Securonix Next-Gen SIEM Reviews

We are using it for Azure logins outside of US and Azure brute force use cases. We have use cases for our firewalls, like Palo Alto. These are use cases that we created ourselves. These are not the use cases out-of-the-box that Securonix provided us.

Without this product, my organization would not be able to function at all. It is our main monitoring product for our clients. We monitor everything through it. Securonix Security Analytics is the main process of providing services to our client because we are a 24/7/365 security operations center. So, Securonix is helping me out on daily basis all the time, every minute.

Security Analytics helps provide actionable intelligence on threats related to our use cases, which is very important. They are improving it almost on a daily basis. They send it to us and keep it running on the back-end for all the tenants. If anything gets raised, according to the threat intelligence that they have generated, we will get an alert. We will then start digging into those events. After that, we work with clients to respond to that incident.

The product can help increase efficiency. My analysts were working 12-hour shifts when we started. Now, they are working eight-hour shifts. However, it also depends on the person and how efficient they want to be. My analysts are monitoring, training, and doing their certifications all at the same time. This definitely divides their attention.

Features, like Spotter, are the most valuable. Spotter is a wide range of research for any of the incidents that happened under my clients' data. 

They also have a feature that separates violations according to top violators. So, I can go in and see all the use cases that got preserved under them. It is an intensive search type of thing. You can just keep digging in. There are other policies attached to it. There are some remediation steps and recommendations attached to it. 

Securonix’s analytics-driven approach for helping to find sophisticated threats and reduce false positives is pretty good. We are allowed to fine tune according to our requirements and our clients' requirements, which does reduce false positives. In the last 24 hours, the total number of policies with triggers was 233. When I started with this product, the false positives were 561. Therefore, the solution has helped by tuning or reducing false positives.

It helps us find sophisticated threats.

The monitoring, analysis, and visualization of data that Securonix provides is good. However, there are some things that I would love Securonix to change. For example, they don't allow us to make changes on the graphical reports that they have integrated into the platform. We have to create our own. If we just want to take out one thing, our page should allow us to change that template just for our platform. I'm not talking about changing others' platforms; this is just for my platform. They should allow me to make changes according to my scalability. I would like a little bit more changes in the analytics and visual views that they already have out-of-the-box in the platform. They are working on this, but I have not heard from them for a while. I'm satisfied with the visualization that they have, but I would like to get some more out of it. For example, I am taking the report and manually making changes. I want all those changes already integrated and automated, so they are automatically done in the product.

I would not say its threat hunting is easy or difficult to use. It is medium because it totally depends on the data that is coming to you. It does not depend on the platform. It depends on whether you can find the correct attribute that you need to look at, then you can go further on that. They are working on this. They are introducing more features, e.g., they have a couple of updates pending at this time. They are working on it to cut down the steps. If I am doing 28 steps right now just to onboard our data, then they are cutting those steps down. They are also putting more automation in the solution. While they are working on these improvements, it is just a matter of time. 

It ingests 85% of all our log sources already built into the product when investigating threats. If the data sources have the functionality, Securonix will create a custom parser for us on a request. If the functionality is not there in the product, then there is a difficulty, but we can still ingest it through the file base, etc. However, I am not a big fan of the file base because a user is creating a file per day for data that was generated the day before. Specifically for activity that has already taken place, we can prevent it, but we cannot stop the activity.

I have been using it for a year and three months.

It is pretty stable. Out of 100%, I would rate the stability between 80% to 85%. 20% can be unstable for any product. There can be bugs. There can be a failure in the core or a syntax error in the core. When I notify the support of these types of issues, they quickly fix the problem for me.

We have experienced a few performance issues, about 10%, when Security Analytics is ingesting our log sources. This can happen with any product. We informed them that we are facing this issue and get pretty good support on it. 

Scalability is pretty good. It does grow with our license. We work according to EPS. So, as our EPS pool grows, the solution will keep growing.

Cloud Scale is super scalable. You can scale Securonix pretty well. Even if you have too much data coming in, you can figure things out or put more resources on it. Securonix is pretty good at doing these things. For example, they have load balancers already in place, which automatically take care of these things.

There are 12 of us right now using the solution. I'm the senior engineer, and I have eight analysts who are using it. I have a senior manager who is also using it.

Six months ago, if someone asked me about the support, I would say, "Not good." Now, the support is pretty effective. They try to resolve problems ASAP. For example, if it's a critical ticket, they get it fixed within an hour.

I would rate the support as eight out of 10.

Positive

We had a generic system previously, which has none of the things which have helped us by using Security Analytics. This solution automatically detects threats. There is a response bar that we can deploy. There is an email notification. So, if I am not available, then I will get an email that I can respond to pretty quickly. As far as threat detection, we get policy updates every three minutes. Therefore, if anything is detected, it will be right there on my screen.

