Devo Reviews

I am using Devo myself. Basically, I work at an MSSP, and we provide services to the organization for Security Operation Centers. In our Security Operation Center, we provide the service of SIEM via Devo. We also provide the service of SOAR via Devo. We are the vendors of Devo, which is why I have a great experience with it.

The features I find most valuable in Devo are that it works on unstructured data. That is the thing that I appreciate about it. It works on the LINQ query, which is similar to SQL syntax. I appreciate this aspect about it, the searching mechanism and the detection mechanism, making and creating the alerts.

Another valuable aspect is the flow editor, which has helped me a lot in my data analysis. Devo has 400 days of hot storage and you can draw your attack chain from more than a year if you are hunting for threats. The results are very faster because it is working on unstructured data.

Visualizations in Devo are great. You can create dashboards, and in Devo, we call them active boards. So visualization is very good in Devo. We have created active boards with the LINQ query. It is a similar process like Splunk. In Splunk, you have to write the query for rules, alerts, and dashboards, and in Devo it is the same thing. We create active boards via LINQ query and visualize and select the layout and which layout we want to see the things we want to see on our dashboards. We also utilize this visualization in height and monitoring. For instance, if there are geopolitical tensions between countries and we are monitoring one of the SOCs of those countries, we utilize these dashboards and active boards in height and monitoring.

Devo can improve in how its connectors enhance integration with third-party tools. Devo's architecture works by having you deploy a relay server in the data center of the client side and Devo SIEM is basically on the AWS cloud. There are specific ports which are enabled on the relay server, which are 514 and 13000, 13151, 152. However, when we talk about databases and custom integrations, there are not default ports in the relay server. No default ports are defined. For JDBC drivers, the port number is 1433, but it is not in the relay server. You have to add it manually. For Oracle RDBMS, the port is 1521, and it is also not there by default.

I would appreciate more third-party integrations including Fortinet and others. Machine learning models can also be improved. Playbooks in the SOAR can also be improved.

Regarding playbooks for automation, we utilize playbooks for automation in SOAR for automated IOC blocking on a firewall, on a web application firewall, on DNS security, etc. The only option for us to run the playbook is to schedule the job for it. However, if I want to manually run the playbook, there is no option for doing so. This needs improvement.

I have been using Devo for a year.

I would rate technical support from Devo around 7.5 out of 10. Both response time and support quality need attention.

The pricing of the product is reasonable if we compare it with other Gartner leading products like Splunk, LogRhythm, Microsoft Sentinel, Google SecOps. Its licensing model is basically on per-day ingestion on the storage, per GB data. It is calculated on the basis of that. However, I do not exactly know how much they charge for per GB data on a day-to-day basis.

I have majority of experience with Devo and a little bit of experience with Splunk and LogRhythm. I have used its advanced querying capabilities.

MTTR and MTTD are the most critical metrics for me when using Devo's analytics engine. I utilize the threat link metrics in SOAR for calculating my metrics.

Devo's automated machine learning models have helped in predicting potential threats, but it needs improvement. It still requires some work because it is not so much vendor agnostic.

Their SOAR support team is very good, but the SIEM team can do better.

I would rate Devo around 7.5 out of 10 for technical support. Overall, Devo as a product, I would rate it 9 out of 10.

I would appreciate seeing more AI automations in Devo and enhancing Security Operation Center's day-to-day tasks. My overall rating for this review is 9 out of 10.

Devo is the bank's centralized log management platform that my team and I rely on the most.

For centralized log management in our day-to-day work, one of the biggest data users would be our Red Hat Linux, so the RHEL, which is called the box.unix.rhel table. We get a lot of server endpoints, specifically Red Hat Linux, come into Devo, and then we forward that to our SIEM system. When our security teams need to review those logs, they're there, and they can perform queries.

It depends on what you're looking for, but it's hard to be specific when we do use Devo for a lot of different platforms that send their syslogs to us.

Devo has impacted my organization positively, starting at the beginning of the project to now where it is maturing. It has been a good book of record for us because it is our CLM go-to. I believe it has been a pretty good upgrade on what we had in the past, although I wasn't at the bank for that. However, I'd say that it's been a useful tool for us.

