USM Anywhere vs Wazuh comparison

Read 45 Wazuh reviews

34,744 Views
20,524 Comparison Views

79% willing to recommend

USM Anywhere

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 18, 2024

USM Anywhere and Wazuh compete in the security platform category. USM Anywhere has the upper hand in pricing and support, while Wazuh leads in features and flexibility.

Features: USM Anywhere is valued for its comprehensive threat detection, automated response capabilities, and integrated threat intelligence. Wazuh is praised for its extensive integrations, flexibility, and open-source nature.

Room for Improvement: USM Anywhere users need a more intuitive configuration process, enhanced reporting capabilities, and simplified user experience. Wazuh users wish for better documentation, a more streamlined setup process, and improved installation ease.

Ease of Deployment and Customer Service: USM Anywhere is noted for easy and efficient deployment, supported by responsive customer service. Wazuh's deployment is more complex but offers beneficial customization possibilities, with customer service that can be less responsive.

Pricing and ROI: USM Anywhere users find pricing reasonable with notable ROI due to operational efficiencies. Wazuh, being open-source, offers a cost-effective solution but requires more time in customization.

To learn more, read our detailed USM Anywhere vs. Wazuh Report (Updated: December 2024).

Download the complete report

USM Anywhere vs. Wazuh

December 2024

Helped 824,053 peers since 2012

Categories and Ranking

USM Anywhere

Ranking in Log Management

37th

Ranking in Security Information and Event Management (SIEM)

29th

Average Rating

8.4

Reviews Sentiment

6.9

Number of Reviews

115

Ranking in other categories

Endpoint Detection and Response (EDR) (52nd), Compliance Management (12th)

Wazuh

Ranking in Log Management

2nd

Ranking in Security Information and Event Management (SIEM)

2nd

Average Rating

7.4

Reviews Sentiment

6.6

Number of Reviews

Ranking in other categories

Extended Detection and Response (XDR) (3rd)

Mindshare comparison

As of December 2024, in the Log Management category, the mindshare of USM Anywhere is 0.5%, down from 1.7% compared to the previous year. The mindshare of Wazuh is 17.0%, up from 13.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Omer Jamil

Supervisor, Security Operations at Bpm

An easy-to-deploy tool that needs to improve its vulnerability scanning feature

To those who plan to use the solution, I would suggest that they go through the documentation and online training models available for free, as it can help you deploy the product quickly while also being helpful in areas where there is a need to understand correlation and monitoring. I rate the overall product a seven out of ten.

Read full review

AKASH MAJUMDER

SOC Analyst at Ovelosec

Open-source platform with custom alerting

There are three key strengths of Wazuh that stand out to me. Firstly, Wazuh offers an enhanced HDR version that outperforms the Elastic Stack. Wazuh has achieved this by running a config or a sec in the background, which has improved the XBR for endpoint security significantly. Secondly, Wazuh comes with built-in frameworks, such as the NISC and ISO, that make it easy to comply with various industry standards. We didn't need to configure any custom frameworks for this, as Wazuh had it built in. Lastly, Wazuh has the ability to collect terabytes of data within seconds, which is a crucial feature for modern enterprises dealing with large amounts of data.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"AlientVault has helped us in improving our visualization and incident response during cybersecurity situations."

"The solution also provides basic log storage options for periods of 15, 30, and 90 days."

"In terms of monitoring, my best feature would be the monitoring of components across the network. It monitors the respective nodes and any new node that comes onto the network and provides reports. The reporting dashboards are really helpful for management in terms of making decisions around patch management."

"Our main focus was intrusion detection, alerts, and correlation. It's easy to use AlienVault and integrate it with other alert tools because it includes lots of connectors. Either the tool is already there, or AlienVault will write an API for us if they don't have a connector for the solution that is providing the logs."

"The USM is a work horse, no matter what devices or the number of logs we throw at it, the system processes them in real time, correlates the events, and alerts on only events that need human review."

"I can easily check (in one place) all the logs and data in relation to attacks. It also gives me an overview if a server is not configured properly."

"It has allowed us to see what is happening on our servers."

"The AlienVault solution has enabled us to create a SOC on a budget with smaller than usual staff requirements, offering a wider range of solutions for our customers."

More USM Anywhere pros

"It's stable."

"We use it to find any aberration in our endpoint devices. For example, if someone installs a game on their company laptop, Wazuh will detect it and inform us of the unauthorized software or unintended use of the devices provided by the company."

"It's very easy to integrate Wazuh with other environments, cloud applications, and on-prem applications. So, the advantage is that it's easy to implement and integrate with other solutions."

"The log monitoring and analysis tools are great in addition to SIEM file activity monitoring."

"The deployment is easy and they provide very good documentation."