I have previously trained on FortiGate and Splunk. Securonix and Splunk are not that different. Splunk has a lot of things on one screen. Whereas, Securonix tries to clean it up.

If you follow the documentation, it is straightforward. If you don't want to read, it will be complex. I don't review documentation anymore. I did it twice when I started, then I went in, wrote a batch script, and automated the whole process. Now, I just need to make some changes before running that script.

The deployment takes 35 minutes on the client side.

I am the only person involved in the managing and deployment of the solution.

If there is any kind of setup that needs to be done on the cloud side, Securonix does that for us. I integrate clients with my platform, but Securonix takes care of the back-end.

The Securonix cloud-native platform helps minimize infrastructure management. We don't need that much manpower. If there is infrastructure to maintain, I need an engineer to maintain infrastructure, a software engineer who will look for the application, a security unit who will look for the threats and attacks, and a response person. Now, I don't need a software engineer or infrastructure engineer. That has gone away. Currently, I need only a security engineer and response person, which one person can do. We can also hire two people to do the different jobs. That is no problem. 

We don't have to put more focus on infrastructure, which helps. There is a little bit of an infrastructure included, but that is a one-time setup thing. You don't need to go and maintain it again and again.

Securonix Security Analytics adds contextual information into security events. For example, on a generic system, if I used to put in an hour, now I'm putting in 35 to 40 minutes on this. So, it's saving me about 20 minutes of time.

Compared to the pricing of other products, Securonix's pricing is pretty good. Clients can get half of the price of other companies by going with Securonix. Other products, like IBM and Splunk, have pretty high pricing. Nowadays, we see CrowdStrike as up and coming, and they are pretty expensive. 

Pricing does depend on what model you are looking for, e.g., are you going for an MSP or single tenant?

I don't find a lot of difference between solutions. Everybody tries to improve their product over time. I do free testing for multiple products, and they are basically copying each other's functions.

I like Securonix because I am familiar with it and can do threat hunting in 10 minutes instead of the 30 minutes that it might take if I used other solutions.

According to my clients and the security world, I cannot eliminate all the false positives because you cannot let false positives go. You need to make sure that there are no attacks attached to that false positive. So, we have a team of analysts who monitor it every time. So, if a false positive policy gets an alert, then we just go ahead and make sure to analyze it. That is okay. If it is a false positive, then we mark it as one. We did eliminate a lot of false positives, but not all of them. It is our choice, not Securonix's, what we want to keep or eliminate.

I would rate Securonix as nine out of 10.

We mostly use it for user-behavior analytics. It is used for all the behaviors related to users. In terms of the environment, there are multiple connections at different sites and locations, and there is also integration with other platforms. For some endpoint use cases, I have to do integrations with different customers who already have the platform.

Its deployment is hybrid. The cloud providers are Amazon and Google Cloud Platform.

When we have an endpoint threat, we have to move very quickly. We detect it through another tool that is associated with Securonix, and automatically the endpoint is isolated from the network. We also get some information for investigation and forensics allowing us to understand the type of threat. We get to know whether it is related to the endpoint or user behavior. We can get information on web-application firewalls and other solutions connected to Securonix, which allows us to understand the depth of the threat for a specific use case.

It provides actionable intelligence on threats related to our use case. After the alerts, we can isolate the endpoints and make some modifications. We can also do some searches about the related IP on the internet and intelligence platforms. That's very nice.

This actionable intelligence is pretty important. When we integrate different platforms, Securonix provides a lot of visibility and allows us to see the whole environment, not just a part. I have been working mostly on the endpoint side, but other people who are working on wider use cases can see all the dashboards and improve the security posture with Securonix.

Its analytics-driven approach to finding sophisticated threats and reducing false positives is very important. With other similar tools, we have to work a lot to reduce or manage false positives. We have to improve the rules and integrations because there are a lot of false positives. With Securonix, we have fewer false positives, and there is also automatic recognition for false positives allowing us to move very quickly.

It adds contextual information related to the use cases. My use case is very specific, but my partners and other teams get a lot of contextual information related to the whole company. It provides a lot of analytics related to a threat in terms of user behavior, environment, and target applications, such as databases, which is very important.

It has saved a lot of investigation time. As compared to other solutions, it has saved more than 50% time.

It has improved the threat detection response and reduced noise from false positives as compared to our previous SIEM solutions. The improvement in the response time is dependent on the scenario, but generally, it is about 40% more effective. When it comes to false positives, it is about 60% more effective.

It has been helpful in detecting advanced threats faster and lowering response times, but I don't have the metrics. 

Its console is very easy to use and configure. It is very intuitive for our use cases. App integrations are also pretty nice. 

It could be improved a little bit more for admin users. There should be more administrative options related to security for admin users. For example, for forensic purposes, the admin should be able to stop a specific user from erasing some information. I would be helpful in certain situations, such as during an internal fraud.

I have used it for two years separately, in 2020 and the last year, 2021.