From using Devo, I can share that it has reduced time for investigations, but I don't know if costs have been reduced. I don't have that visibility, though I know that with their support structure and the contract, it's not cheap, so I don't know if there was necessarily a cost reduction, especially since we did scale it out and required the vendor for help with that. So there was a cost associated.

In my experience, Devo has the best features for us because we store close to two terabytes a day of data, and it has come in handy for that as I don't find the system to really lag. It's been pretty reliable for us in that way, and with a lot of different types of servers, just to sum it up, let's say Windows, Linux, database, mainframe, etc., sending logs into there, it's pretty easy to find the table that you're looking for when you want to search a query or when a security investigation does come up.

Devo makes it easy to find the tables or search for queries, especially during a security investigation. However, I don't want to give too much detail because I don't want to be a security risk. If an account has been compromised, you can do a search on the box.unix.rhel table, for example, and then there's a user field or an IP field. You can try and trace it down that way, and it does give you customizable date ranges. You can do real-time, 15 minutes, one hour, 24 hours, or go back a few months, so it allows you to trace it.

In terms of improvements, I think Devo falls short with their support model, as they rely mainly on their support team in Spain. Although they do have a support team in North America, they lack knowledge. Usually, if we have support cases open and they pick it up, they need to go back to the team in Spain, and with a six-hour difference from North America, it means that issues get dragged out and take longer for resolution because of that.

Beyond support, I see another common complaint that I notice when we have some disk space issues with it. Sometimes it could be day to day, and then we have to clean it up. It's hard for us to keep pace since our original use case was 250 to 500 megabytes a day, and then it became two terabytes a day. We didn't really have the infrastructure in place to support that, so disk space did fill up quickly and then we have to manually intervene to get it back to an acceptable threshold.

We've been using Devo since late 2020, and the project started in about September 2020.

In my experience, Devo is stable.

Devo's scalability has its challenges. We had to do a CCR refresh to add more space, and I think it took half a year to a year to finish that, and we were already a few versions behind.

Overall, customer support needs a lot of improvement.

In terms of return on investment with Devo, I'd say it has been costly due to the need for support and the overtime required for issues experienced at the beginning of the project. I know when we renewed our contract with them, we were supposed to get our own dedicated support, but I don't think that happened. I don't really see those metrics.

I would give Devo a seven out of ten because it has been a good tool, but with the lack of support, it kind of gives me some bias for using the product since it takes a while for issues to get resolved. We are relying on them for enhancements, which is another thing that could take a while to get addressed as well, just based on them being in Spain where their main support team is located, and knowing that they do have other clients as well. Sometimes, as a client, you don't feel prioritized.

My advice for others looking into using Devo is that it's a good product, but I would reiterate its challenges with support. Devo is a good product with poor support. I rate Devo a seven out of ten.

My main use case for Devo is predominantly data storage, specifically security log data storage, which provides a great opportunity in terms of cloud data storage. The primary use case I focus on is data sovereignty with country-specific restrictions that helps significantly.

A specific example of how I use Devo for security log data storage includes two components: incident information and raw logs that are being generated. We have specific storage requirements for the customer that we addressed using Devo's SIEM solution.

Regarding my main use case for Devo, since it is a cloud-based platform, I do not need much local or on-premise infrastructure to be hosted, which solves the delays caused by procuring hardware.

Let me dive into one of the customers we have recently worked with, where the key impact points are mean time to detect and mean time to respond. These metrics help any organization identify threats faster, initiate threat hunting activities, and allow us to reduce alert noise and analyst burnout through Devo's SOAR playbooks, making incident investigation efficient without overwhelming tier one analysts with numerous notifications.

Regarding the reduction in analyst burnout and alert noise, the prime concern in security is the time to respond to detected incidents. If an analyst takes hours to respond to a detected threat, the organization risks more breaches, which is mitigated by automated playbooks that assist analysts in focusing on responses rather than spending extensive time investigating incidents.

The best features Devo offers include processing, parsing, and enrichment, which involves parsers that come with logic engines that transform into standardized and searchable schema events, helping in multiple technological environments. I particularly appreciate the Hyperstream engine for analytics and core detection, which powers Devo, driving real-time alerting and the multi-tenancy capability.

