LogRhythm UEBA vs Vectra AI comparison

Read 44 Vectra AI reviews

4,587 Views
2,383 Comparison Views

97% willing to recommend

LogRhythm UEBA

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

Vectra AI and LogRhythm UEBA are competing products in the cybersecurity domain. Vectra AI seems to have the upper hand in user satisfaction with features and deployment ease, while LogRhythm UEBA shines in pricing and ROI benefits.

Features: Vectra AI offers advanced threat detection powered by AI, efficient automation, and real-time threat response. LogRhythm UEBA provides robust analytics, comprehensive incident response, and detailed reporting functions.

Room for Improvement: Vectra AI users suggest improving usability, adding better integration capabilities, and enhancing interface design. LogRhythm UEBA users highlight the need for performance upgrades, improved interface, and faster processing speeds.

Ease of Deployment and Customer Service: Vectra AI is noted for straightforward deployment and effective customer support, ensuring a smooth setup. LogRhythm UEBA offers flexible deployment models but faces challenges in deployment speed and support response times.

Pricing and ROI: Vectra AI is known for competitive setup costs with a satisfactory ROI. LogRhythm UEBA, though initially more expensive, provides a positive ROI over time, making it a valuable investment for users with its extensive features.

To learn more, read our detailed LogRhythm UEBA vs. Vectra AI Report (Updated: March 2025).

LogRhythm UEBA vs. Vectra AI

March 2025

Download the complete report

Helped 846,617 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

LogRhythm UEBA

Ranking in Extended Detection and Response (XDR)

25th

Average Rating

7.0

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

User Entity Behavior Analytics (UEBA) (11th)

Vectra AI

Ranking in Extended Detection and Response (XDR)

15th

Average Rating

8.6

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Intrusion Detection and Prevention Software (IDPS) (3rd), Network Detection and Response (NDR) (2nd), Identity Threat Detection and Response (ITDR) (10th), AI-Powered Cybersecurity Platforms (6th)

Mindshare comparison

As of April 2025, in the Extended Detection and Response (XDR) category, the mindshare of LogRhythm UEBA is 1.1%, up from 1.0% compared to the previous year. The mindshare of Vectra AI is 3.4%, up from 3.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Extended Detection and Response (XDR)

Featured Reviews

Sheikh Abu Ayub Azad

CEO at Trustaira

Great at managing cyber incidents; the technical support could be improved

The initial setup is easy, partly because LogRhythm is primarily based on the Windows platform. It's good to have two engineers for deployment but it can be done with one. It's more about the knowledge. Deployment is typically done in two or three different phases. It usually takes up to three full months to get good deployment. There's the initial onboarding of all the log sources, then collecting data in the data lake, followed a couple of weeks later with some minor tuning before the final tuneup.

Read full review

Mohammad Alkurdi

Owner at Fortibits

Innovative detection features enhance monitoring

The advantages of the integration are not entirely out-of-the-box. You have to do it manually. When I'm doing tier response, an out-of-the-box solution is not available. You need to have a Linux server, and from the Linux server, you must perform AI tasks, and there is a lot to be handled in the back end. This is a major consideration about them. The recall feature, if it can be placed in some areas instead of the cloud, and charged for, would be better. Recall the storage where you watch all the traffic, and you can recall it and try to analyze it in the back end. It’s cloud-based. If they offer it on-prem, it would be better. I think they have a solution, but I have never tested it, to be honest with you.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I can investigate attacks more quickly using machine learning tools."

"LogRhythm UEBA’s best feature is the dashboard. It provides several graphs, charts, and event logs."

"What I like most about LogRhythm UEBA is that it allows you to identify and analyze end-user behaviors and suspicious activities within the systems."

"Good capability pinpointing specific cyber incidents."

"It is easy to monitor users and that is how the solution is adding value to our firm."

"It has a lot of features. It has file integration monitoring."

"The solution's most valuable features are the graphical user interface and the reporting."

"The most valuable features are file activity monitoring and registry activity monitoring."

More LogRhythm UEBA pros

"The packet-capturing feature is very useful."

"The most useful feature is the anomaly detection because it's not signature-based. It picks up the initial part of any attack, like the recon and those aspects of the kill chain, very well."

"The most valuable feature for Cognito Detect, the main solution, is that external IDS's create a lot of alerts. When I say a lot of alerts I really mean a lot of alerts. Vectra, on the other hand, contextualizes everything, reducing the number of alerts and pinpointing only the things of interest. This is a key feature for me. Because of this, a non-trained analyst can use it almost right away."

"The core product provides excellent visibility, but my favorite feature is Vectra Recall."

"The UI is easy to use and when we send detection to everybody, they easily understand what we are asking at the time."