Its stability is pretty nice because we don't have too many problems with it. The complexity is related to what we want to see. There are no issues with the performance. We have not experienced any performance issues when the solution is ingesting all of our log sources. 

It is 100% cloud. So, its scalability is pretty nice. We have all the capabilities and options to grow. Our environment has more or less four locations with about 1,000 devices. We don't have any plans to increase its usage in the near future.

I have had to call support three or four times, and I would rate them a ten out of ten.

Positive

I have worked with Splunk and LogRhythm. I am using Securonix because, in this company, most of our clients are using Securonix. So, I had to learn how it works and understand its architecture and capabilities. It is very easy to understand for anyone who has worked with similar solutions. It is 90% easier than Splunk, which has a lot of code. Securonix is very radical and intuitive.

I wasn't involved in its setup and onboarding process, but I would assume that it is very quick. That's because it is very simple to use for my use cases, and they have nice support and help.

Its maintenance is pretty lightweight. We have another team that is in charge of that. There are most probably two people who take care of SIEM and cybersecurity solutions.

Securonix cloud-native platform helps to minimize infrastructure management. It allows us to focus on threats versus engineering or managing the platform.

We have surely seen an ROI when we look at multiple threats that we have been able to prevent.

It improves analysts' efficiency to do more with less time. By using the contextual information that it provides, we can be more accurate in our investigation. It has saved about 30% time.

Its pricing is quite similar to others and is very competitive. The other solutions have different types of licensing, but when you do the math, it is competitive.

You should know your environment and connectivity requirements very well. You should understand the analytics that Securonix is providing for the team. You can make a lot of improvements based on those analytics.

I would rate it a ten out of ten.

We use Securonix Next-Gen SIEM as a SIEM, security incident and event management solution in our organization.

Securonix Next-Gen SIEM has effective features for threat detection, such as models and custom trap models which are useful. Its integration capabilities are good and comprehensive, allowing us to connect with various necessary components. 

Additionally, the AI capabilities enhance threat detection, although they were relatively new at the time. Finally, the solution has shown to be time-saving in the long run.

The passing and setup are quite complex at the beginning, making onboarding not smooth, which is an area that needs improvement.

We have been using the solution for around two years.

I rate the stability of the solution as eight on a scale of one to ten.

The solution is scalable as it is cloud-based and cloud-native.

Customer support is rated around seven to eight out of ten. The support system requires creating support requests, and there is no UK-based support, which leads to delays in waiting for US support.

Positive

Previously, we used Splunk. We switched to Securonix Next-Gen SIEM since Splunk required a lot of hand-holding in terms of creating rules and models. We needed a solution out of the box as we have a small team.

The initial setup involved complex passing and setup, which made the onboarding process not smooth.

Deployment was handled by the vendor, Securonix themselves.

The solution is time-saving, particularly in the long run after it is deployed, enabling us to get value promptly.

The pricing has similar ingestion charges compared to other solutions, such as Splunk.

We compared Securonix with Exabeam before deployment.

I would recommend Securonix Next-Gen SIEM depending on the use case. For a small team that wants to get things done without much additional work, it is suitable. 

Overall, I would rate the solution at eight point five.

We use Securonix Next-Gen SIEM primarily for managed SOC, focusing on threat detection, baselining, and ensuring the maturity of our SOC security operations. 

It is integrated with threat intelligence and utilizes frameworks like MITRE ATT&CK and the Cyber Kill Chain. 

The solution helps in threat detection, especially with use cases like brute force attacks, port scans (both horizontal and vertical), other insider threat activities, Privileged access abuse, Ransomware detection and Data exfiltration prevention. We also customize and fine-tune these use cases based on our requirements.

Securonix Next-Gen SIEM has significantly improved the visibility of tools and technologies within the environment. 

It enhances our security posture by providing comprehensive oversight of users and devices, aiding in threat detection and prevention. 

Additionally, its scalability and ease of onboarding new devices and technologies have streamlined our security operations.

The most valuable feature of Securonix Next-Gen SIEM is its advance analytics, flexibility and scalability. We ingest billions of logs without worrying about resource allocation. This makes it a robust and cost-effective solution for our needs. Its user entity and behavior analytics (UEBA) are also integral for detecting insider threats and lateral movements within the organization. These features help organizations strengthen their security posture, protect sensitive data, and maintain compliance with strict regulatory requirements.

The dashboards in Securonix Next-Gen SIEM need more customization and informational capabilities. 

The reporting features also require improvements. 

Additionally, the multi-tenancy functionality should be enhanced to allow individual consoles for different customers, which is currently a limitation. This feedback has been given to Securonix for future improvements.

I have previous experience with Securonix Next-Gen SIEM for almost three years in deployment management and baselining in my past experience.

