Overview
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as…
TrustRadius Insights
Empowering Security Zenith with Unified Vigilance.
will I continue to use USM, Yes I would
Excellent security for your machine
MSSP Review
Great product but out of the box it needs a lot of work.
Great if you can deploy and manage on-premises SIEMs
AlienVault - Not Worth the Price
AlienVault USM Anywhere, a SIEM that is easy on your pocket.
Unbeatable Security Machine
AlienVault USM Provides Heightened Security Awareness in the Legal Services Industry
Best product I've seen for a smaller enterprise network.
Great SIEM for enterprise environments
AlienVault USM is a really beneficial SIEM solution.
Great tool for medium shops
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Centralized event and log data collection (8)8.585%
- Correlation (8)8.484%
- Event and log normalization/management (8)8.080%
- Custom dashboards and workspaces (8)7.070%
Reviewer Pros & Cons
Pricing
Essentials
$1,075
Standard
$1,695
Premium
$2,595
Entry-level set up fee?
- Setup fee optional
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Features
Security Information and Event Management (SIEM)
Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools
- 8.5Centralized event and log data collection(8) Ratings
Effectiveness of real-time centralized event and log data collection
- 8.4Correlation(8) Ratings
Correlation of logs and events to pinpoint significant threats
- 8Event and log normalization/management(8) Ratings
Ability to normalize event syntax so that logs can be compared and are machine-understandable
- 8.6Deployment flexibility(7) Ratings
Ability to tune system to maximize threat detection and minimize false positives
- 7.3Integration with Identity and Access Management Tools(5) Ratings
Integration with access control tools like Active Directory and LDAP
- 7Custom dashboards and workspaces(8) Ratings
dashboards that can be customized to meet the needs of specific groups
- 8.1Host and network-based intrusion detection(5) Ratings
Ability to detect both endpoint intrusion and network ingress detection
Product Details
- About
- Competitors
- Tech Details
- Downloadables
- FAQs
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as well as continuous threat intelligence updates. The vendor states that even for resource-limited IT security teams, AlienVault USM can be affordable, fast to deploy, and easy to use. It eliminates the need to deploy, integrate, and maintain multiple point solutions in the data center.
Smart, automated data collection & analysis: USM Anywhere automatically collects and analyzes data across the attack surface, helping to quickly gain centralized security visibility without the complexity of multiple disparate security technologies.
Automated threat detection powered by AT&T Alien Labs: With threat intelligence provided by AT&T Alien Labs, USM Anywhere is updated automatically to stay on top of evolving and emerging threats, so the security team can focus on responding to alerts.
Incident response orchestration with AlienApps: USM Anywhere supports a growing ecosystem of AlienApps, enabling the user to orchestrate and automate actions towards other security technologies, able to respond to incidents quickly and easily.
AlienVault USM Features
Security Information and Event Management (SIEM) Features
- Supported: Centralized event and log data collection
- Supported: Correlation
- Supported: Event and log normalization/management
- Supported: Deployment flexibility
- Supported: Integration with Identity and Access Management Tools
- Supported: Custom dashboards and workspaces
- Supported: Host and network-based intrusion detection
Additional Features
- Supported: AlienVault Open Threat Exchange
AlienVault USM Screenshots
AlienVault USM Videos
AlienVault USM Competitors
AlienVault USM Technical Details
Deployment Types | Software as a Service (SaaS), Cloud, or Web-Based |
---|---|
Operating Systems | Unspecified |
Mobile Application | No |
Supported Countries | Global |
AlienVault USM Downloadables
- Unified Security Management vs. SIEM: a Technical Comparison
- AlienVault USM Anywhere: Datasheet
- AlienVault Fast Facts
- AlienVault USM Anywhere: Datasheet
- Beginner’s Guide to Open Source Intrusion Detection Tools
- SIEM for Beginners: Everything You Wanted to Know About Log Management But Were Afraid to Ask
Frequently Asked Questions
Comparisons
Compare with
Reviews and Ratings
(733)Community Insights
- Business Problems Solved
- Recommendations
Users have found AlienVault USM to be a valuable SIEM solution for centralizing and searching log data from a large number of network attached devices. This platform is being used for various use cases such as vulnerability management, scanning, malware detection, and monitoring malicious network traffic. It is considered a good SIEM solution for organizations new to security operational logging or those with a smaller staff and budget. The product has been praised for its integrated feature sets, including HIDS, NIDS, FIM, and security alerting capabilities. The inclusion of features like vulnerability scanning and file integrity monitoring has extended its value for organizations in the early stages of cybersecurity program development. Many users have experienced real-time alerts, enabling them to respond to security incidents and compromised passwords more quickly. Furthermore, AlienVault is used for a range of functions such as SIEM, vulnerability scanning, asset discovery, and investigations. It provides organizations with a centralized log collection site, allowing them to monitor and address new problems more effectively. The platform has been effective in helping organizations meet regulatory compliance requirements and improve SOC operations. Additionally, AlienVault is used to analyze network traffic, Windows Event Logs, and other security events, helping organizations improve network security and protect their customers. It solves security challenges related to device and software visibility, monitoring for anomalous events, and ensuring patch management. Users appreciate the simplicity of deployment and the robustness of the interface. The support team is highly responsive and knowledgeable.