"The MITRE ATT&CK correlation is most valuable."

"Wazuh is simple to use for PCI compliance."

"Wazuh's most valuable features include file monitoring and compliance reporting, which do not require excessive costs."

More Wazuh pros

Cons

"The reporting is mediocre and is something that needs to be improved."

"The lack of mature functionality and expertise in any of those areas is a strong negative."

"The reporting tools are a bit lacking for building reports to give directly to customers, but support has been helpful in giving our requests for new features to the development team and following up with us."

"There is room for improvement in Log parsing."

"The reporting aspect could be improved. While there are a lot of different options available, there are still pieces which are missing."

"Adding a parsing interface for the customers would make AT&T AlienVault USM better."

"There could be some type of integration with our existing portal. We have our own customer portals, and it would be good if there was an integration so that our portal can provide reports. There could be some type of API into the AlienVault system with the USM system so that it is easy to show the customers high-level reports of the system through our portal."

"The solution already has quite good tools, however, they need better integration tools for linking with Office 365, Google Suite, and so on."

More USM Anywhere cons

"So far, the recent updates have addressed most challenges we previously faced."

"The biggest part that's missing is threat intelligence. It isn't inbuilt, and if a sudden incident occurs, we don't get that feedback inside the SIEM tool. That's a big gap, I see. It would be better if we could get the threat intelligence feeds integrated with the SIEM tools. That would help us push value solutions to the clients in a big way."

"Alerts should be specific rather than repeatedly triggered by integrating multiple factors. This issue needs improvement to create a more efficient alert system."

"The support team could be more responsive and provide quicker replies during our working hours in Indonesia, which would be a significant improvement."

"An issue I noticed is with tag values in certain rules not functioning properly."

"Scalability is a challenge because it is distributed architecture and it uses Elastic DB. Their Elastic DB doesn't allow open source waste application."

"We would like to see more improvements on the cloud."

"The support channel is not optimal, and extensive research is required on our part to implement Wazuh effectively."

More Wazuh cons

Pricing and Cost Advice

"AT&T AlienVault USM is an expensive solution and we pay for the license and the support separately. We paid for the license and support for three years."

"QRadar, ArcSight and Splunk are some of the most expensive SIEM products out there in the market and not everyone has the budget to buy them. In such cases, AV USM is a very cost effective alternative."

"Pricing is very competitive with other products and you get much more functionality from AlienVault."

"They charge a license based on the storage. ATT AlienVault USM is a less expensive solution than IBM QRadar."

"It has good pricing."

"The price for this solution is very good, but since the features do not work the price is expensive."

"We pay around $12,000 a year including storage."

"It's very reasonably priced. It was one of the lowest among the ones I looked at. Licensing is pretty flexible. They can do a two-year or a three-year, even a one-year, perhaps."

More USM Anywhere pricing and cost advice

"We use the free version of Wazuh."

"When I contacted customer care, they mentioned bundling options, that I found to be overall affordable."

"The product is cheaper compared to other tools."

"My client uses the open-source version of Wazuh."

"The current pricing is open source."

"Wazuh is open-source, therefore it is free. You can purchase support for $1,000 a year."

"It is a cost-effective solution."

"Wazuh is a good tool, but the open-source version has scalability limitations."

More Wazuh pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

824,053 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

18%

Educational Organization

Financial Services Firm

Comms Service Provider

Computer Software Company

16%

Comms Service Provider

University

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about AT&T AlienVault USM?

The most valuable feature of the solution is the ease of deployment that it provides to users. The integrations that the product has with third-party applications are useful.

What is your experience regarding pricing and costs for AT&T AlienVault USM?

The pricing is amazing and really cheap.

What needs improvement with AT&T AlienVault USM?

There are scalability issues due to a 60 TB limit, which restricts its use for large customers like banks. It is also limited when used with bigger products and has complex password requirements.

What do you like most about Wazuh?

Integrates with various open-source and paid products, allowing for flexibility in customization based on use cases.

What needs improvement with Wazuh?

I am investigating more about the community support for Wazuh. I can't provide a definitive answer yet. An issue I noticed is with tag values in certain rules not functioning properly. It's unclear...

What is your primary use case for Wazuh?

I am currently evaluating and using Wazuh for file monitoring and compliance reporting. We are in the process of conducting a POC to understand how the rules work. I lead this effort to explore and...