Securonix Next-Gen SIEM is very stable and reliable, but like any sophisticated security platform, its stability depends on several factors, including deployment architecture, environment, and proper maintenance. It handles billions of logs efficiently, along with the managed service, ensure its reliable performance especially when deployed in the cloud. However, to maintain long-term stability, it's important to ensure the platform is well-resourced, updated regularly, and properly configured. When implemented correctly, Securonix SIEM delivers reliable performance and security monitoring without significant interruptions.

The scalability of Securonix Next-Gen SIEM is seamless. We don't have to worry about resource allocation as long as we have the required EPS licenses. The solution is designed to scale according to our needs without any hassle.

Securonix is generally regarded for its strong customer service and support, which is a critical factor in ensuring the success of complex security solutions like SIEM. Overall, Securonix offers solid and responsive support with a team that is technically proficient and helpful, especially in complex deployments. The proactive guidance, customization support, and strong documentation make it easier for organizations to implement and maintain their SIEM effectively. However, for critical issues, it's advisable to escalate promptly and ensure you're engaging the appropriate level of support for your organization's needs. 

Positive

Prior to Securonix, we evaluated LogRhythm and IBM QRadar. Based on our company’s requirements, reduced operational overhead, lower TCO and improved threat detection Securonix Next-Gen SIEM was the best fit.

The initial setup includes evaluating technology that fits our organizational needs, signing NDAs, scoping, providing inventory, and EPS calculation. Once we procure the licenses, there is an expectation setting for onboarding, followed by workflows for exchanging guides, documents, and prerequisites. After the environment is ready, we proceed with onboarding.

I was closely working with the internal team and the vendor, leading the project. Including me, there were four people involved in the onboarding and baselining part.

From a business point of view, it can be assessed in both quantitative and qualitative terms. The ROI may vary depending on the organization’s size, security needs, and how well the platform is utilized and is highly positive in environments with high compliance requirements, frequent security incidents, or large amounts of data to process. By reducing incidents, improving operational efficiency, and simplifying compliance, the cost savings and protection against expensive breaches can quickly outweigh the initial investment.

The pricing of Securonix Next-Gen SIEM is reasonable, especially considering the package they provide. If we went with the same package with another vendor, it would be significantly more expensive. It’s value for money.

Before choosing Securonix, we evaluated LogRhythm and IBM QRadar. Based on our requirements need for more advanced analytics, scalability, better cloud integration, and automated threat detection., Securonix Next-Gen SIEM was found to be the best fit.

My recommendation would be to evaluate the solution precisely based on the company's requirements to avoid scalability issues in the future. Careful calculation of the EPS during initial sizing is crucial as it can become costly to procure additional EPS licenses later.

I'd rate the solution eight out of ten.

Securonix or SNYPR is a UEBA tool. It has all the features. It can work as a traditional SIEM as well as do behavior-based analysis. 

In terms of deployment, it is on the cloud. It is hosted with Securonix. We are using it as a service, however i have worked on premise deployements as well.

We have this tool to monitor all types of log activities. It can monitor whatever is happening. It can monitor traffic-related things, and it can monitor EDR and all types of logs. It has a set of use cases, and it can alert us if any abnormal activities are happening and if there is any suspicious and malicious traffic. It definitely does 24x7 monitoring of the activities happening in our environment and the type of possible attack that can happen in any of the environments.

It provides a lot of analytics. For handling alerts, we have a manual approach, and it is a team effort. Whenever there is a flag or violation, we check the behavior in the tool or in the UI itself. We can check each and everything in the tool itself. On the basis of that, we identify whether something is a false positive or not. If it is a false positive, we work on the policy condition.

An analyst's efficiency is all about the analytics present in the tool. They provide sufficient analytics. Recently, they have added one more analytics. They already have more than 15 analytics for threat detection purposes. They definitely help us to do more in less time. 

In our environment, we do not have external TPI integrated. So, we don't have any external sources for IOCs. With Securonix, all the IOCs are available in their Threat Lab. We are using that feature, and we are also receiving the reports. They check our environment against the IOCs available in their lab and provide us with the report. So far, we haven't got any high severity or medium severity issues. Whatever we got has been of low severity. Sometimes, we see traffic coming from a particular IP address continually, which is blocked in our fiber. We get to know that we have to be very careful about this external, malicious IP address that is trying to hit our environment. Because we do not have the external IOCs or TPIs integrated, we find this report very useful. 

It adds contextual information to security events, which is very helpful.

SNYPR has a bundle of features. It has the UEBA feature that tells you about the behavior of a person or entity. In the tool itself, there is an incident management feature, which is definitely valuable. It is a value-added item. It also has third-party TPI.

SNYPR is valuable for any organization because it is not only a traditional SIEM. It is also a UEBA tool. It does behavior analytics. As a UEBA tool, it has a lot of features. You can see a lot of things in the UI itself. It provides a lot of analytics. You can see how a policy is working and how it is giving you the flags if you want to reduce false positives. You can have all the visibility in the UI itself. You don't need to check anything in the backend for this.