AlienVault USM Anywhere is used by organizations to easily identify security incidents happening across their infrastructure and comply with PCI-DSS compliance requirements. MSSPs utilize AlienVault USM Anywhere to provide their customers with best-in-class threat monitoring and response services. It is also used to monitor cloud environments, scanning and alerting for any known vulnerabilities or activity on servers. AlienVault helps organizations with auditing purposes by monitoring cloud permissions and changes to security. Additionally, it is deployed to customers for monitoring and is used by NSOCs to monitor their networks. AlienVault has been implemented across organizations, covering server assets and providing granular logging on systems and networks. It helps in raising alarms/alerts and mitigating network-related activities. AlienVault collects and alerts on network and system activity across the entire organization, making it easy to filter for important data. The product centralizes log data and helps perform vulnerability analysis and threat detection. It assists in security patching and monitoring within AWS environments. Users appreciate the ease of use and configuration of the cloud-based panel. AlienVault is implemented and managed for clients as a recommended SIEM solution, collecting and normalizing logs from various data sources. It is used throughout organizations to gain insight into network and server events, manage and correlate logs, and recognize anomalous activity. Users have been able to set up alerts for specific events and policies, effectively managing systems and alerts in place, monitoring multiple client environments, and identifying issues that clients may have missed.
AlienVault USM Anywhere is praised for its cost-effectiveness compared to other SIEM solutions on the market. Users appreciate its threat intelligence capabilities, ease of use, user-friendly interface, and simplicity of deployment. The built-in correlation rules require minimal setup and provide high-quality results. Asset management and scanning features help users stay on top of monitoring assets, including dynamic and static asset lists. The integration of OTX into USM Anywhere allows for up-to-date threat intelligence and pulse subscriptions.
The software plays a crucial role in monitoring and alerting when anomalies occur, aiding in threat detection, compliance management, log collection, and vulnerability scanning. It helps organizations stay up to speed on new vulnerabilities and supports agile business initiatives by aiding analysts in identifying cyber threats and providing access to threat cross-referencing data. AlienVault USM Anywhere is deployed to monitor AWS cloud environments, attain compliance, identify threats, and facilitate auditing of non-emergency configuration changes and vulnerability monitoring.
Overall, AlienVault USM Anywhere provides centralized security monitoring, incident response capabilities, compliance reporting features, vulnerability assessment tools, real-time SIEM functionality, as well as asset discovery and user activity monitoring capabilities. It has been widely adopted across various industries for enhancing security posture and gaining comprehensive visibility into network activities.
Based on user recommendations, AlienVault USM receives the following common recommendations:
-
AlienVault USM is recommended for cost-conscious companies and small to medium businesses due to its affordability and effectiveness. Users find it to be a great tool for analyzing and reacting to threats, offering excellent value for the price.
-
Users suggest exploring alternative SIEM choices and discussing functionality and configuration requirements. Logrhythm is mentioned as a possible alternate SIEM choice, especially for high-end functionality needs. It is advised to compare features and select the SIEM system that offers the best cost for desired features.
-
To maximize the experience with AlienVault USM, users recommend taking advantage of training opportunities provided by AlienVault. Joining official training sessions allows users to learn best practices from other users and gain comprehensive knowledge of the product. Users also recommend utilizing forums, support, webinars, and videos offered by AlienVault to enhance understanding and achieve optimal results.
Overall, AlienVault USM is regarded as a cost-effective solution suitable for organizations with data privacy and security priorities. The product's flexibility, community-created intelligence, and continual improvement are also highlighted by users. While some mention areas for improvement, such as support stability and module quality, the general consensus is that AlienVault USM delivers reliable security enhancements and cost savings.
Attribute Ratings
- 7.2Likelihood to Renew18 ratings
- 6.4Availability3 ratings
- 7.3Performance3 ratings
- 6.7Usability34 ratings
- 7.3Support Rating25 ratings
- 8.3Online Training6 ratings
- 4.5In-Person Training1 rating
- 6.4Implementation Rating38 ratings
- 8Configurability3 ratings
- 6.3Product Scalability3 ratings
- 7.3Ease of integration3 ratings
- 8.2Vendor pre-sale3 ratings
- 7.6Vendor post-sale3 ratings
Reviews
(1-25 of 389)- Asset discovery.
