USM Anywhere Reviews

The solution has everything that you want: SIEM, vulnerability management, NetFlow, IDS, and more. This solution can completely detect and prevent incidents on your network. This solution can completely detect and prevent incidents on your network

It has helped not only in the security, but also on the network when we have problems with slowness, we can go to the NetFlow section and see who is generating a lot of traffic. 

Using the communication within the security device, it is easier to create plugins. Therefore, if you want to create plugins, there is an option called plugin creator to assist with this.

AlienVault has the necessary all-in-one product with the function of vulnerability scanner integrated with detections, so when you detect an incident in a vulnerable port you can act faster and prevent more incidents.

Maybe logs are the problem, as the database query is too slow. If you want to search something, you need time to find it.

The other thing is the agent is OSSEC. They needed to create its own agent to help to find threats on the devices that it happens to be installed.

The setup was somewhat complex.

We have had this solution in place for about 10 months.

There were deployment issues. At the time, it was right after USM Anywhere had been released, and not all of the documentation was posted. This made the deployment have some issues.

The product has been very stable.

We have had no issues with scalabilty.

I would give customer service a rating of four out of five.

I would give technical support a rating of four out of five.

This is the first solution like this that I have deployed.

The setup was somewhat complex. One thing that was difficult was configuring log forwarding from Window systems.

We implemented using an in-house team.

• Open Threat Exchange (for IP reputation)
• Vulnerability scanning
• Quick APT phishing-related threat detection

• Phishing sites were detected and it secured the environment from the upcoming threat.
• Vulnerability scanner OpenVas is very useful for knowing current vulnerabilities present in system and taking preventive action.

• IPv6 not supported
• Correlate with external logs from other sources makes little bit difficult to work

I have been using it for one year.

It works well when you have minimum required setup as per AlienVault documentation.

Stability issues happen only when you do not have sufficient hardware as the primary requirement.

It scales well.

Customer service is 7 out of 10.

Technical support is 10 out of 10.

We did not previously use a different solution.

Initial setup was straightforward and simple.

An in-house team implemented it.

It is providing good ROI.

It is cheaper and more valuable compared to other reputable SIEMs.

Before choosing this product, we did not evaluate other options.

The automated alarms have been very helpful in identifying what is happening on your network that should be investigated.

It has helped us keep an eye on Admin activity on the network and in our directory.

The way it identifies systems can use some improvement. It has a hard time differentiating between versions of Windows.

I have used it for two years.

Deployment was extremely smooth.

The system has been very stable.

We have a small network. So far, we have had no issues with scale.

Customer service is excellent, very responsive, and they know their product.

Technical support is excellent so far.

This was the solution selected after evaluating several competing products; no SIEM prior to this deployment.

Initial setup was very straightforward.

We did the initial implementation and then had a vendor fine tune it with us. The vendor was very well qualified.

Licensing and pricing was one of the primary reasons for selecting this solution. Since no one has an unlimited budget, consider your needs and get the most bang for your buck.

Before choosing this product, we evaluated other options. We were leaning heavily towards AccelOps but had worries about their viability as a business.

If you are considering this solution, I highly recommend that you have someone in-house who is familiar with Unix/Linux. The underpinnings of this solution is *nix. It will make deployment and ongoing maintenance much easier.

SIEM, Event Correlation and the Vulnerability Scanner.

Reduced the number of the false alarms generated by other devices. With AlienVault we can gather all data from different devices, analyze theme and extract the correct information.

Plugins: most plugins are not up to date with the newer versions of products.

Since 2013

We had problems with the MySQL database, but the technical support is very helpful. I'd give them a 9/10.

Yes, But AlienVault is the more appropriate solution, it's flexible, Linux based, and contains a large number of open source solutions.

Simple.

A vendor team, don't install the solution in a virtual platform except VMware ESXi. We had a long story with AlienVault with a Proxmox Virtual Environment.

It's a powerfull solution and contain more features than other products.

Alerts derived from logs.

Simplified log analysis and log management.

More information about what the alerts mean and how they are derived would be useful when determining their significance. Support is good to provide this information though.

>12 months

No.

Excellent.

Fairly straightforward. It does take some time to tune the system to your environment – to prevent getting alerts on activity your find acceptable in your environment.

They do give discounts towards the end of quarters if your renewal is due.

You will wonder how you lived without it.

• Central log aggregation
• Security correlation

It provides greater visibility of host-based and network activity through its HIDS and NIDS functionality.

They should simplify the HIDS agent reporting/custom rule creation.

I've used it for one year.

We had issues but this was due to us receiving improper training from a third party and not necessarily due to the product.

Servers/sensors cap at 2048 host based agent deployments, but servers and sensors are easily scalable for a medium sized business.

10/10

I haven't used anything similar.

AlienVault is willing to offer flexible and competitive pricing.

We also looked at AccelOps, LogRhythm, and IBM QRadar.

If you have any questions, AlienVault's support team is more than willing to help with your installation, implementation, and integration.