AlienVault OSSIM vs USM Anywhere

Comparisons

Compared 18% of the time

Splunk Enterprise Security vs USM Anywhere

Compared 10% of the time

Rapid7 InsightIDR vs USM Anywhere

Compared 9% of the time

IBM Security QRadar vs USM Anywhere

Compared 8% of the time

CrowdStrike Falcon vs USM Anywhere

Compared 8% of the time

More USM Anywhere Competitors

Security Onion vs Wazuh

Compared 16% of the time

AlienVault OSSIM vs Wazuh

Compared 9% of the time

Elastic Stack vs Wazuh

Compared 9% of the time

Elastic Security vs Wazuh

Compared 9% of the time

Graylog vs Wazuh

Compared 5% of the time

More Wazuh Competitors

Product Reports

Download USM Anywhere product report

USM Anywhere

November 2024

Download Wazuh product report

November 2024

Also Known As

AT&T AlienVault USM, AlienVault, AlienVault USM, Alienvault Cybersecurity

No data available

Learn More

Video not available

LevelBlue

Overview

USM Anywhere centralizes security monitoring of networks and devices in the cloud, on premises, and in remote locations, helping you to detect threats virtually anywhere.

Discover

Network asset discovery
Software & services discovery
AWS asset discovery
Azure asset discovery
Google Cloud Platform asset discovery

Analyze

SIEM event correlation, auto-prioritized alarms
User activity monitoring
Up to 90-days of online, searchable events

Detect

Cloud intrusion detection (AWS, Azure, GCP)
Network intrusion detection (NIDS)
Host intrusion detection (HIDS)
Endpoint Detection and Response (EDR)

Respond

Forensics querying
Automate & orchestrate response
Notifications and ticketing

Assess

Vulnerability scanning
Cloud infrastructure assessment
User & asset configuration
Dark web monitoring

Report

Pre-built compliance reporting templates
Pre-built event reporting templates
Customizable views and dashboards
Log storage

Wazuh is an enterprise-ready platform used for security monitoring. It is a free and open-source platform that is used for threat detection, incident response and compliance, and integrity monitoring. Wazuh is capable of protecting workloads across virtualized, on-premises, containerized, and cloud-based environments.

It consists of an endpoint security agent and a management server. Additionally, Wazuh is fully integrated with the Elastic Stack, allowing users the ability to navigate through security alerts via a data visualization tool.

Wazuh’s agent can run on many different platforms, and is lightweight. It can successfully perform the tasks needed to detect threats in order to trigger responses automatically.
Wazuh manages the agents, can analyze agent data, and can scale horizontally.
Elastic Stack is where alerts are indexed and stored.

Wazuh Capabilities

Some of Wazuh’s most notable capabilities include:

Intrusion detection: Wazuh’s agents can detect hidden files, cloaked processes, or unregistered network listeners, as well as inconsistencies in system call responses. Wazuh’s server component uses a signature-based approach to intrusion detection, using its regular expression engine to analyze collected log data and look for indicators of compromise.
Log data analysis: Wazuh can read operating system and application logs, and securely forward them to a central manager for rule-based analysis and storage.
Integrity monitoring: File integrity monitoring can help identify changes in content, ownership, permissions, and attribute of files. Wazuh’s file integrity monitoring can be used in conjunction with threat intelligence.
Vulnerability detection: Wazuh agents can identify well-known vulnerable software so you can see where your weak spots are and take action before an attack can exploit them.
Configuration assessment: System and application configurations are monitored to make sure they are compliant with security policies. Periodic scans are used to detect applications that are known to be vulnerable, insecurely configured, or unpatched.
Incident response: Wazuh responds actively when active threats need to be addressed. It can perform countermeasures like blocking access to a system when a threat source is identified.
Regulatory compliance: Wazuh includes the security controls required to be compliant with industry regulations and standards.
Cloud security: Wazuh’s light-weight and multi-platform agents are commonly used to monitor cloud environments at the instance level. In addition, Wazuh helps monitor cloud infrastructure at an API level.
Security for containers: With Wazuh, you have increased security visibility into hosts and containers, allowing for easier detection of threats, anomalies, and vulnerabilities.

Wazuh Benefits

Some of the most valued benefits of Wazuh include:

No vendor lock-in
No license costs
Uses lightweight, multi-platform agents
Free community support

Wazuh Offers

Annual support and maintenance
Assistance with deployment and configuration
Training and instructional hands-on courses

Reviews From Real Users

"It's very easy to integrate Wazuh with other environments, cloud applications, and on-prem applications. So, the advantage is that it's easy to implement and integrate with other solutions." - Robert C., IT Security Consultant at Microlan Kenya Limited

“The MITRE ATT&CK correlation is most valuable.” - Chief Information Security Officer at a financial services firm

Sample Customers

Abel & Cole, Bank of Ireland, Bluegrass Cellular, CareerBuilder, Claire's, Hays Medical Center, Hope International, McCurrach, McKinsey & Company, Party Delights, Pepco Holdings, Richland School District, Ricoh, SaveMart, Shake Shack, Steelcase, TaxAct, Taylor Morrison, Vonage and Zoom

Information Not Available