SolarWinds : Greatest for log aggregation

Determine A

SolarWinds Safety Occasion Supervisor (SEM) is targeted on log aggregation and risk detection. It could actually simply course of and ahead uncooked occasion log knowledge to exterior functions for additional evaluation utilizing syslog protocols, which is an space the place it stands out from the competitors.

Pricing

• SolarWinds annual SEM subscriptions begin at $2,877.
• Perpetual licensing is offered for round $5,000.

Options

• Automation to remediate some incidents.
• Export log knowledge and share with different groups or distributors.
• Dashboards point out the state of safety, and studies tackle compliance necessities.
• Pre-built connectors pull knowledge from quite a few sources.
• A file integrity checker tracks entry and adjustments made to recordsdata and folders to detect unauthorized or malicious exercise.

Execs

• Good for network-related occasions and analyzing per-host actions, akin to logons, privilege utilization and registry alterations.
• Safety features embrace knowledge encryption, single sign-on and sensible card authorization.
• Capability to limit entry from IPs, block functions and deny entry to detachable media.

Cons

• Dashboards can turn out to be cluttered and arduous to know when processing giant quantities of knowledge.
• Can wrestle with the complexity of very giant enterprise environments.
• Automated doesn’t present a full vary of remediation capabilities.

Splunk Enterprise Safety: Greatest for cloud native environments

Determine B

Splunk Enterprise Safety affords cloud-based security-related occasion notifications and log monitoring. It could actually establish useful resource bottlenecks, failing {hardware}, capability points and different potential points. Because it developed within the period of the cloud, it’s notably effectively suited to cloud-native environments. Splunk Incident Evaluation dashboard Picture: Splunk

Pricing

• Splunk’s complicated pricing construction is cut up into entity, exercise, workload and ingest classes.
• Splunk doesn’t publish actual costs, however person studies place them anyplace from $173 per 30 days as much as $1,800 per GB.

Options

• Menace detection with machine studying, together with 1,400 detections for frameworks akin to MITRE and others.
• Ingest and monitor tens of terabytes of knowledge per day from any supply, structured or unstructured.
• Attribute danger to customers and methods, map alerts to cybersecurity frameworks and set off alerts when danger exceeds thresholds.
• Examine safety occasions or suspicious exercise quickly.

Execs

• Triggers that reply to logged conditions with custom-made response patterns.
• Analytics capabilities are inbuilt, which might produce long-term graphs.
• View a variety of logs and drill down into particular instances or knowledge sources.
• Capability to resolve issues throughout a number of platforms.

Cons

• Some customers think about Splunk to be costly when monitoring giant quantities of knowledge in main enterprise environments.
• The corporate’s just lately introduced acquisition by Cisco could result in lengthy integration delays and lack of progress on its innovation roadmap.

Datadog Safety Monitoring: Greatest for personalisation

Determine C

Datadog has designed its platform to be extremely customizable to person wants. Datadog Safety Monitoring makes it comparatively straightforward to see at a look what’s occurring with all sources being analyzed.

Pricing

• The professional model prices $15 per host per 30 days, and the enterprise model is $23 per host per 30 days.

Options

• Over 350 detection guidelines and greater than 500 integrations with log sources present full visibility into safety operations.
• Capability to see inside any stack or utility at any scale and anyplace.
• Infrastructure monitoring, APM, log administration, machine monitoring, cloud workload monitoring, server monitoring and database monitoring, all included.
• Assemble knowledge from logs and different metrics to supply context and reduce incident response time.

Execs

• Datadog takes a monitoring strategy geared towards analytics and is favored by DevOps and IT to handle cloud and infrastructure efficiency.
• Datadog set up is simple, courtesy of agent deployment.
• Dashboards and interfaces are straightforward to customise.

Cons

• Datadog stops wanting calling itself a whole SIEM platform, as it’s extra targeted on cloud monitoring and safety however has been increasing its cloud SIEM capabilities.
• Datadog lacks a number of the log monitoring capabilities of full-featured SIEM platforms.

LogRhythm SIEM: Greatest for on-premises.

Determine D

LogRhythm’s SIEM software program is designed to be hosted on-premises. It has constructed AI and automation options into its platform. Reporting based mostly on queries is simple to configure. The system integrates effectively with an array of safety and technological options..

Pricing

• Begins at $28,000.
• Quite a lot of pricing choices can be found, akin to perpetual or subscription software program licenses, an infinite knowledge plan and a high-performance plan.

Options

• Heightens the detection of safety and potential threats.
• LogRhythm offers an built-in person expertise.
• Combines enterprise log administration, safety analytics, person entity and behavioral analytics (UEBA), community visitors and behavioral analytics (NTBA) and safety automation and orchestration.
• In addition to an on-prem model, it additionally affords a cloud-based SIEM.

Execs

• Constructed on a machine analytics/knowledge lake know-how basis that’s designed to scale simply.
• Open platform permits for integration with enterprise safety and IT infrastructure.
• Embedded modules, dashboards and guidelines ship risk monitoring, risk looking, risk investigation and incident response.
• Integration with many third-party platforms.
• Person feedback are favorable concerning the velocity and responsiveness of the assist workforce.

Cons

• Giant upfront funding usually wanted for the on-prem model.

