Overview
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as…
TrustRadius Insights
Empowering Security Zenith with Unified Vigilance.
will I continue to use USM, Yes I would
Excellent security for your machine
MSSP Review
Great product but out of the box it needs a lot of work.
Great if you can deploy and manage on-premises SIEMs
AlienVault - Not Worth the Price
AlienVault USM Anywhere, a SIEM that is easy on your pocket.
Unbeatable Security Machine
AlienVault USM Provides Heightened Security Awareness in the Legal Services Industry
Best product I've seen for a smaller enterprise network.
Great SIEM for enterprise environments
AlienVault USM is a really beneficial SIEM solution.
Great tool for medium shops
Awards
Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards
Popular Features
- Centralized event and log data collection (8)8.585%
- Correlation (8)8.484%
- Event and log normalization/management (8)8.080%
- Custom dashboards and workspaces (8)7.070%
Reviewer Pros & Cons
Pricing
Essentials
$1,075
Standard
$1,695
Premium
$2,595
Entry-level set up fee?
- Setup fee optional
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting/Integration Services
Features
Security Information and Event Management (SIEM)
Security Information and Event Management is a category of security software that allows security analysts to look at a more comprehensive view of security logs and events than would be possible by looking at the log files of individual, point security tools
- 8.5Centralized event and log data collection(8) Ratings
Effectiveness of real-time centralized event and log data collection
- 8.4Correlation(8) Ratings
Correlation of logs and events to pinpoint significant threats
- 8Event and log normalization/management(8) Ratings
Ability to normalize event syntax so that logs can be compared and are machine-understandable
- 8.6Deployment flexibility(7) Ratings
Ability to tune system to maximize threat detection and minimize false positives
- 7.3Integration with Identity and Access Management Tools(5) Ratings
Integration with access control tools like Active Directory and LDAP
- 7Custom dashboards and workspaces(8) Ratings
dashboards that can be customized to meet the needs of specific groups
- 8Host and network-based intrusion detection(5) Ratings
Ability to detect both endpoint intrusion and network ingress detection
Product Details
- About
- Competitors
- Tech Details
- Downloadables
- FAQs
What is AlienVault USM?
AlienVault® Unified Security Management® (USM) delivers threat detection, incident response, and compliance management in one unified platform. It is designed to combine all the essential security capabilities needed for effective security monitoring across cloud and on-premises environments, including SIEM, intrusion detection, vulnerability management, as well as continuous threat intelligence updates. The vendor states that even for resource-limited IT security teams, AlienVault USM can be affordable, fast to deploy, and easy to use. It eliminates the need to deploy, integrate, and maintain multiple point solutions in the data center.
Smart, automated data collection & analysis: USM Anywhere automatically collects and analyzes data across the attack surface, helping to quickly gain centralized security visibility without the complexity of multiple disparate security technologies.
Automated threat detection powered by AT&T Alien Labs: With threat intelligence provided by AT&T Alien Labs, USM Anywhere is updated automatically to stay on top of evolving and emerging threats, so the security team can focus on responding to alerts.
Incident response orchestration with AlienApps: USM Anywhere supports a growing ecosystem of AlienApps, enabling the user to orchestrate and automate actions towards other security technologies, able to respond to incidents quickly and easily.