These capabilities enhance query performance over massive rolling windows of data without traditional indexing shutdowns, and the correlation and detection rules at large scales for complex multi-stage rules that detect suspicious patterns and anomalous behaviors on attacks are very impressive.

The Hyperstream engine and real-time alerting help my team by leveraging a stream-oriented architecture that minimizes latency during data ingestion. It helps bypass traditional indexing bottlenecks and utilizes advanced nested file storage to achieve high compression ratios, such as 10:1, which reduces storage footprints. Query performance allows for executing complex searches across massive rolling windows, while also eliminating batch processing delays significantly.

In terms of improvements, I believe Devo should focus on refining the pricing component.

Another needed improvement is related to index-free query functionality. Sometimes raw logs are stored without initial normalization, causing some issues. I believe integrating custom parsing and mapping for non-standard logs is essential due to compatibility challenges with various technologies.

I have been using Devo for six years.

Devo is stable.

Regarding Devo's scalability, its horizontal scalability is quite good with no significant hassle, although data storage can be on the expensive side.

Customer support can be improved, particularly in APAC, as they have a small team and response quality sometimes lacks. I would rate the customer support around 5.5 or 6.

We used various SIEM solutions including Microsoft Sentinel, IBM QRadar, Splunk, and FortiSIEM, along with some proprietary SIEM engines including Palo Alto XCM Cortex. Our choice of Devo is often dependent on customer inclination and cost considerations.

I do not have a hard number for ROI, but we achieve early identification of security incidents that could potentially breach the customer environment, which would have been costly. Currently, we are running a lean L1 team, allowing us to provide 24x7 services with reduced operational costs.

The pricing could be simpler, and while the initial setup cost for a new instance is a bit expensive, the licensing can currently be user-based or driven by log volume, which is better if there is expansion of our user base.

Before choosing Devo, we evaluated options including Microsoft Sentinel, FortiSIEM, and Cortex XCM from Palo Alto. It is standard for customers to request comparative views when proposing Devo as a solution.

On a scale of 1 to 10, I would rate Devo a 7.

I chose 7 out of 10 because despite having amazing features, there are still improvements needed in areas such as supportability and integration capabilities with third-party solutions.

Regarding Devo's AI capabilities, the governance and security aspects still need verification as I lack visibility on how AI models are developed and governed.

The accuracy of Devo's AI capabilities is roughly 85 to 90% reliable in terms of output. In terms of deployment, we primarily use public cloud, but have opted for private cloud for one customer due to data sovereignty restrictions.

For our public cloud deployments, we predominantly use AWS and Azure in APAC.

For those looking into using Devo, I would recommend focusing on scalability and out-of-the-box detection engines, particularly on the processing speed of events, MTTD, and MTTR reductions.

My main use case for Devo is to parse data, perform correlation and searches between hosts, and determine if I can conduct scoping across the entire enterprise to identify common indicators of compromise (IOCs).

For example, if we have an IOC on a specific host, such as Mimikatz installed, I can input that into a search on Devo and it will display a list of hosts that have that specific executable. I find Devo easier to use initially compared to Splunk, which has a steeper learning curve but offers more resources. Devo requires less index maintenance.

Devo has impacted my organization positively, although they are no longer using it after transitioning to Microsoft MDE.

Before the transition, I did not observe any specific positive outcomes or measurable improvements when using Devo in terms of time saved, detection speed, or other quantifiable metrics.

The best features Devo offers are its simplicity compared to Splunk, making it more accessible for beginners. If someone were starting in a SOC, I would recommend beginning with Devo before transitioning to Splunk.

Devo is simpler and easier for beginners because the data ingestion is more streamlined and it includes a visual query interface, whereas Splunk is more complex but also more flexible. The complexity can be both an advantage and a disadvantage. Splunk uses SPL, which is powerful but has a steep learning curve, whereas Devo uses a GUI that is more user-friendly.

Devo could potentially adopt SPL for improvement.

I have been using Devo for approximately four to five years.

Devo is stable.

Devo's scalability is quite good. For the most part, I can add or remove things without encountering issues.

I did not use a different solution prior to Devo. This was already what the organization had when I joined.