It has a feature called Threat Model to identify a threat. For intelligence, it has a feature called Autonomous Threat Sweep that is valuable. 

Sometimes, there is instability in the data in terms of the customization of the time. They should work on stability on tool. However 6.4 jupiter version is much more stable.

I have been working with this tool since 2018 till today.

They have improved it a lot over time. We don't see a lot of issues related to stability in our environment. Sometimes, we see instability issues, but they are not very regular.

Performance-wise, it is good. It has a lot of analytics. We see the value in having this tool. Our management is also happy with the tool. It is reliable. We had a lot of configuration mistakes in our environment, and we could detect them with the tool.

It is scalable. We have 1,500 active users. We are operating in the US at three locations.

In terms of the integration of the data sources or the log sources with the Securonix tool, if the connectors are available, we never see any difficulty. I have integrated more than 50 log sources with Securonix. However, if they don't have a connector, we won't have any option for integration. This is common to all the SIEM tools. It isn't something that's specific to this. In any of the SIEM tools, if the connector isn't available, you won't have any option to integrate.

Their support has improved it a lot, They do support us or they do reply to us, but they need to be very fast. They need to be very quick. I would rate them nine out of ten in terms of support.

Positive

I started with Securonix itself. I have read about other solutions such as QRadar and Splunk, but I did not get a chance to work on these tools.

It was not at all difficult for me to use Securonix's interface. This is the first tool that I used. It was not difficult for me to learn. Its interface is very user-friendly, and I don't think anyone will face difficulty operating the tool. Everything is displayed nicely.

When we have a cloud deployment or we take it as a service, we don't get involved in the deployment of the SNYPR application, but we do get involved with on-prem Remote Ingester. So, application deployment is done by Securonix, but the integration with other sources is done by us. We don't have any difficulties with the integration because we have been working with it for a long time. So, we're aware of the backend and how to integrate. It is quite simple and easy. We also have a call with Securonix SME twice a week.

The maintenance is handled by Securonix themselves. They sometimes do the monthly maintenance. We only get the notification, and we know of the maintenance window. After maintenance, we check everything. We just validate that everything is working fine. They also validate from their end, but we also validate. We haven't had any difficulty after the maintenance or upgrade. It always works fine. There are no issues.

The Securonix cloud-native platform helps minimize infrastructure management. We don't need to buy a server. We don't need to manage it. 

It is a good solution, but it definitely requires some improvements. It has already improved a lot. They are upgrading it in every build, and it is getting better. They work on policy decommission. Whenever a policy gets old or replicated, they remove the policy. They work on the content refresh. For example, last year when we had the Log4j vulnerability, they immediately updated their content and applied the policy. They provided an update for the Log4j vulnerability.

I would definitely recommend this tool. It is really a good tool. It has all the features available. I don't know anything about the pricing. I don't know if it is more expensive or cheap as compared to the other tools, but as a UEBA tool, I would definitely recommend it to everyone.

Overall, I would rate it an 9.5 out of ten.

We have customized the uses of the platform for our benefit. In general, we use it for failed access attempts, network issues, and allowed/blocked, and we have use cases for platforms such as Windows Server.

We are a service company and partners of various vendors. We provide support to customers. Our strategy is that each piece of equipment sold to customers comes with value-added service, and Securonix protects our customers.

It is an excellent tool that helps us optimize threat-hunting operations, detect intrusive events on the network, and respond to security incidents. It is a tool that helps debug false positives and eliminate noisy alerts. It helps us focus on the alerts that we should take into account for analysis.

Using old, traditional SIEMs did not provide us with the same responsiveness and ability to operate. And if they did provide us with something similar, we needed more staff to review things, event by event. That meant some risky events could occur unnoticed. With Securonix, those issues no longer exist. Securonix shows us information that we must consider as a threat and helps us know when to start an investigation to avoid an incident.

It's very good at adding contextual information to security events. It has reduced the time spent by admins on the dashboard. They can now see information connected to attack risks or even users. The single dashboard alerts them and quickly reports if there is any threat.

It has helped us to better understand what is happening in our network through the indicators of compromise. We have saved days of work. And it optimizes the time that analysts take to review events, compared to other tools that do not have as much intelligence and as many indicators. With Securonix, the information automatically enters and adds intelligence to the indicators. This saves a lot of time that would otherwise be spent reviewing noisy data. It saves our analyst between four and eight hours when analyzing events.

When it comes to advanced threats, it shows us the threats or events that have been detected, with their risk level. It shows us a vulnerability bar and that helps us see who is looking at us, who is trying to deliver certain information to our systems, who exploited us, or if there is any alert due to someone extracting certain information. The automation of information delivery has facilitated everything, saving us three or four days.