AlienVault USM Features
Security Information and Event Management (SIEM) Features
- Supported: Centralized event and log data collection
- Supported: Correlation
- Supported: Event and log normalization/management
- Supported: Deployment flexibility
- Supported: Integration with Identity and Access Management Tools
- Supported: Custom dashboards and workspaces
- Supported: Host and network-based intrusion detection
Additional Features
- Supported: AlienVault Open Threat Exchange
AlienVault USM Screenshots
AlienVault USM Videos
AlienVault USM Competitors
AlienVault USM Technical Details
Deployment Types | Software as a Service (SaaS), Cloud, or Web-Based |
---|---|
Operating Systems | Unspecified |
Mobile Application | No |
Supported Countries | Global |
AlienVault USM Downloadables
- Unified Security Management vs. SIEM: a Technical Comparison
- AlienVault USM Anywhere: Datasheet
- AlienVault Fast Facts
- AlienVault USM Anywhere: Datasheet
- Beginner’s Guide to Open Source Intrusion Detection Tools
- SIEM for Beginners: Everything You Wanted to Know About Log Management But Were Afraid to Ask
Frequently Asked Questions
Comparisons
Compare with
Reviews and Ratings
(733)Community Insights
- Business Problems Solved
- Recommendations
Users have found AlienVault USM to be a valuable SIEM solution for centralizing and searching log data from a large number of network attached devices. This platform is being used for various use cases such as vulnerability management, scanning, malware detection, and monitoring malicious network traffic. It is considered a good SIEM solution for organizations new to security operational logging or those with a smaller staff and budget. The product has been praised for its integrated feature sets, including HIDS, NIDS, FIM, and security alerting capabilities. The inclusion of features like vulnerability scanning and file integrity monitoring has extended its value for organizations in the early stages of cybersecurity program development. Many users have experienced real-time alerts, enabling them to respond to security incidents and compromised passwords more quickly. Furthermore, AlienVault is used for a range of functions such as SIEM, vulnerability scanning, asset discovery, and investigations. It provides organizations with a centralized log collection site, allowing them to monitor and address new problems more effectively. The platform has been effective in helping organizations meet regulatory compliance requirements and improve SOC operations. Additionally, AlienVault is used to analyze network traffic, Windows Event Logs, and other security events, helping organizations improve network security and protect their customers. It solves security challenges related to device and software visibility, monitoring for anomalous events, and ensuring patch management. Users appreciate the simplicity of deployment and the robustness of the interface. The support team is highly responsive and knowledgeable.
AlienVault USM Anywhere is used by organizations to easily identify security incidents happening across their infrastructure and comply with PCI-DSS compliance requirements. MSSPs utilize AlienVault USM Anywhere to provide their customers with best-in-class threat monitoring and response services. It is also used to monitor cloud environments, scanning and alerting for any known vulnerabilities or activity on servers. AlienVault helps organizations with auditing purposes by monitoring cloud permissions and changes to security. Additionally, it is deployed to customers for monitoring and is used by NSOCs to monitor their networks. AlienVault has been implemented across organizations, covering server assets and providing granular logging on systems and networks. It helps in raising alarms/alerts and mitigating network-related activities. AlienVault collects and alerts on network and system activity across the entire organization, making it easy to filter for important data. The product centralizes log data and helps perform vulnerability analysis and threat detection. It assists in security patching and monitoring within AWS environments. Users appreciate the ease of use and configuration of the cloud-based panel. AlienVault is implemented and managed for clients as a recommended SIEM solution, collecting and normalizing logs from various data sources. It is used throughout organizations to gain insight into network and server events, manage and correlate logs, and recognize anomalous activity. Users have been able to set up alerts for specific events and policies, effectively managing systems and alerts in place, monitoring multiple client environments, and identifying issues that clients may have missed.
AlienVault USM Anywhere is praised for its cost-effectiveness compared to other SIEM solutions on the market. Users appreciate its threat intelligence capabilities, ease of use, user-friendly interface, and simplicity of deployment. The built-in correlation rules require minimal setup and provide high-quality results. Asset management and scanning features help users stay on top of monitoring assets, including dynamic and static asset lists. The integration of OTX into USM Anywhere allows for up-to-date threat intelligence and pulse subscriptions.
The software plays a crucial role in monitoring and alerting when anomalies occur, aiding in threat detection, compliance management, log collection, and vulnerability scanning. It helps organizations stay up to speed on new vulnerabilities and supports agile business initiatives by aiding analysts in identifying cyber threats and providing access to threat cross-referencing data. AlienVault USM Anywhere is deployed to monitor AWS cloud environments, attain compliance, identify threats, and facilitate auditing of non-emergency configuration changes and vulnerability monitoring.
Overall, AlienVault USM Anywhere provides centralized security monitoring, incident response capabilities, compliance reporting features, vulnerability assessment tools, real-time SIEM functionality, as well as asset discovery and user activity monitoring capabilities. It has been widely adopted across various industries for enhancing security posture and gaining comprehensive visibility into network activities.