I have not observed a return on investment with Devo in terms of fewer employees needed, money saved, or time saved.

On a scale of 1 to 10, I would rate Devo an 8 out of 10.

I give it an 8 because I would never rate anything a 10, as there is always room for improvement with any tool. Some tools excel in certain areas while lacking in others. I think tools complement each other, with one being stronger in some areas while another is stronger in different areas. In terms of long-term usefulness, I think Splunk would probably be better. I have noticed that not many companies use Devo, and the organization has since moved away from it. More companies seem to use Splunk, which appears to be the industry direction.

Regarding Devo's AI capabilities, I have not noticed anything unusual in terms of its accuracy and reliability of output. If everything is set up and ready, then what it displays is what it shows. If it is not displaying something, then someone probably needs to fix it on the back end.

If others are considering using Devo, my advice is that if they know what they are looking for, using Devo is straightforward, but if they do not know what they are looking for, they will quickly fall into a rabbit hole.

My main use case for Devo is that it serves as a primary tool for centralized logging solutions, mainly for threat investigation and alert monitoring. It helps us with security and analytic analytics, as we collect all the logs from multiple servers across our three clouds: AWS, GCP, and Microsoft Azure. Devo helps us correlate those events and assists in the investigation of any suspicious activity or improving our incident management lifecycle.

A specific example of how I use Devo for threat investigation and alert monitoring is that since Devo acts as a centralized logging solution in our company, whenever we face any kind of security alert, such as unauthorized usage of our system or alerts related to threats, we use this tool. This tool provides data in a very fast manner because it utilizes all the data in its raw format. The queries we run in Devo give results quickly, and it integrates well with our ServiceNow tool, so as soon as there is a suspicious activity in our systems, an alert gets generated from ServiceNow.

Devo has positively impacted our organization because we have been using only one tool for our centralized logging systems. Previously, we used Microsoft Azure's Microsoft Sentinel, which gathered data but was costly and less user-friendly. When we learned about Devo and its features, UI experience, reporting capabilities, and threat detection automation, we moved to Devo. We also manage other customers, and whenever they come to us, we introduce them to Devo's logging tools, and they are always happy to accept it as their centralized logging system. No one has provided negative or bad reviews for using Devo, and I believe both we and our customers are very happy using it.

I can say there has been an improvement in incident response with Devo. It serves as the main solution for all log ingestion across AWS, Azure, GCP, or Oracle Cloud, capturing data from all these clouds. Any unexpected or suspicious behavior or activity from unknown users simply generates a ticket with the help of ServiceNow, integrating seamlessly with third-party tools. I think that is a great feature for us and our customers, as they receive incident reports in a very fast manner with Devo's assistance.

The best features Devo offers include its focus on security investigation as a SIEM tool. Our SOC and NOC teams mainly depend on this tool for security operations and data analytics. For them, this tool is the main foundation for their daily work, which I believe is a key feature for Devo.

Devo stands out for our SOC and NOC teams compared to other tools such as Elastic because of its SIEM capabilities for threat detection and investigation. It utilizes 400 days of hot data, allowing queries to run very fast and yield results quicker than other tools in terms of security and SIEM capability. The 400 days of long-term data retention for searchable log data without transitioning to cold storage is significant. If data moves to cold storage, it takes time to retrieve it into hot storage, but Devo provides hot data for 400 days. The security orchestration is an exceptional feature of Devo for our SOC and NOC teams.

I think some features could be added to Devo. The cost is a little higher compared to other tools such as DataDog or Elasticsearch, so they could work on reducing costs. Additionally, while the support team is good, I feel that the documentation is not always very helpful for some use cases, so improvements could be made in the documentation as well.

The UI configuration could be simplified for new users. While it may be straightforward for seasoned users, new users often feel confused by the vast options available in Devo's UI. I believe there is room for improvement in that area.

I have been using Devo since I started working in my current company, which has been for the last two years.

Previously, we used Microsoft Azure's Microsoft Sentinel, which gathered data but was costly and less user-friendly. When we learned about Devo and its features, UI experience, reporting capabilities, and threat detection automation, we moved to Devo.

Devo stands out for our SOC and NOC teams compared to other tools such as Elastic because of its SIEM capabilities for threat detection and investigation.

