Fortra's Alert Logic MDR Reviews

Alert Logic is a highly mature managed detection and response XDR service that has been under development for more than 22 years. It's a comprehensive solution with all the essential XDR elements and the latest technologies, such as artificial intelligence and machine learning. I recommend deploying Alert Logic for all kinds of customers in the public and private sectors, including utility companies, financial services, government, etc.

Alert Logic offers total visibility into the client's IT ecosystem. The solution's intrusion detection system inspects 100 percent of the network packets and installs universal agents on all physical and virtual servers for log collection. Alert Logic also aggregates logs of the client's various 3rd Party security tools into a single pane of glass. 

All of the analytics from those data feeds got to a 24/7 SOC with sophisticated resources. Alert Logic has massive threat intelligence resources to provide additional context to the incident response declarations. They do all the heavy lifting for clients who lack the technology and resources to operate their own SOC. 

The client is solely responsible for the incident response component. The macro analytics resides on Alert Logic's cloud. You have the ECM response and business application team on the client side.

Everything works in tandem, which is the only way you can deal with the advanced threats we face today, especially the ransomware families. If you don't respond in minutes, you're in trouble.

It could help us report all the logs and everything and serve as the main SIEM tool we use before escalating tickets.

Like any other tool that can process large amounts of data, Alert Logic allows me to feed it with a lot of data. What sets Alert Logic apart is its cloud-based and GUI-focused approach. While I still have on-premises appliances, I can remotely monitor everything from the cloud, and Alert Logic's ease-of-access features have helped me streamline my workflow and reduce implementation time.

We use this solution for lag management and to protect our network. We are customers of Alert Logic. 

The value of Alert Logic is that everything is in one dashboard; I'm notified when there's an incident, kept up to date and advised on what steps to take. The solution has good intrusion detection. 

The use case for Alert Logic was to identify configuration issues related to security and cloud infrastructure.

Alert Logic provided value by offering a single dashboard that amalgamated various sources for performing specific activities.

We are primarily using the solution for an e-commerce company.

The application is deployed in multiple countries, and therefore the servers are very huge servers. Sometimes, at the same time, there will be 40 to 50 or 100 nodes also. For our application log, for example, if any request goes to any particular node, and we don't know which we can look at the node's logs in Alert Logic. We will just simply mention our order ID or whatever text we are searching for, and it will tell you which node it is. If it is an XML format, you will get a complete XML in a short time, instead of going to the PuTTY, connecting to the node and getting the XML, fetching everything, and wasting your time. 

We have used other solutions, such as Splunk, and in comparison, this solution is very user-friendly and there is less confusion when you are using the app. It's faster. You can configure more than 100 nodes and you'll get all the speed and accuracy you need.

In the most recent instance, I have used Alert Logic to monitor the architecture for an IT software company. I am an IT consultant by trade, and I was contracted to design and support the infrastructure for a SaaS company.

The lead database administrator felt that there was a need to have a particular port open for the application to communicate and gather data effectively. That particular DBA and I were not in agreement over the potential risk of this open port. With the use of Alert Logic, I was able to prove factually that having that port open was a great risk. Because of it, we eventually closed the port and changed the design of the app.

We use it to be able to review logs and the overall system help and learn on anything that we need to handle.

Our organization's issue is that we implemented it and kicked the tires, but we never put an administrator behind it to own it and do a whole lot for it. There were a couple of select cases that we found and acted on those alerts. However, for the most part, it's just a climbing number of alerts with nobody touching them.

We needed a better plan for implantation. If we put something out there, we have to have people lined up to look at it and admin it, then reap the benefits of everything it's telling us to act on it. If you're not doing this, you have good intentions, but you fell short.

It is used to track production and for IDS.

It has the ability to install agents. It is pretty straightforward. You can automate the process pretty easily.