Based on user recommendations, AlienVault USM receives the following common recommendations:
-
AlienVault USM is recommended for cost-conscious companies and small to medium businesses due to its affordability and effectiveness. Users find it to be a great tool for analyzing and reacting to threats, offering excellent value for the price.
-
Users suggest exploring alternative SIEM choices and discussing functionality and configuration requirements. Logrhythm is mentioned as a possible alternate SIEM choice, especially for high-end functionality needs. It is advised to compare features and select the SIEM system that offers the best cost for desired features.
-
To maximize the experience with AlienVault USM, users recommend taking advantage of training opportunities provided by AlienVault. Joining official training sessions allows users to learn best practices from other users and gain comprehensive knowledge of the product. Users also recommend utilizing forums, support, webinars, and videos offered by AlienVault to enhance understanding and achieve optimal results.
Overall, AlienVault USM is regarded as a cost-effective solution suitable for organizations with data privacy and security priorities. The product's flexibility, community-created intelligence, and continual improvement are also highlighted by users. While some mention areas for improvement, such as support stability and module quality, the general consensus is that AlienVault USM delivers reliable security enhancements and cost savings.
Attribute Ratings
- 7.2Likelihood to Renew18 ratings
- 6.4Availability3 ratings
- 7.3Performance3 ratings
- 6.7Usability34 ratings
- 7.3Support Rating25 ratings
- 8.3Online Training6 ratings
- 4.5In-Person Training1 rating
- 6.4Implementation Rating38 ratings
- 8Configurability3 ratings
- 6.3Product Scalability3 ratings
- 7.3Ease of integration3 ratings
- 8.2Vendor pre-sale3 ratings
- 7.6Vendor post-sale3 ratings
Reviews
(1-3 of 3)- Alienvault USM is THOROUGH. We have a highly integrated workspace that's most SAAS, and I monitor those integrations and their security with AV. If I am trying to track the uptime of a laptop, I don't go to VPN or our Directory Services... I go to AV.
- As I mentioned before, we use Sophos to protect our laptops. If a questionable file shows up on someones laptop, I hear about it from AlienVault before I hear about it from our Sophos service.
- The OTX Pulse feature is a built-in feature that lets you subscribe to industries and you are notified about new threats that affect that industry on a daily basis. The pulse alerts are added to your AV watchlist.
- Personally, I've wished I could purchase a service that would configure AV for my environment. I get a lot of traffic on a daily basis and I almost need to hire an analyst that just works on AV.
- Some of the filters when looking for a specific alert aren't that easy to use.
My boss, the CIO/CTO uses the reporting functionality.
- Syslog aggregation that was previously not being collected and parsed for vulnerabilities and malicious activity
- Intrusion detection. My heart stopped when I started working here and found out that there was only a basic firewall protecting software assets and end users.
- In depth endpoint scanning. This reveals patch updates, vulnerabilities, and improperly configured security settings that might be considered as ideal vectors for penetration.
- Bonus: we weren't actively seeking this, but the Integrations with G Suite, Sophos, and plugins for our networking gear have been an incredible boon and greatly increased visibility into our infrastructure.
- As I mentioned before, the Integrations and Plugins with other SaaS services we're using and plugins for other components of our infrastructure was a nice bonus feature we weren't expecting
- We were able to configure custom alerts for our staging and production web services and cancel Papertrail.
- This isn't in production yet, but I hope to do more work with deep scans and alerting and replace our Automox subscription.
- This isn't in production yet, but I hope to do more work with deep scans and alerting and replace our Automox subscription.
- I hope to further integrate AlienVault into our AWS infrastructure. We have several accounts that use VPC peering and ideally, all syslog traffic would route through the central VPC to the AlienVault collector.
- As our Cloud Services providers keep growing, I'd consider adding another collector to those services as well.
- Product Features
- Product Usability
- Product Reputation
- Analyst Reports
- Implemented in-house
- Educating my C-levels on what AlienVault is and why we need it. Again, probably a problem faced more commonly in SMBs. The AlienVault sales team was a huge help in this and didn't seem too pushy.