For optimization and data analysis, it has a good evaluation engine for repeat offenders and that has helped us to detect, on time, what other basic SIEMs did not detect. Those other solutions needed more time to detect at that same level.

We can customize our use cases with the tools provided by Securonix.

It is an excellent tool that can ingest data in different ways and is very flexible.

Securonix could open up information regarding the indicators of compromise or cyber-threat intelligence databases that they use. The idea is that they share what threats they are detecting.

I have been using Securonix Next-Gen SIEM for about a year.

It is stable, both in the cloud and on the servers. We have never had access problems or experienced any performance issues.

Scaling is flexible. If we fall short in terms of EPS, we would simply increase the EPS. And if the RIN server has low resources, as it is a virtual machine we could increase the resources according to the data quantity.

It is an excellent option for the cloud in terms of scalability. It is flexible for both us and our clients. We have plans to increase usage for certain customers.

The support is excellent. At the service level, they attend to us quickly. We have a post-sale person who follows up in some cases. He can also see the tickets and can escalate something according to the urgency.

Positive

We used a traditional SIEM where everything was very manual. It did not have threat intelligence or threat hunting of compromises, while Securonix has those features.

We changed because we wanted a good tool to automate certain manual processes so that everything is more flexible. With Securonix, you have the option of integrating with other indicator-of-compromise services, and that helps create a more powerful platform and eliminate false positives.

I started the process of design and continued with onboarding and implementation. The initial implementation was simple, but we had some delays because we had new solutions and we had to create new templates. But in general, if you have traditional solutions that have a template, it is easy to implement. It would take a week.

As for our implementation strategy, the tool that we had previously had a forwarding functionality, so what we did was deploy information to the RIN and, from there, sent the information to the cloud. After that, we created a pipeline and sent the rest of the events so that we could take the previous SIEM out of production.

The sources took a month to incorporate. It took us a month to get access to the teams because we do not manage certain teams. It was a bureaucratic process.

Securonix does the maintenance. It doesn't require work from us. They send us emails indicating that the system is going to have a brief reboot and it takes a short amount of time. 

We hired an onboarding engineer from Securonix who helped us with the implementation of the RIN. He explained the process to us until we understood everything.

Our experience with the onboarding engineer was good. He helped us with any questions we had and followed up through emails.

For the implementation of Securonix, we only needed one person from our side. I was the point of contact with our other areas.

Where we see our best return on investment is in the time and manpower we save. Before Securonix, our staff had to investigate events constantly. Now, one engineer with some expertise is enough to speed things up and give the rest of the admins time to do other things.

The pricing is fine compared to the market but I think that at some point the competitors will catch up on price. It would be good if, for example, there were an option to offer customers who have used the solution for more than a year some kind of additional trial or service.

There is no cost outside of the standard licensing fee, other than an initial installation service charge. Otherwise, there is simply a monthly cost for the service.

We were thinking about Splunk, QRadar, and Rapid7. One of the drawbacks of those systems would be the infrastructure. Many of the other platforms, including McAfee, need boxes or deployment servers in our infrastructure or our clients' infrastructures and, in many cases, the infrastructure is growing continuously.

With Securonix, that does not happen. It is a cloud solution that only requires a small deployment server with low resources, depending on how many events are received. And all that information is stored in the cloud as well.

The cost, compared to other solutions, is better.

Compared to other platforms, it is very simple yet, at the same time, it is very efficient because it packs information into a glance. After that, it gives you the option of hunting threats and that can be initiated on the dashboard.

It is very intuitive. A person who has a certain notion of cyber security can move quickly since it gives you information about any attack. It gives you a summary and it gives you links to receive information. And if you don't have much knowledge of the tool, you can always take the courses that are free on the web. Doing so helped us understand the solution.

This is a solution that will help you a lot in hardware processing and in optimizing the time it takes to review events, which is what admins often spend their time doing.

There are things on the network that you can't see with traditional tools. There are tools that don't give you the visibility that Securonix gives you.

Foreign Language:

(Spanish)

¿Cuál es nuestro caso de uso principal?

Hemos personalizado los usos de la plataforma para nuestro beneficio. En general, lo usamos para intentos de acceso fallidos, problemas de red y permisos/bloqueos, y tenemos casos de uso para plataformas como Windows Server.

Somos una empresa de servicios y socios de varios proveedores. Brindamos soporte a los clientes. Nuestra estrategia es que cada equipo vendido a los clientes venga con un servicio de valor agregado, y Securonix protege a nuestros clientes.

¿Qué es lo más valioso?

Para optimización y análisis de datos tiene un buen motor de evaluación de reincidentes y eso nos ha ayudado a detectar, a tiempo, lo que otros SIEM básicos no detectaban. Esas otras soluciones necesitaban más tiempo para detectar al mismo nivel.

​​Podemos personalizar nuestros casos de uso con las herramientas proporcionadas por Securonix.

Es una excelente herramienta que puede ingerir datos de diferentes maneras y es muy flexible.

