should improve their usage of third party tools for making dashboards and reports. If they would create their own tools for dashboard and report, it would be much better in terms of security purposes."
"The reporting on the dashboard should be improved from a management perspective. It would be helpful if they adjusted the colors and the presentation to make things clearer and easier to read."
"We've tried to work with a couple of engineering department guys there. We've called them and called them but we never hear anything back."
"LogRhythm's SOAR and NDR features don't stack up well against competitors. maybe integrating theme functionality as the other do. But in general, it's okay."
"We're still struggling to get a real return on it and finding something that isn't false noise."
"The user interface needs improvement. The more the user can slide around and know what's going on, the better it will be."
"I think they probably need to, because a lot of companies are having this cloud-first strategy, where anything that's new has to go into the cloud for some reason."
"There's no software support from McAfee."
"We acquired the IBM product because McAfee is slightly confusing to use, and it's broader."
"The support from McAfee ESM could improve. They could improve the speed."
"The initial setup is difficult and could improve."
"We cannot add new data sources to the most recent version."
"I would like to see improvements to the user interface."
"Product currently requires Flash."
"McAfee is no more providing security updates on this product, and the enhancements to this product seem to have stopped. Moreover, we don't get proper support, and we struggle to get its support. It would be good if they can add some AI engine and out of the box use cases because it is currently limited to the same scenario and the same setup. I have done a POC for Securonix, LogRhythm. These products are much more ahead as compared to McAfee ESM. They have included multiple modules in the same solution. Correlation is very easy. If McAfee ESM can improve, especially in such implementations, then I believe it would be much better."
 

Pricing and Cost Advice

"The pricing is very reasonable and accessible compared to other products in the market but I am not very sure about the exact licensing cost per year for our company."
"On a scale of one to ten, I'd rate the pricing of this solution as a seven - not too expensive but not cheap either. Regarding licensing costs, it varies depending on factors like being a partner or an end user, but there are no additional costs aside from standard licensing fees for the basic SIEM solution."
"We did a five-year agreement. We pay close to a quarter of a million dollars for our solution."
"The setup and licensing for small and medium size businesses is straightforward, though when it comes to the enterprise it pays to keep in mind the possibility for complications given all the extras and add-ons that may be required."
"When it comes time to renew, they say, "This is what you are using. This is what we can do for you." So, they work with you on pricing."
"Everything is expensive with LogRhythm, and you don't get anything for free."
"If you don't have your staff, absolutely look into the co-pilot and factor that into your cost evaluation."
"I have seen a measurable decrease in the mean time to detect and respond to threats. We went from not detecting them to detecting them. We can actually pick up what is anomalous in our network now."
"When compared to IBM Security QRadar and other similar platforms, the pricing of McAfee ESM is reasonable and comparatively less expensive."
"The pricing is good, and they are competitive compared to providers such as RSA and IBM QRadar."
"You should buy the distributed option instead of the all-in-one for environments with more than 1000 end points."
"We renew our license annually."
"The cost is all included. The finance department handles the financial part, and we mostly don't get involved in it."
"Regarding pricing, Trellix ESM is not that expensive. It's less than half the cost of IBM QRadar."
"The licensing cost is based on EPS."
"The pricing is fair."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
814,649 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Answers from the Community

AS
May 7, 2015
May 7, 2015
Hello , As someone who worked with Splunk, Arcsight and Qradar. I am sorry but you cant compare between those two . IBM QRADAR works great with 100 eps and with 100000 eps. IBM Qradar analyze not only logs but Traffic, Policey's, Vulnerabilities, OSINT Data and integrates them all into a single quilty event which made the analysis factor and easter Risk management Risk assessment. Even in an SM...
2 out of 6 answers
it_user123231 - PeerSpot reviewer
Jun 25, 2014
Its is now an easy and clear answer. It depends on the environment, the integration needed, and the staff expertise. IBM is usually a better solution for large/very large installations and integration. But it requires much more staff and skills. But for smaller environments Splunk and LogRhytm is better. McAfee is correctly rated against others. So the answer is YES/AGREE for large installations. And NO/DISAGREE for smaller ones.
it_user114555 - PeerSpot reviewer
Jun 25, 2014
Hi, I disgree for SME installation since Q1 is usually on a large scale installation. While expertise on the product is still needed including integration with other security platforms. Splunk/LogRythm is good for Network correlation only not focusing much on the security area. McAfee is ok for both SME and Enterprise whilst expertise should also be considered as they have an easy and available tool for integration with their ticketing system, IPS, and AV. Hope this helps. Cheers, Lilet
 

Top Industries

By visitors reading reviews
Educational Organization
43%
Computer Software Company
9%
Government
6%
Financial Services Firm
6%
Educational Organization
74%
Financial Services Firm
4%
Computer Software Company
4%
Government
3%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What is the difference between log management and SIEM?
Rony, Daniel's answer is right on the money. There are many solutions for each in the market, a lot depends upon your ability to manage such tools and your budget. A small operation may be best s...
What do you like most about LogRhythm NextGen SIEM?
LogRhythm does a very good job of helping SOCs manage their workflows.
What is your experience regarding pricing and costs for LogRhythm NextGen SIEM?
LogRhythm's pricing and licensing are extremely competitive and it's one of the top three reasons we continue to invest in the platform.
What do you like most about McAfee ESM?
The solution's technical support is great.
What is your experience regarding pricing and costs for McAfee ESM?
Regarding pricing, Trellix ESM is not that expensive. It's less than half the cost of IBM QRadar.
What needs improvement with McAfee ESM?
The product is mature and needs little improvement, but we could enhance the customized dashboarding based on use cases.
 

Also Known As

LogRhythm NextGen SIEM, LogRhythm, LogRhythm Threat Lifecycle Management, LogRhythm TLM
McAfee ESM, NitroSecurity, McAfee Enterprise Security Manager
 

Learn More

Video not available
 

Overview

 

Sample Customers

Macy's, NASA, Fujitsu, US Air Force, EY, Abbott, HD Supply, SAB Miller, UCLA, Raytheon, Amtrak, Cargill
San Francisco Police Credit Union, Wªstenrot Gruppe, Volusion, California Department of Corrections & Rehabilitation, Government of New Brunswick, State of Colorado, Macquarie Telecom, Texas Tech University Health Sciences Center, Cologne Bonn Airport
Find out what your peers are saying about LogRhythm SIEM vs. Trellix ESM and other solutions. Updated: October 2024.
814,649 professionals have used our research since 2012.