- My lack of knowledge. I learn by doing and trying and usually breaking things. In this case, I forced myself to learn the tool via traditional means.
- The sheer volume of things you can do with this tool can be daunting if you've never used it. Think of the first time you logged in to AWS or Azure and saw all those features staring at you without a clear picture of where to start.
- Online training
The support engineer walked me through the vulnerability though I did have an understanding already, sent me some links of Intel's plans on resolving the problem, walked me through some settings in vSphere to disable a feature that was generating the alerts, and fine-tuned the alert to reduce the number of false-positives it was generating.
- I think it's brilliant that they've got so many third-party plugins built for log ingestion that just work. They're uncomplicated and AlienvVault even helped me build my own plug-in when I found they did not have a plug-in for Ubiquiti products.
- Regarding computer scanning, I really enjoy the system they've built centered on building a list of credentials and being able to simply right-click and deploy credentials on a given computer. Once this happens, which takes just a few moments, the same right-click menu let's you perform simple or in-depth scans on that machine.
- The SaaS or Cloud integrations they have work well and are fairly easy to navigate and configure.
- Some of the things I found a bit unnecessarily complex is the deployment of the USM Sensors. The AWS Cloudfront deployment was especially complicated. Once it was deployed though, it's been great.
- Suppression filters are always a challenge because it's not always clear what you need to keep from the dozen or so things listed in an alert and what you can remove and still have it be a functional filter.
- G suite
- Sophos
- Office365
- n/a
- File import/export
- API (e.g. SOAP or REST)
AlienVault is a very good investment
The support is available to help if needed!
It helps to better understand what happens on the network as well.
- Monitoring: The possibility to monitor all devices of your network with SNMP management
- Vulnerability scan: Very simple and powerfull feature. It scans your network and gives you all device vulnerabilities on your LAN.
- Nagios module: Integrated Tools in AlienVault Unified Security Management Platform. Very useful to have all theses tools in one place.
- False positive: there are still too much false positives detected when we use the alarm module. A lot of packets are caught in severity medium or high but are not threats. It is just standard traffic.
AlienVault Unified Security Management is less appropriate in a small network.
We are using the product to supervise the network.
- Security threats
- Log tracks
- Alerts
- To generate attack list before the weekly security meeting
- Alert every time there is a change in AD or in the firewall
- Price
- Product Features
- Product Reputation
- Implemented in-house
configuration
quick training
- Configuration on our infrastructure
- Online training
- Self-taught
- List the past attacks
- Sending an email with understandable details of the event every time it happend
Reports complete in a reasonable time frame.
AlienVault Unified Security Management integrates with any other software or systems, and does not tend to slow them down.
- Active directory
- Firewall
- Switch
- SNMP traps of all network devices
- Single Signon
There were no unexpected impacts.
- fix glitches
- fix the glitches still not fixed.
AlienVault USM good for your business?
- Traffic Analysis
- OTX feed intelligence
- File Integrity Monitoring
- Threat Scanning
- Asset Management depends too much on DNS
- Threat scanner could have more functionality
- McAfee Nitro and RSA enVision
- Log Analysis
- File Integrity Management
- Threat Scanning
- Alerting on large file transfers from net flow
- Asset Management
- Enhanced Threat Management
- Price
- Product Features
- Positive Sales Experience with the Vendor
- Implemented in-house
- File Integrity Monitoring -- Agent Rollout
- Disk IO during logger rollout
- Online training
- In-person training
- Self-taught
- Reviewing Alerts
- Dashboard graphs
- File Integrity Monitoring
- Menu systems
- Threat menu and scheduling
- OTX maps
- Netflow setup
- Advanced Threat Management
- Asset Management
- File Integrity agent setup
- Correlation Event setup
- SocVue software
- ELK (elastic search, logstash and kibana)
- File import/export
- API (e.g. SOAP or REST)
- Performance
- Dashboard
- Log Analysis
- Documented API
- Asset management
- Better plugin correlation support