RSA NetWitness: Greatest for big enterprises

Determine E

RSA, well-known for its multifactor comfortable and arduous token authentication merchandise, has a powerful footprint within the general safety group. Its NetWitness SIEM is geared extra towards giant companies, with variations that work each on-premises and by way of cloud.

Pricing

• Pricing begins at $857 per node per 30 days.

Options

• NetWitness displays for actionable occasions.
• Conduct analytics observe hacker exercise and recreate full classes to watch the exact anatomy of an assault.
• Intelligence feeds based mostly on customizable data observe and stay key operations.
• Visibility into log knowledge unfold throughout the IT setting

Execs

• Simplifies risk detection, reduces dwell time and helps compliance.
• Centralized log administration and log monitoring for logs generated by public clouds and SaaS functions.
• Identification of suspicious exercise that evades signature-based safety instruments.

Cons

• The educational curve and implementation efforts might be steep.
• Some customers require a considerable amount of rack house.

ManageEngine Log360: Greatest for small companies

ManageEngine Log360 is a SIEM that serves companies of all sizes however is particularly suited to small enterprise deployments. It additionally integrates effectively with a sequence of different safety and monitoring merchandise that the corporate affords.

Pricing

Options

• Detect inside threats, akin to knowledge exfiltration and person account compromise, by recognizing refined adjustments in person exercise.
• Determine suspicious or blocklisted IPs, URLs and domains intruding into your community by correlating your log knowledge with reputed risk feeds.
• Automate responses to occasions with configurable workflows.
• Monitor lively VPN connections and obtain alerts on uncommon VPN actions and VPN entry from malicious sources.

Professional

• Migrate SharePoint environments to Microsoft 365 by deciding on the required SharePoint website customers, teams and permission ranges.
• Audit adjustments in Energetic Listing infrastructure and Azure AD in actual time.
• Uncover and classify delicate recordsdata, audit customers’ file actions and analyze file permissions.
• Detect, disrupt and forestall delicate knowledge leaks by way of endpoints, like USBs and printers, electronic mail and net functions with real-time safety monitoring.

Cons

• Some customers complain of poor assist.
• Might wrestle to scale effectively sufficient in giant, complicated environments.

IBM Safety QRadar SIEM: Greatest for IBM outlets

Determine F

IBM QRadar is a risk detection and response resolution that features an SIEM module. As such, IBM Safety QRadar SIEM is particularly suited to enterprises which are closely invested in IBM instruments and methods, in addition to giant enterprise deployments.

Pricing

• Per node month-to-month value begins at $2,340.

Options

• Accelerated risk response by dashboards that spotlight alerts that matter.
• Makes use of close to real-time analytics to intelligently examine and prioritize high-fidelity alerts based mostly on severity of danger.
• Identifies insider threats and dangerous person habits.
• A part of IBM Cloud Pak for Safety which makes use of AI to supply danger assessments in addition to analytics.

Execs

• Machine learning-based analytics to establish anomalies as potential risk actors.
• QRadar SIEM augments conventional log knowledge by monitoring key community stream knowledge.

Cons

• Lack of integration with different SIEM instruments.
• These not utilizing IBM platforms could discover it troublesome to deploy.

Trellix Safety Operations and Analytics: Greatest for Home windows outlets

Trellix Safety Operations and Analytics comprises the bones of the previous McAfee Enterprise Safety Supervisor SIEM platform and is now a module often known as Trellix Enterprise Safety Supervisor. That SIEM providing was Energetic Listing-based and effectively suited to Home windows environments. However Trellix has expanded it to supply robust cloud assist.

Pricing

• Trellix Digital ESM is priced at $61,294.33 per VM.

Options

• The Trellix Helix SecOps platform is a part of a collection that features SIEM to assist IT take management from incident to detection to response.
• Trellix Insights offers risk intelligence to foretell and prioritize threats and prescribe countermeasures.
• Trellix ePO safety administration platform helps IT management and administer all endpoints from a single console.

Execs

• A central view of potential threats with built-in workflows removes complexity.
• Get larger transparency monitoring customers, functions, networks and gadgets.
• Actual-time risk identification and response reduces lead time to guard towards threats.
• Can combine merchandise from 650+ third-party distributors.

Cons

• The total Trellix suite is required to supply full remediation capabilities.
• Some customers complain that it may be sluggish to reply.

AT&T USM Anyplace: Greatest for asset discovery

AlienVault Unified Safety Administration platform (USM) is now AT&T USM Anyplace. It discovers property and gathers knowledge about working providers, customers, working methods and {hardware} data. This asset focus means it may possibly decide up any gadgets within the setting that it protects.

Pricing

• The necessities model begins at $1,075 per 30 days. The usual begins at $1,695 per 30 days and the premium at $2,595.

Options

• Robotically collects and analyzes knowledge throughout the assault floor.
• Menace intelligence offered by AT&T Alien Labs.
• Helps an ecosystem of AlienApps to orchestrate and automate actions in the direction of different safety applied sciences and reply to incidents.

Execs

• Good for many who need their cybersecurity and SIEM providers managed by another person.

Cons

• Not appropriate for organizations that want to keep up tight management over their very own property for sensitivity or compliance causes.