There are other improvements needed when comparing Devo with other tools on the market, especially since we have started using Elasticsearch for DevOps and infrastructure. Elastic is much better and less costly than Devo, and it offers a free tier for first-time use, allowing users to gain a good understanding of the tool. Due to this, we have stopped using Devo in our company for the past six months and have transitioned to Elasticsearch, which is performing well.

Devo's main job is to provide a centralized logging system, so we do not have to use other logging systems for other servers. It helps us correlate events from our clouds and third-party clouds, providing all those solutions in one system. Devo is a great tool for anyone to analyze logs and reports.

Devo helps our teams with incident investigation and security monitoring, and it also assists in providing compliance reports, which helps us improve our systems day by day.

My advice to others looking into using Devo is that if you have a large or even small customer project and want to utilize SIEM and security threat analytics, you should consider Devo. It is a great tool. However, if you need infrastructure monitoring and DevOps observability, you might want to opt for Elasticsearch. I rate Devo an eight out of ten.

One practical scenario involved investigating suspicious authentication activity where we had to review logs from multiple sources. Devo helped us centralize the data and allowed the team to investigate faster by correlating the logs instead of checking multiple systems separately.

Devo functions as our centralized visibility and investigation platform, integrated with security workflows. It becomes more valuable when multiple log sources are connected together because it provides a unified SIEM solution.

Typically, we have integrated Devo into an enterprise monitoring environment, which supports centralized log collection and analytics.

In our day-to-day work, fast querying and correlation help reduce our effort because our SOC analysts do not need to manually switch across systems for logs. Correlated visibility helps speed up the investigation and provides more context for decision making. When the analyst uses queries to search, it pulls the data quickly, in a second, which aids us greatly with the investigation.

Devo helps us improve visibility across different environments and allows better incident tracking. The search and analytics capability is also useful for our teams as well as the security teams.

Devo has improved our visibility, log management efficiency, and investigation capabilities positively. Teams are able to investigate events with better context and faster access to the relevant data.

Our analysts can investigate faster when using Devo. It has absolutely reduced our investigation time, improving our investigation quality as well. This helps security teams respond more efficiently.

Devo's main value comes from improved investigation speed. It has improved significantly, and its centralized visibility has reduced our effort in log analysis.

UI improvements, a simplified dashboard, or an easier reporting workflow could further improve analyst productivity.

I rate the customer support a nine out of ten because of their timely technical guidance and responsiveness during the deployment and troubleshooting periods.

Devo provides a good experience overall. It is an enterprise-grade monitoring platform.

I would rate this review an eight out of ten.

I have been using Devo as a partner and system integrator for three years. For log monitoring, the clients' use cases can utilize Devo perfectly.

Compliance and security operation monitoring are the biggest benefits from the product.

Integration is easy, and Devo integrates with most products. Devo has connectors that enhance integration with third-party tools such as firewalls and servers.

Querying helps my data analysis, and it is quite fast. The product provides insight and analytics, and the visualization part contributes to how I understand data insights.

Perhaps Devo could add some features in the future on the network part.

Specifically, I think they could improve network traffic analysis capabilities.

I have been using Devo for three years.

Devo is 99% stable and reliable.

I think it is easy to scale up, but we never did a request for that.

The customer service is average. Technical support from Devo is helpful, but they can improve on the support model.

I think they could improve on the response time.

I have used ArcSight and Splunk previously.

The installation is very easy and seamless.

Devo gives value to the end user and is saving compared to other products in the same category.

I think it saves approximately 10 to 15% compared to similar products.

The price is considered okay.

I work with Devo. When comparing Devo with Splunk and Carbon Black, I think Devo is the leader.

I believe this is because it has the updated technology and component.

Devo has automated machine learning modules that help predict potential threats. The product learns the data and provides additional correlation rules on top of that.

I gave this review a rating of 8.

During my time at MetaBase Q and as a partner integrator of ServiceNow, I had the chance to understand and be part of projects integrating SOCs, NOCs, and Security Operation Centers with Devo.

Mostly enterprise customers invest money in security information and event management or security orchestration, automation, and response, such as SOAR or SIEMs.