"The biggest feature for us, because we are heavy Microsoft users, is its integration with Office 365. On top of Vectra AI, we use all of the Microsoft security platforms, such as Defender ATP and Sentinel. Having full integration and a central platform to look at all of the threats that are coming through from the different platforms is a huge benefit for us."

"It gives you access, with Recall, to instant visibility into your network through something like a SIEM solution. For us, being able to correlate all of this network data without having to manage it, has provided immediate value. It gives us the ability to really work on the stuff where I and my team have expertise, instead of having to manage a SIEM solution..."

"The solution's ability to reduce alerts, by rolling up numerous alerts to create a single incident or campaign, helps in that it collapses all the events to a particular host, or a particular detection to a set of hosts. So it doesn't generate too many alerts. By and large, whatever alerts it generates are actionable, and actionable within the day."

More Vectra AI pros

Cons

"The on-premises LogRhythm is not very scalable. When considering packets per second or the MPS needed for additional logs such as web application logs, scalability is usually found in cloud products."

"What needs improvement in LogRhythm UEBA is the pricing. Here in Asia, for example, in Sri Lanka, pricing is the primary concern, and this is the only area for improvement I see in the product."

"The product should improve its dashboards. Splunk has neat dashboards. Additionally, we would like to enhance the use cases provided by LogRhythm as its use case library is not as extensive as other tools. Its machine-learning capabilities need to improve when compared to other solutions. It lacks risk quantification in a single, transparent view for individuals such as CSOs."

"In general, if something needs to be improved in the algorithm, it would be the dashboards."

"It would be helpful if there were more guidance provided for integrating with unsupported devices."

"The search feature needs to be improved."

"The product could be user-friendly for someone who doesn’t have any prior experience working with it."

"The cloud version is lacking and not up to par."

More LogRhythm UEBA cons

"We have had a few issues with the integration of Vectra AI with EDR. Some filters have not been working. We've also had issues with the brain not being powerful enough."

"They use a proprietary logging format that is probably 90% similar to Bro Logs. Their biggest area of improvement is finishing out the remaining 10%. That 10% might not be beneficial to their ML engine, but that's fine. The industry standard is Zeek Logs or Bro Logs, or Bro or Zeek, depending on how old you are. While they have 90% of those fields, they're still missing some fields. In very rare instances, some community rules do not have the fields that they need, and we had to modify community rules for our logs. So, their biggest area of improvement would be to just finish their matching of the Zeek standard."

"There is room for improvement in the documentation. We would like to have more details on how it detects what we see."

"An area for improvement in Vectra AI is reporting because it currently needs some details. For example, when you download a report from Vectra AI, you won't see complete information about the alerts or triggers. Another area for improvement in the tool is that sometimes, an alert has high severity, yet it's marked as low severity. Vectra AI should have a mechanism to change the severity level from low to high or critical."

"I'd like to be able to get granular reports and to be able to output them into formats that are customizable and more useful. The reporting GUI is lacking."

"Neither Vectra nor Darktrace have a function like a status health check on my log sources and traffic sources."

"Other alternatives, like Darktrace, have a fancier UI."

"The solution needs to become more proactive. When Vectra AI is the primary solution in an environment - like it is in our case - you must work on response time. We have a small team so response time at endpoint level is vital."

More Vectra AI cons

Pricing and Cost Advice

"Licensing is on a yearly basis. It's not expensive compared to its competitors."

"I rate the product's pricing a three out of ten. However, the cloud version is expensive. You need to hire professional services for deployment and migrations, which can be expensive."

"As LogRhythm UEBA is pretty expensive, I'd give its pricing a seven out of ten."

"It is quite a budget-friendly product."

"LogRhythm UEBA's pricing is affordable for small and medium businesses."

"The pricing is nice when compared to other products in the industry."

"From a licensing perspective, the Vectra detect platform is pretty doable. Also, the hardware prices are nothing that we're not used to. The stream part is a little overpriced compared to the detect part. The reason is that you need to stream data to detect events anyway, so the data is in there. The only thing that's not available is the UI to be able to look at the stream data, which is also on the appliances but is just not activated. That's mainly the thing that we want to improve on."

"Vectra's licensing model could scale to our research network, which has multiple, 100-gigabit links."

"The pricing is high."

"The upfront pricing model that we have would have been more beneficial if it had been a recurring license fee, but that wasn't a massive issue for us. It's fairly priced."

"The solution's pricing was 50 percent lower than the other vendors shortlisted."

"We are running at about 90,000 pounds per year. The solution is a licensed cost. The hardware that they gave us was pretty much next to nothing. It is the license that we're paying for."

"The pricing is very good. It's less expensive than many of the tools out there."