¿Por cuánto tiempo he usado la solución?

He estado usando Securonix Next-Gen SIEM durante un año aproximadamente.

¿Qué opino de la escalabilidad de la solución?

El escalado es flexible. Si nos quedamos cortos en términos de EPS, simplemente aumentaríamos el EPS. Y si el servidor RIN tiene pocos recursos, al ser una máquina virtual podríamos aumentar los recursos según la cantidad de datos.

Es una excelente opción para la nube en términos de escalabilidad. Es flexible tanto para nosotros como para nuestros clientes. Tenemos planes para aumentar el uso para ciertos clientes.

¿Cómo son el servicio de atención al cliente y el soporte?

El soporte es excelente. A nivel de servicio nos atienden rápido. Contamos con una persona de post venta que da seguimiento en algunos casos. También puede ver los tickets y puede escalar algo según la urgencia.

¿Cómo calificaría el servicio y soporte al cliente?

Positivo.

¿Qué solución usé anteriormente y por qué cambié?

Usamos un SIEM tradicional donde todo era muy manual. No tenía inteligencia de amenazas o búsqueda de amenazas de compromisos, mientras que Securonix tiene esas características.

Cambiamos porque queríamos una buena herramienta para automatizar ciertos procesos manuales para que todo sea más flexible. Con Securonix, tienes la opción de integrarte con otros servicios de indicadores de compromiso, y eso ayuda a crear una plataforma más poderosa y eliminar los falsos positivos.

¿Cómo fue la configuración inicial?

Comencé el proceso de diseño y continué con la incorporación e implementación. La implementación inicial fue simple, pero tuvimos algunos retrasos porque teníamos nuevas soluciones y tuvimos que crear nuevos modelos. Pero, en general, si tiene soluciones tradicionales que tienen un modelo creado, es fácil de implementar. Tardaría una semana.\

En cuanto a nuestra estrategia de implementación, la herramienta que teníamos anteriormente tenía una funcionalidad de reenvío, entonces lo que hicimos fue desplegar información al RIN y de ahí enviamos la información a la nube. Después de eso, creamos una canalización y enviamos el resto de los eventos para que pudiéramos sacar de producción el SIEM anterior.

Las fuentes tardaron un mes en incorporarse. Nos tomó un mes tener acceso a los equipos porque no administramos ciertos equipos. Fue un proceso burocrático.\

Securonix hace el mantenimiento. No requiere trabajo de nosotros. Nos envían correos electrónicos que indican que el sistema se reiniciará brevemente y normalmente no tarda mucho.

¿Y el equipo de implementación?

Contratamos a un ingeniero de incorporación de Securonix que nos ayudó con la implementación del RIN. Nos explicó el proceso hasta que entendimos todo.

Nuestra experiencia con el ingeniero de incorporación fue buena. Nos ayudó con cualquier pregunta que tuviéramos y nos dio seguimiento a través de correos electrónicos.

Para la implementación de Securonix, solo necesitábamos una persona de nuestro lado. Yo era el punto de contacto con nuestras otras áreas.

¿Cuál fue nuestro Retorno de Inversión?

Donde vemos nuestro mejor retorno de la inversión es en el tiempo y la mano de obra que ahorramos. Antes de Securonix, nuestro personal tenía que investigar eventos constantemente. Ahora, un ingeniero con algo de experiencia es suficiente para acelerar las cosas y dar tiempo al resto de los administradores para hacer otras cosas.

¿Cuál es mi experiencia con los precios, el costo de configuración y las licencias?

El precio está bien en comparación con el mercado, pero creo que en algún momento los competidores alcanzarán el precio. Sería bueno que, por ejemplo, hubiera una opción para ofrecer a los clientes que han utilizado la solución durante más de un año algún tipo de servicio adicional.

No hay ningún costo fuera de la tarifa de licencia estándar, aparte de un cargo por servicio de instalación inicial. De lo contrario, simplemente hay un costo mensual por el servicio.

¿Qué otras soluciones evalué?

Estábamos pensando en Splunk, QRadar y Rapid7. Uno de los inconvenientes de esos sistemas sería la infraestructura. Muchas de las otras plataformas, incluida McAfee, necesitan cajas o servidores de implementación en nuestra infraestructura o en las infraestructuras de nuestros clientes y, en muchos casos, la infraestructura crece continuamente.

Con Securonix, eso no sucede. Es una solución en la nube que solo requiere un pequeño servidor de implementación con pocos recursos, dependiendo de cuántos eventos se reciban. Y toda esa información también se almacena en la nube.

El costo, en comparación con otras soluciones, es mejor.

Comparado con otras plataformas, es muy simple pero, al mismo tiempo, es muy eficiente porque empaqueta la información en un vistazo. Después de eso, le da la opción de cazar amenazas y eso puede iniciarse en el tablero.