- Real-time threat detection.
- Centralized log management.
- Provides actionable insights into emerging threats.
- Intrusion detection.
- Enhancing user interface intuitiveness.
- Granular customization options for alerts and reporting.
- Integration with third-party tools and expanding support for emerging threat intelligence sources would be beneficial since the alien app only supports a few.
Empowering Security Zenith with Unified Vigilance.
- Unified Security Monitoring and Threat Detection.
- Integrated Incident Response.
- Compliance Management and Reporting.
- User Interface and Ease of Use.
- Customization and Flexibility.
- Enhanced Automation and Orchestration.
will I continue to use USM, Yes I would
- Investigations
- Event collection and alerting
- correlation rules
- N/A
- CBT training
- training
Excellent security for your machine
- Security
- User operations tracking
- Notifications pop up is annoying
- Little more improvement in UI side
MSSP Review
- Threat intelligence look-ups
- Asset management
- Vulnerability scanning
- Better UI/workflow for alarms
- Better alarm management (add notes/set status)
- UX/UI responsive and easy to navigate.
- Covers wide variety of systems and devices.
- Ease of getting sensors up and running.
- More simplified dashboards would help not overwhelm new users.
- Use more industry-standard terms for items.
- Tech support that actually reads your questions prior to replying with canned responses.
- Update their KBs to reflect real-world scenarios. We've ran across several places where NxLog's settings in the KB were incorrect and support had no idea, kept telling us that we were wrong despite demonstrating to them the correct settings.
Great if you can deploy and manage on-premises SIEMs
- OTX
- HIDS
- Asset discovery
- Literal terminology used
- UI
- Troubleshooting
AlienVault - Not Worth the Price
- Log collection
- Users cannot share views across an organization.
- Views and reports could be more interchangeable.
- Descriptions of events are based upon each individual asset reporting and not a general grouping of events according to any framework or standards. This makes it difficult for the administrator/user as they would need to know each and every asset and their respective event descriptions.
AlienVault USM Anywhere, a SIEM that is easy on your pocket.
- Deployment is straight forward
- AlienVault USM forensic and response app is great. You can create rules to shut down, disable networking, etc. automatically if Windows becomes infected.
- AlienVault allows seamless integration with third-party products like Cisco, Office365 etc.
- A lot of false-positive alarms
Unbeatable Security Machine
- Extremely customizable and versatile product.
- Useful dashboard and UI is easy to navigate.
- Log plugins parse logs from a variety of sources into a readable format
- AlienApps provide out-of-the-box integration with other solutions.
- The product requires a considerable amount of time to set up.
- Setting up log filters in order to prevent USM from quickly running out of space is very time-consuming.
- The product will stop working if the logs run out of space. There is no way to set retention rules to automatically clean up old logs.
- Identifies possible spurious identify (Windows AD) changes and manipulation.
- Identifies installation of possible malware.
- Analyzed all activities and filters for only those with a potential negative security impact.
- Closing an Investigation does not close the attached alarms.
- Vulnerability Scanning interfaces/process is complicated to use.
- Vulnerability Scanning allows far too many assets to be specified at once, resulting in timeouts and ambiguous results.
Best product I've seen for a smaller enterprise network.
- Security event correlation.
- Security event alarms
- Security event investigations
- Potential vulnerability identification
Great SIEM for enterprise environments
- Consolidation of logs from various sources.
- Alerting on particular activities.
- Alerting on anomalous activities.
- Time consuming implementation that requires professional services.
- Pricing model based on the amount of data can be expensive.
- Training for the product is available, but at additional expense.
AlienVault USM is a really beneficial SIEM solution.
We also implement and manage AlienVault USM deployments for clients as our recommended SIEM solution.
- Ease of deployment and quick to get operating.
- Wide range of plugins and log receivers to ingest logs from many sources.
- Simple interface and dashboard makes daily operation quick and easy.
- Custom notification templates can be limited - it is not easy to get custom email alert content for example.
- Some network configuration on premise is needed to take full advantage of NIDS (port/traffic mirroring for example).
- Vulnerability scanning and reporting can be a bit sparse if you are used to the likes of Nessus.
While it works with fully on-premise deployments (Exchange, file server etc), additional configuration for log correlations and alerting will likely be needed. Also for complex networks, getting the required port mirroring to ingest all network traffic can be difficult.