Devo integrates with QRadar, Mitre clouds, and Watson.

For complex ecosystems with Fortinet, ServiceNow, and configuration management of the database with ServiceNow, the dashboards and reports that Devo brings together with their interfaces are very effective. I don't have experience working with other tools besides Devo related to these use cases. Comparing with the SIEM of IBM, one needs great skills in interpreting data on IBM, Fortinet, or Palo Alto. Devo offers quick dashboards that are easy to understand and use.

The data analytics cloud component focuses on real-time analytics, which is very impressive. The SIEM collects and correlates logs data from different sources and can integrate with ServiceNow, hardware asset management, and software asset management. The security orchestration, automation, and response (SOAR) is another valuable feature. The security data platform serves as the foundation of Devo.

Regarding advanced query capabilities, Devo offers several models including query logs, visual query builder, language integrated query, and SQL, with SQL being the most frequently used querying data capability.

The single pane of glass that Devo offers is the SOC. The tools in Devo's active ports are for investigating, not just viewing data. They are more interactive than other market solutions. The drill-down reports capabilities allow analysts to click on any element in a widget. When they see a spike in a line chart for a failed login, which could be a true or false attempt, they can click that spike, and a table widget on the same active board instantly populates with raw logs of data for those specific failed logins. This is particularly important for enterprise companies with numerous endpoints and users. The dynamic filtering of inputs significantly reduces the time cybersecurity analysts spend trying to figure out failed logins and identifying false positives.

The single pane of glass that Devo offers could be improved. The tools in Devo's active ports need enhancement in their investigative capabilities. The drill-down reports capabilities, while useful, could be more refined. This is particularly evident when dealing with failed login attempts and determining true versus false positives.

Integrations with other sandboxes could be improved to better interpret data using AI and machine learning models.

I am a Strategic Account Executive.

Positive

Compared to Fortinet, Devo is easier to use. However, when using ServiceNow, hardware asset management, and software asset management, there is an opportunity to improve on hardware asset management. They simplify the analyst's time to value, particularly in relation to hardware asset management and software asset management, which are very niche markets.

The primary model of SOAR is good. Compared to main competitors, Splunk, Microsoft Sentinel, or Elastic Security, Devo is average in pricing. It's not as expensive as Splunk, and not as inexpensive as other solutions.

Regional support in Mexico or Latin America could be improved, as currently almost all support is in English. For account management or partners of ServiceNow or IBM, they have local support, which is an area where Devo could improve.

On a scale of one to ten, I rate Devo a seven out of ten.

Devo is a SIEM replacement technology used to run security operations. It centralizes security management within a business, functioning as a core system for a SOC. This system is the central cybersecurity hub, helping manage and streamline service tickets.

One of Devo's standout features is its cloud-first architecture, which sets it apart from many traditional SIEM providers that still rely on legacy, on-premise solutions. While many companies have started shifting to the cloud, Devo offers a hybrid solid approach with full cloud deployment. This mature architecture is one of Devo's significant strengths. Unlike other providers like Fortinet and Sentinel, which handle specific security parts, Devo offers a more comprehensive, end-to-end solution, making it one of the most advanced SaaS products.

They can improve their AI capabilities. If you look at some integrations like XDR or AI, which add to the platform to correlate situations in events, there are areas for enhancement. For instance, when an event comes in with many tickets, the best systems excel at correlating and grouping the different instances or alerts into a single instance or ticket, providing context. Their correlation engines sometimes miss the mark, leading to false positives. They're not as strong as other vendors, like SentinelOne, regarding AI power and data or event correlation.

I have been using Devo as a partner for four years now.

Devo's stability is a strong point. As a SaaS provider, they've had no performance issues. 

I rate the solution’s stability a ten out of ten.

When it comes to scale, they're architected quite well. They handle some of the biggest customers globally, with significant throughput on their platform, managing thousands of customers. One of the most impressive aspects of Devo is its customer community. A large majority, over 80 percent of their customers, actively participate on a Devo-specific community page. They're contributing to product development and support, events, and user group information, helping each other out. This high level of engagement is rare and demonstrates both the loyalty of their customer base and the quality of their product.

