LogRhythm UEBA vs Microsoft Defender for Identity comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

LogRhythm UEBA
Average Rating
7.2
Number of Reviews
10
Ranking in other categories
User Entity Behavior Analytics (UEBA) (12th), Extended Detection and Response (XDR) (22nd)
Microsoft Defender for Iden...
Average Rating
9.0
Number of Reviews
13
Ranking in other categories
Advanced Threat Protection (ATP) (6th), Microsoft Security Suite (8th), Identity Threat Detection and Response (ITDR) (1st)
 

Mindshare comparison

As of June 2024, in the User Entity Behavior Analytics (UEBA) category, the mindshare of LogRhythm UEBA is 2.0%, down from 3.0% compared to the previous year. The mindshare of Microsoft Defender for Identity is 6.1%, down from 13.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
User Entity Behavior Analytics (UEBA)
Unique Categories:
Extended Detection and Response (XDR)
0.6%
Advanced Threat Protection (ATP)
6.7%
Microsoft Security Suite
7.1%
 

Featured Reviews

EC
Jun 1, 2023
The solution makes it easy to monitor users though it needs to improve its UI
I use the solution for a bit of user monitoring and analysis, and logging events It is easy to monitor users and that is how the solution is adding value to our firm. I think almost all the features in terms of how they assist us in monitoring what is going on in our infrastructure are valuable,…
Dumebi Chukwuemeka - PeerSpot reviewer
Dec 21, 2023
Flexible and adaptable to different security postures and business requirements
I have found the installation process of Microsoft Defender for Identity to be incredibly straightforward. You just download the agents from the Defender portal, move them to your domain controller, and install – simple as that. Once it is up and running, checking reports on our on-premises environment is a breeze. Everything I need is neatly aggregated on the Microsoft Defender portal, making it easy to monitor and manage our identity security. However, there is room for improvement, especially for organizations using proxy servers. Enhancements in this area could streamline the configuration process and make it more seamless, irrespective of the proxy settings in the environment.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution is useful for privilege accounts and super admin accounts. It is beneficial from a security perspective. The tool uses machine learning rather than threshold-based alerts. For instance, it can detect unusual user logins, such as a user logging in from a new browser or location."
"It is easy to monitor users and that is how the solution is adding value to our firm."
"It has a lot of features. It has file integration monitoring."
"The solution's most valuable features are the graphical user interface and the reporting."
"LogRhythm UEBA’s best feature is the dashboard. It provides several graphs, charts, and event logs."
"The most valuable features are file activity monitoring and registry activity monitoring."
"Good capability pinpointing specific cyber incidents."
"The tool's most valuable feature is server threat hunting."
"One of our users had the same password for every personal and company account. That was a problem because she started receiving phishing emails that could compromise all of her accounts. Defender told us that the user was not changing their password."
"Defender for Identity has not affected the end-user experience."
"The basic security monitoring at its core feature is the most valuable aspect. But also the investigative parts, the historical logging of events over the network are extremely interesting because it gives an in-depth insight into the history of account activity that is really easy to read, easy to follow, and easy to export."
"The most valuable aspect is its connection to Microsoft Sentinel and Defender for Endpoint, and giving exact timelines for incidents and when certain events occured during an incident."
"All the integration it has with different Microsoft packages, like Teams and Office, is good."
"This solution has advanced a lot over the last few years."
"The feature I like most is that you can create your own customized detection rules. It has a lot of default alerts and rules, but you can customize them according to your business needs."
"The solution offers excellent visibility into threats."
 