Great tool for medium shops
- Stability
- Content filtering
- Documentation
- Self service onboarding
- In-app recommendations for common configurations.
- Improved error resolution.
Aliens are coming! or are they?
- Easy to understand what is going on with the server.
- Works on firewalls.
- Alerts are easy to set up.
- Support isn't always the best.
- Hard to initially set up.
1) Logging aggregation and actionable insights using log correlation.
2) Threat hunting & intel.
3) Vulnerability management and validation of our separate patch automation software.
4) Security orchestration.
5) Asset discovery and inventory management.
- Log Correlation: The engineers at Alienvault/AT&T Cybersecurity have included a great integrated rule set (which continues to grow) to save analysts time on combing through logs and instead executing threat hunts, investigations, and remedial activities.
- Single pane-of-glass for all security activities from the convenience and efficiency of a SaaS web console, being that USM has deep integrations with over a dozen major software platforms (Office 365, GSuite, ZScaler, Box, etc.) and what they call plugins which interpret log and SIEM data from hundreds of vendors and platforms like Meraki, CrowdStrike, Aruba switches and AP's, etc.
- Great value! You can pay the same or more for other big name SIEM vendors that offer less features than this platform. Plus, even if you begin ingesting too much log data, you can filter specifics types of logs (for example, ones that have no impact to security) to bring data ingestion in line with your subscription level. The onboarding team did a great job in right-sizing our subscription plan, so this hasn't been a problem.
- Vulnerability scanning is currently done by authentication into the host over the network, even when the AlienVault USM agent is installed on an endpoint. It would be nice to have near-real-time vulnerability information provided via the agents. This would also delete the need for specially-configured remote-access admin service accounts on endpoints, which is just another account that has to be administered, namely password management and auditing for potential abuse and compromise.
- Endpoint agent support for ARM architecture is just starting to get going -- wide availability across Linux and MS Windows/Server platforms won't be available until possibly circa mid-2021. Fortunately, at least general asset scan info, authenticated vulnerability scans, etc. still provide a good deal of security inspection into these devices.
- Making some UI settings persist across logins on the web console is still lacking. Would also be nice to change a "detailed view" to icons/thumbnails/tiles. UI is very efficient in some aspects but frustrating in others.
A MSP and especially MSSP would do well with this while organizations that pay for MSSP services might not need AlienVault USM.
One of the best SIEMs out there
- Easy intergration using APIs
- Bespoke alarm configuration
- OTX database
- Needs to be fine tuned to get any valuable insight
- Requires alot of resourses when running in VMs
- Cost makes it hard to sell to smaller buisnesses
The system may slow down considerably when a large number of events/logs are fed in the dashboard, so ensure there is enough storage each month.
Honest Opinions Only
- Vulnerability visibility and remediation
- Log management and compilation
- The vulnerability scanner could use some tweaking as I feel it isn't always working
- The integrations could use some more testing
Limited Use Feedback
- The system is intuitive and easy to navigate.
- Integration with key services like AWS and other cloud applications is crucial.
- Links to MITRE, root cause, and remediation recommendations is also a very nice feature.
- Difficult to configure for initial set up.
- Key features like alarms for brute force attacks or malware should be automatic instead of needing to be created and configured.
- Remediation should be taken one step further past recommendations to actual solutions able to be purchased or assisted by AlienVault.
Solid unified security solution
- Endpoint detection notification with detailed logs
- Vulnerability detection
- Investigation tracking
- Endpoint protection agent rollout
- Vulnerability management historical tracking
- Endpoint tracking across DHCP infrastructure
It is very efficient as a supporting tool if SOC work is outsourced or the monitoring requirements are not very intense.
First use of AlienVault USM
- Customizable
- Easy installation
- Scalable
- NXLog agent compatibility with the Spanish language.
- OSSEC Agent Compatibility
Great introduction to SIEMs
- Great documentation.
- Overall good support.
- Nice UI.
- UI can be wonky at times.
- Log search from the SIEM UI is quite troublesome as every filter applied performs the search again.
- Some features can stop working seemingly out of nowhere, requiring contacting support.
AlienVault USM anywhere
- Authenticated vulnerability assessment
- Authenticated asset discovery
- Incident response
- Log correlation
- Ability to do an external vulnerability assessment.
- User training awareness through the console for administrators to educate users.
- Allow more remediation options for administrators to endusers.
Built with security professionals in mind.
- Great log aggregation and management tool.
- Great intrusion detection and investigation tool.
- Very easy to set up and get it going in a very few steps.
- AlienVault can look into providing log collection methods other than using a sensor.
- AlienVault USM capabilities should be replicated to AlienVault OSSIM except that with OSSIM there wouldn't be any support.