We performed a comparison between AlienVault OSSIM and USM Anywhere based on real PeerSpot user reviews.
Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
"It is easy to implement (turn on) - does need a skilled analyst to develop queries and playbooks."
"Sentinel has an intuitive, user-friendly way to visualize the data properly. It gives me a solid overview of all the logs. We get a more detailed view that I can't get from the other SIEM tools. It has some IP and URL-specific allow listing"
"The pricing of the product is excellent."
"It has basic out-of-the-box integrations with multiple log sources."
"The Identity Behavior tab furnishes us with the entire history linked to each IP or domain that has either accessed or attempted to access our system."
"There are a lot of things you can explore as a user. You can even go and actively hunt for threats. You can go on the offensive rather than on the defensive."
"The SOAR playbooks are Sentinel's most valuable feature. It gives you a unified toolset for detecting, investigating, and responding to incidents. That's what clearly differentiates Sentinels from its competitors. It's cloud-native, offering end-to-end coverage with more than 120 connectors. All types of data logs can be poured into the system so analysis can happen. That end-to-end visibility gives it the advantage."
"It's easy to use. It's a very good product. It can easily ingest data from anywhere. It has an easily understandable language to perform actions."
"The solution has a very good open source community, and whenever we have problems, we are always able to resolve it online."
"The initial setup is straightforward."
"The paid version of the solution has reporting and better scalability options."
"There are a lot of people you will find using OSSIM since they are also offering OTX as a service"
"The product is easy to use."
"Asset discovery is good."
"AlienVault OSSIM is an enterprise solution that sells easily. It is rated highly by organizations."
"The most valuable features of AlienVault OSSIM are case management, ease of configuration, and investigation."
"AT&T AlienVault USM is good for ELK Stack, the user experience is great because of its architecture. The ELK has a great performance and it has very good speed in the search and Kibana. Additionally, the visuals and dashboards and very nice and customizable."
"The IDS and the threat intelligence are very useful. They are very intuitive and data-rich."
"The vulnerability scanning is helpful to identify the areas that need patching or fixes installed."
"Easy to use, scalable, stable, and very intuitive platform that provides protection against security threats."
"Log-monitoring and alerting enable us to know when things happen that we need to know about."
"The solution is stable."
"The most valuable feature in AT&T AlienVault USM is the reporting."
"It brought our logs into one place for review and set up alarms based on changes we were missing due to lack of having one place for everything to go."
"There is a wider thing called Jupyter Notebooks, which is around the automation side of things. It would be good if there are playbooks that you can utilize without having to have the developer experience to do it in-house. Microsoft could provide more playbooks or more Jupyter Notebooks around MITRE ATT&CK Framework."
"I believe one of the challenges I encountered was the absence of live training sessions, even with the option to pay for them."
"They could use some kind of workbook. There is some limitation doing the editing and creating the workbook."
"The playbook development environment is not as rich as it should be. There are multiple occasions when we face problems while creating the playbook."
"We have been working with multiple customers, and every time we onboard a customer, we are missing an essential feature that surprisingly doesn't exist in Sentinel. We searched the forums and knowledge bases but couldn't find a solution. When you onboard new customers, you need to enable the data connectors. That part is easy, but you must create rules from scratch for every associated connector. You click "next," "next," "next," and it requires five clicks for each analytical rule. Imagine we have a customer with 150 rules."
"The performance could be improved. If I create 15 to 20 lines for a single-use case in KQL, sometimes it takes more time to execute. If I create use cases within a certain timeline, the result will show in .01 seconds. A complex query takes more time to get results."
"The reporting could be more structured."
"Sentinel provides decent visibility, but it's sometimes a little cumbersome to get to the information I want because there is so much information. I would also like to see more seamless integration between Sentinel and third-party security products."
"When comparing AlienVault OSSIM to other solutions it looks a bit outdated. Additionally, they need to improve their integration."
"The documentation could be improved."
"The correlation engine needs to be improved."
"They can add more compliance templates."
"It's under heavy traffic. If you have heavy traffic, the system is slow."
"AlienVault OSSIM’s configuration and integration could be a little easier."
"The initial setup was a bit complex. You've got to do a lot of reading. It's not an intuitive implementation."
"The incidence reporting could be better."
"The AT&T AlienVault USM is okay, but the relational database is not very good for large amounts of data. For example, many logs cannot be processed. It has been very slow for the queries and some data which are large, it is not very good in this case."
"The other thing is the agent is OSSEC. They needed to create its own agent to help to find threats on the devices that it happens to be installed."
"Source material on the forums to be more up-to-date with the changes happening within the product. Forums being out-of-date with information due to the changes makes troubleshooting a little more difficult - specific to the HIDS agents."
"Maybe logs are the problem, as the database query is too slow. If you want to search something, you need time to find it."
"I feel that some areas of improvement would be vulnerability scanning. We use a separate product that seems to do a much better job."
"The solution already has quite good tools, however, they need better integration tools for linking with Office 365, Google Suite, and so on."
"We develop additional rules and scripts to make it more usable."
"I'd like to see a dashboard that's a little more descriptive."
AlienVault OSSIM is ranked 14th in Security Information and Event Management (SIEM) with 27 reviews while USM Anywhere is ranked 11th in Security Information and Event Management (SIEM) with 113 reviews. AlienVault OSSIM is rated 7.4, while USM Anywhere is rated 8.4. The top reviewer of AlienVault OSSIM writes "An easy-to-scale open-source solution used for monitoring events on devices ". On the other hand, the top reviewer of USM Anywhere writes "Easy to use and affordable". AlienVault OSSIM is most compared with Wazuh, Elastic Security, Splunk Enterprise Security, Fortinet FortiSIEM and AWS Security Hub, whereas USM Anywhere is most compared with Wazuh, IBM Security QRadar, Splunk Enterprise Security, Rapid7 InsightIDR and LogRhythm SIEM. See our AlienVault OSSIM vs. USM Anywhere report.
See our list of best Security Information and Event Management (SIEM) vendors.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