Es muy intuitivo. Una persona que tiene cierta noción de ciberseguridad puede moverse rápidamente ya que te da información sobre cualquier ataque. Te da un resumen y te da enlaces para recibir información. Y si no tienes mucho conocimiento de la herramienta, siempre puedes tomar los cursos que están gratis en la web. Hacerlo nos ayudó a comprender la solución.

¿Qué otro consejo tengo?

Esta es una solución que ayudará mucho en el procesamiento de hardware y en la optimización del tiempo que lleva revisar los eventos, que es a lo que los administradores suelen dedicar su tiempo.\

Hay cosas en la red que no puedes ver con las herramientas tradicionales. Hay herramientas que no te dan la visibilidad que te da Securonix.

I use this solution for security monitoring and user behavior analytics. Banks, governments, and the oil and gas sector utilize it.

The software includes user behavior interactions, dashboards, and training capabilities. These features are interactive, allowing for comprehensive engagement.

In terms of improvements, SIEM could have better integration with other technologies. 

Additionally, it might benefit from integration with other sources, such as firewalls. It all depends on specific use cases.

I have been using the solution for three years.

I have found the solution to be stable.

The system is very scalable, and I would rate it around eight out of ten.

I find customer service to be very good.

Neutral

The initial setup is not very complex, however, it does have its intricacies, and I would rate it around seven out of ten.

The return on investment depends on the customer. It typically takes at least a year to realize the value.

Comparatively, it is reasonable when compared to solutions like Splunk and Exabeam. Licensing is based on events per second (EPS), costing between $50 to $60 per EPS.

My rating for the solution would be around eight out of ten. 

If organizations are on a journey to move to cloud, I recommend transitioning to Securonix over an on-premise solution due to its ease of deployment in cloud.

We mainly use Securonix for SIEM software architecture and for logs. We generate all the logs from different APIs and firewalls. We also have created other policies. Securonix is the primary tool we use to get everything done for our projects and architecture. We even use it for other solutions like AD.

Primarily, I work on violations and policies, not the backend. As an analyst, I work on SIEM.

The solution is deployed on a private cloud. It is deployed with Microsoft Azure.

Everyone has access to SIEM, but they don't have admin access. We mainly have three people and a team lead on the Azure Securonix team. I am the backup and work on the operational side of that team. Everyone has read-only access except the three team members. 

Securonix primarily helps with our log code situation. We found a vulnerability last December, so it helped us gather logs for that. We informed our vendor, and they provided some queries on how to get those vulnerabilities and logs.

I normally work on policies and face a lot of false positives. We reduced many false positives since using this solution. Securonix has definitely helped improve our threat detection response and reduced noise from false positives.

Sometimes we face threats and sign-in logs from different countries, but we're able to resolve those. Sometimes we face malicious activities from traffic but it's very rare. It happens about twice a month.

Securonix helps a lot with monitoring. My project is in the monitoring and operational stage, so it's a primary tool I use to monitor everything. The implementation stage has already been completed. We have created policies for all kinds of tools and APIs.

As we are the client, most of us don't have the SIEM threat model feature. There isn't a lot of proper information about how to implement that. Customer service doesn't have a proper idea either. We are lagging in this area, but it's good overall.

In some cases, we have observed that people start getting login failures, so we checked the logs from Securonix and resolved the issue. In that way, it's helped.

Securonix Next-Gen helps us detect advanced threats faster and gives us lower response times. Sometimes we face a data source delay and it's impacted badly, but overall it serves us a lot.

I haven't faced any data loss since using Securonix.

The most valuable feature is that it works on user behavior and event rarities. Those features are in Splunk too, but they're not as effective. Securonix's customer service is also pretty good.

It's not difficult to use the interface, but there's a lot of documentation to read.

We haven't experienced any performance issues when ingesting log sources and investigating threats. The response is good.

Parsing needs to be improved. Every time we integrate a new, specific data source, we face a lot of problems in parsing, even for the old data source. That should be updated on a regular basis.

In some of the policies, the geographical location for a single IP is from a specific country, but the IP doesn't match. For instance, if the log is from China, the actual location of that IP will be from somewhere else, not China.

I have been using this solution for more than a year.

It's reliable and very stable. We haven't faced any major or even minor issues with security.

It's definitely scalable and fulfills my needs.

Technical support is good, but sometimes we face delays with responses.

I would rate technical support as nine out of ten.

Positive

The solution was already in the mid-stage of implementation when I joined the organization. I mostly worked on fine-tuning the policies.

We have a team that takes care of maintenance updates. The solution needed some updates because the user behavior wasn't working properly for some of the policies. As of now, instead of using user behavior, we use event rarity. After version 6.4 is implemented, the issue will be resolved. There are two or three more issues we have that will be resolved after the update.

I would rate this solution a nine out of ten. 

My advice is to get a proper idea of the tool you are working on and be sure to read the documentation.