Cons

"The UI could be improved a little bit."
"The search feature needs to be improved."
"It should have better mitigation with other solutions and be tightly integrated with other solutions. It has to be improved."
"The product should improve its dashboards. Splunk has neat dashboards. Additionally, we would like to enhance the use cases provided by LogRhythm as its use case library is not as extensive as other tools. Its machine-learning capabilities need to improve when compared to other solutions. It lacks risk quantification in a single, transparent view for individuals such as CSOs."
"LogRhythm UEBA's data aggregation needs to be improved. Open-source users do not have much documentation available. Documentation is available only for enterprise users."
"What needs improvement in LogRhythm UEBA is the pricing. Here in Asia, for example, in Sri Lanka, pricing is the primary concern, and this is the only area for improvement I see in the product."
"The product could be user-friendly for someone who doesn’t have any prior experience working with it."
"The cloud version is lacking and not up to par."
"One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents."
"Microsoft should look at what competing vendors like CrowdStrike and Broadcom are doing and incorporate those features into Sentinel and Defender. At the same time, I think the intelligence inside the product is improving fast. They should incorporate more zero-trust and hybrid trust approaches. They need to build up threat intelligence based on threats and methods used in attacks on other companies."
"And when you are working in a priority IP address, Identity is not able to know that those IPs are from the company. It sees that the IPs are from Taiwan or from Hong Kong or from India, even though they are internal IPs, resulting in a lot of false positives."
"The impact of the sensors on the domain controllers can be quite high depending on your loads. I don't know if there's any room for improvement there, but that's one of the things that might be improved."
"I would like to be able to do remediation from the platform because it is just a scanner right now. If you onboard a device, it shows you what is happening, but you can't use it to fix things. You need to go into the system to fix it instead."
"The tracking instance needs to be configured appropriately."
"The technical support needs significant improvement. Documentation for more minor issues in the form of guides or walkthroughs could help to resolve this issue. The number of tickets raised would decrease, removing some pressure from the support team and making it easier to clear the remaining tickets."
"An area for improvement is the administrative interface. It's basic compared to other administrative centers. They could make it more user-friendly and easier to navigate."
 

Pricing and Cost Advice

"I rate the product's pricing a three out of ten. However, the cloud version is expensive. You need to hire professional services for deployment and migrations, which can be expensive."
"LogRhythm UEBA's pricing is affordable for small and medium businesses."
"The pricing is nice when compared to other products in the industry."
"Licensing is on a yearly basis. It's not expensive compared to its competitors."
"As LogRhythm UEBA is pretty expensive, I'd give its pricing a seven out of ten."
"It is quite a budget-friendly product."
"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."
"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."
"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."
"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."
report
Use our free recommendation engine to learn which User Entity Behavior Analytics (UEBA) solutions are best for your needs.
787,817 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
18%
Financial Services Firm
10%
Manufacturing Company
9%
Government
9%
Computer Software Company
15%
Financial Services Firm
14%
Government
8%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about LogRhythm UserXDR?
The solution is useful for privilege accounts and super admin accounts. It is beneficial from a security perspective. The tool uses machine learning rather than threshold-based alerts. For instance...
What is your experience regarding pricing and costs for LogRhythm UserXDR?
I rate the product's pricing a three out of ten. However, the cloud version is expensive. You need to hire professional services for deployment and migrations, which can be expensive.
What needs improvement with LogRhythm UserXDR?
The product should improve its dashboards. Splunk has neat dashboards. Additionally, we would like to enhance the use cases provided by LogRhythm as its use case library is not as extensive as othe...
What do you like most about Microsoft Defender for Identity?
Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence.
What needs improvement with Microsoft Defender for Identity?
One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents. Currently, it is mandatory to install the agent on the on-premises e...
What is your primary use case for Microsoft Defender for Identity?
Microsoft Defender for Identity is like a personal security guard for our organization's identity. It keeps a close eye on how we use our identities across both on-premises and Azure Active Directo...
 

Also Known As

LogRhythm UserXDR, LogRhythm Enterprise UEBA
Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity
 

Overview

 

Sample Customers

Information Not Available
Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
Find out what your peers are saying about LogRhythm UEBA vs. Microsoft Defender for Identity and other solutions. Updated: July 2023.
787,817 professionals have used our research since 2012.