They offer a range of small, medium, and large options to cater to everyone. I sold Devo products while working with them, focusing on enterprise solutions. However, as a small reseller, my customers were typically smaller businesses.

I rate the solution's scalability a nine out of ten.

The community support is excellent. I rate the direct support around eight, mainly because the company is based in America and has more support infrastructure there than in Europe. In the U.S., the support level rating should be closer to ten.

Positive

The initial setup is easy. They have a lot of out-of-the-box integrations and are quite lightweight in their implementation. There are plenty of options for integration, which I would consider one of their strengths. One standout feature beyond data analytics and real-time diagnostics is something called DeepTrace. If I recall correctly, this feature involves automated threat hunting and investigation. It uses AI to expedite the investigation process, identifying attack chains and conducting root cause analysis without human intervention. Essentially, they're using AI to perform tasks typically done by analysts, automating the investigation process. When you start an investigation, their AI-driven tool provides the best guess at identifying the problem, potentially offering root cause analysis without human involvement. You can either use their suggested analysis or investigate further if needed. This DeepTrace feature is likely one of the unique selling points of their platform, making it a significant differentiator for them.

I rate the initial setup an eight out of ten, where one is difficult and ten is easy.

Compared to Splunk or SentinelOne, it is really expensive.

I rate the product’s pricing a nine out of ten, where one is cheap and ten is expensive.

It integrates several critical components, such as SIEM, SOAR, and UEBA, to make it a robust solution for SOCs. The platform's cloud-based architecture ensures excellent performance, scalability, and quick deployment, particularly beneficial in environments with heavy production loads or when integrating additional tools.

Devo provides near-real-time capability for threat alerts, analysis, and updates. This allows SOC teams to stay on top of security incidents as they happen. Additionally, the platform excels in visualization, providing clear and timely dashboards that help SOCs avoid missing critical incidents or failing to interpret data correctly. Its user-friendly design allows for high-level overviews and detailed drill-downs, ensuring security professionals can quickly grasp the situation and act.

They push AI as their differentiation, calling it a next-gen SIEM. It offers a more inclusive platform that delivers end-to-end security for the entire customer. Using some weighting system, they use AI to drive down false positive rates by determining whether something is a real threat. They have an AI-powered system that assesses if an issue is real, though the specifics of how it works are difficult to explain. This includes machine learning and algorithms designed to identify complex issues, with some of that learning built into the tool. However, this is pretty standard for most SIM platforms today. The biggest challenge for SIEMs has been to make the information they present smarter and more context-heavy. This is not a differentiation but rather being on par with other AI-driven platforms that aim to reduce false positives and minimize manual checks.

I 100% recommend the solution. It can help most medium to large enterprises develop their IT capabilities to advance quickly. However, if you're already at the top of your field and willing to invest heavily, some pedigree products might offer a ten out of ten experience, but that would be due to the higher cost and specialized features.

Overall, I rate the solution an eight out of ten.

Our primary use case is so we have historical logs in case of an event or if we need to do any troubleshooting.

Our secondary use of Devo is for incident detection; certain logs trigger alerts, so we now have a 24/7 monitoring service that detects and alerts us to incidents. 

We can ingest virtually any log source, which is much better than our previous solution. We can access those logs more quickly and efficiently, with a better focus on our points of interest.

Cloud log sources were more difficult with our previous solution. Devo isn't wholly worry-free, but it's much more manageable.

With Devo, we don't have desperate multiple log storage solutions; we can do it for the most part with one. The sheer breadth of logs we can ingest is very beneficial.

The solution allows us to ingest much more data; our event volume is around 100 GB. That's ten times the volume we were ingesting before. 

The alerting is much better than I anticipated. We don't get as many alerts as I thought we would, but that nobody's fault, it's just the way it is. 

Having at least one year of data was one of our requirements, so 400 days of hot data benefits us. We are used to this capability, as our previous solution offered the same, and we wouldn't have purchased Devo if it didn't provide that.  

There are some issues from an availability and functionality standpoint, meaning the tool is somewhat slow. There were some slow response periods over the past six to nine months, though it has yet to impact us terribly as we are a relatively small shop. We've noticed it, however, so Devo could improve the responsiveness.