"Their licensing model is antiquated. I'm not a fan of their licensing model. We have to pay for licensing based on four different things. You have to pay based on the number of unique IPs, the number of logs that we send through Recall and Stream, and the size of our environment. They need to simplify their licensing down to just one thing. It should be based on the amount of data, the number of devices, or something else, but there should be just one thing for everything. That's what they need to base their licensing on. Cost-wise, they're not cheap. They were definitely the most expensive option, but you get what you pay for. They're not the cheapest option."

More Vectra AI pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.

See recommendations

846,617 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

19%

Financial Services Firm

11%

Manufacturing Company

Real Estate/Law Firm

Financial Services Firm

13%

Computer Software Company

13%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about LogRhythm UserXDR?

The solution is useful for privilege accounts and super admin accounts. It is beneficial from a security perspective. The tool uses machine learning rather than threshold-based alerts. For instance...

What is your experience regarding pricing and costs for LogRhythm UserXDR?

I rate the product's pricing a three out of ten. However, the cloud version is expensive. You need to hire professional services for deployment and migrations, which can be expensive.

What needs improvement with LogRhythm UserXDR?

In general, if something needs to be improved in the algorithm, it would be the dashboards. The dashboards with solutions such as Splunk are very neat and clean. I would also like to improve the us...

What is the biggest difference between Corelight and Vectra AI?

The two platforms take a fundamentally different approach to NDR. Corelight is limited to use cases that require the eventual forwarding of events and parsed data logs to a security team’s SIEM or ...

What do you like most about Vectra AI?

The solution is currently used as a central threat detection and response system.

What is your experience regarding pricing and costs for Vectra AI?

It is very acceptable when you compare it with Darktrace, for example.

Darktrace vs LogRhythm UEBA

Comparisons

Wazuh vs LogRhythm UEBA

Compared 46% of the time

Compared 19% of the time

Cortex XDR by Palo Alto Networks vs LogRhythm UEBA

Compared 9% of the time

CrowdStrike Falcon vs LogRhythm UEBA

Compared 7% of the time

Microsoft Purview Insider Risk Management vs LogRhythm UEBA

Compared 7% of the time

More LogRhythm UEBA Competitors

Darktrace vs Vectra AI

Compared 32% of the time

ExtraHop Reveal(x) vs Vectra AI

Compared 11% of the time

Corelight vs Vectra AI

Compared 6% of the time

Cisco Secure Network Analytics vs Vectra AI

Compared 6% of the time

Arista NDR vs Vectra AI

Compared 6% of the time

More Vectra AI Competitors

Product Reports

User Entity Behavior Analytics (UEBA)

April 2025

Download LogRhythm UEBA product report

Download Vectra AI product report

March 2025

Also Known As

LogRhythm UserXDR, LogRhythm Enterprise UEBA

Vectra Networks, Vectra AI NDR

Overview

LogRhythm UEBA enables your security team to quickly and effectively detect, respond to, and neutralize both known and unknown threats. Providing evidence-based starting points for investigation, it employs a combination of scenario analytics techniques (e.g., statistical analysis, rate analysis, trend analysis, advanced correlation), and both supervised and unsupervised machine learning (ML).

LogRhythm

Vectra AI is used for detecting network anomalies and potential malicious activities, providing visibility into network traffic and enhancing threat detection across environments.

Organizations deploy Vectra AI mainly on-premises with additional cloud components. It helps with compliance, incident response, security monitoring, detecting insider threats, and correlating network events. Vectra AI captures and enriches network metadata, provides detailed dashboards, reduces false positives, and supports cross-environment behavioral analysis to enhance threat detection and prioritization. While valued for its high accuracy and alert aggregation, it has room for improvement in UI/UX, packet management, and integration with SIEMs and other tools. It is noted for expensive pricing and limited proactive threat response features.

What are Vectra AI's most valuable features?

High accuracy in identifying threat locations
Aggregation of alerts into single incidents
24/7 threat detection
Visibility into the entire attack lifecycle
Risk score aggregation
Effective triaging of alerts
Integration with other tools

What benefits or ROI should users look for?

Enhanced threat detection and prioritization
Comprehensive network visibility
Reduction in false positives
Better incident response capabilities
Improved compliance monitoring

In specific industries, Vectra AI is deployed to monitor complex networks and alleviate challenges in threat detection. It is particularly effective in sectors requiring stringent compliance and security measures, offering insights and capabilities crucial for protecting sensitive data and maintaining operational integrity.

Sample Customers

Information Not Available

Tribune Media Group, Barry University, Aruba Networks, Good Technology, Riverbed, Santa Clara University, Securities Exchange, Tri-State Generation and Transmission Association