When we first started implementing the solution, the staff that helped us with the migration and getting it set up seemed very new. The tool could be more mature, which we knew going in, but we were hopeful for quick improvements. We would prefer to be further along than we are in that respect, but 18 months later, we still feel pretty good about adopting Devo.

The price could be more friendly as we pay significantly more than what we were paying before, but it's in line with other solutions on the market.

We've used the solution for 18 months. 

The solution is relatively stable; I'd rate it eight out of ten here. We heard about somewhat shaky performance from other customers over the last six to nine months, but we were fine.

The solution seems scalable, though we're a small shop, so we're probably not the best to answer that well.

We have 400-450 end users across three locations. 

Once we get a hold of someone and they respond, customer support is fine. It isn't extraordinary, and the escalation process is a little below average for the industry.

Neutral

We previously used IBM QRadar, and we switched because it was antiquated. We had difficulty ingesting logs from cloud solutions, which is the direction our organization is moving in. We have several cloud solutions now versus two or three years ago, so the migration to Devo from QRadar was very timely for us in that regard.

QRadar's interface was pretty antiquated. They have updated it now, but we weren't satisfied with it at the time. We also had some support-related issues around updating the solution as it was on-prem. We were coming to a point where we had to update the hardware and software, so it was a good time for us to look for another product.

The initial setup was relatively straightforward. 

In terms of maintenance, I go through every quarter to ensure that each of our log sources is still sending logs to Devo. We were a little disappointed that they didn't have a good way of informing us if a log source stopped sending logs. I appreciate that each source sends on a different frequency, but we should be able to define that frequency and receive a notification of any issues.

As is often the case with security solutions, it's hard to measure an ROI because we only need it once an incident occurs. The hope is that we get a return if an incident takes place. Devo is much better than we previously had, but it's also a lot more expensive, so it should be so.

Devo is a hosted or subscription-based solution, whereas before, we purchased QRadar, so we owned it and just had to pay a maintenance fee. We've encountered this with some other products, too, where we went over to subscription-based. Our thought process is that with subscription based, the provider hosts and maintains the tool, and it's offsite. That comes with some additional fees, but we were able to convince our upper management it was worth the price. We used to pay under 10k a year for maintenance, and now we're paying ten times that. It was a relatively tough sell to our management, but I wonder if we have a choice anymore; this is where the market is.

We focused on four solutions: Splunk, AlienVault OSSIM, the incumbent QRadar, and Devo. We narrowed it down pretty quickly to Splunk and Devo, and the latter was a bit cheaper, though less mature. We took a chance and went with Devo.

I rate the solution seven out of ten.

Devo's cloud-native SIEM increased our threat visibility, though we had hoped for a bit higher. Visibility is critical, as we rely upon knowing about security incidents as soon as possible. We expected the solution would provide additional insight, but we're finding it isn't. Devo gives us the historical logs, a fantastic capability we are very happy with. However, the incident and threat detection is not what we had hoped for. Regarding security operations, the tool is different from what we wanted.

Getting our staff up to speed with the solution was right in the middle in terms of difficulty. It wasn't as easy as we had hoped, but it wasn't insurmountable by any stretch of the imagination. Devo provided us with several training sessions, and I wonder how much that helped because our group is very technical. The tool's interface is intuitive, so our staff can find what they need. With regular use, the learning curve is relatively low, but without that, it can take some getting used to, as with any solution. Devo is broad and encompassing, so it requires familiarity to leverage it fully. We don't have dedicated internal staff to manage the solution, so we outsourced the monitoring to an MSP.  

The migration from QRadar to Devo was relatively straightforward and painless; we essentially cut the cord on QRadar, maintained the logs and moved them over to the new solution. The ease of migration was relatively important, the old solution was antiquated, so we expected any newer tool to be better. 

Migrating the bulk of the initial logs took about three months. We got some aspects up and running during a proof of concept while we were still using the old solution. Once we went live, we migrated the POC environment to a production environment, so it was much less stressful than it could have been. 

The Devo team was intimately involved in the migration. They weren't as responsive as we had hoped, and they seemed new and didn't completely understand the product. We received better support on escalation; overall, they were critical to the migration.

Before going down this path, I advise potential customers to document their log sources and what information they need based on their use cases.