LogRhythm SIEM Reviews

I am not directly a partner with LogRhythm SIEM, but I work for a company that offers all kinds of solutions, including implementation, engineering, and analysis. I am currently involved in the engineering and analysis parts. Implementation is very rare; you only get a chance to implement the SIEM solution when a project is on pilot mode or is very new. Else, I am majorly into engineering, which involves adjusting data from different types of firewalls, routers, switches, handling day-to-day tasks, and analysis when I get alerts regarding any security or internal threats.

My role involves detection, and I am part of detection engineering, so my core concentration is on detection engineering.

The most beneficial features of LogRhythm SIEM are its customization; the tool is very customizable. It is based on Windows operating systems, making it a bit easier compared to Linux, which requires a lot of internal knowledge for troubleshooting. With a basic idea and certifications like MCSA, one can easily handle LogRhythm SIEM. Compared to QRadar, LogRhythm SIEM is easier to access, but the tool can be very unstable, encountering daily issues such as components down, services down, or high memory utilization.

My solution is deployed on-prem because there are restrictions from government facilities; the data cannot be sent to the cloud due to security reasons and concerns about potential espionage. We have enough budget for cloud deployment, but we choose to keep it on-prem to ensure data privacy; cyberattacks are a concern, but data privacy is the foremost priority due to sensitive government information.

My primary use case for LogRhythm SIEM is mainly within the financial sectors, like financial services institutions and banks. I utilize it broadly within the banking industry for various use cases.

LogRhythm SIEM has strong machine-learning capabilities with behavioral rules and analysis. The seamless integration for case management, along with a user-friendly dashboard user interface, makes tasks like threat hunting more efficient. 

Analytics and behavioral analysis help me save time with rule creation. Its scalability allows me to add components as needed. Overall, LogRhythm SIEM offers end-to-end visibility with a reasonable price.

I work with LogRhythm SIEM in a variety of ways, including monitoring security and compliance, conducting behavioral monitoring, and handling security information and event management (SIEM) tasks. The solution is used for security monitoring, user behavior analytics, NDR, and consolidating events from workstations to servers.

LogRhythm SIEM helps maintain security through continuous monitoring and provides a platform for behavioral monitoring, which can be deployed using the AI engine.

Mostly in Indonesia, LogRhythm SIEM is used by government agencies that must use the on-prem solution because of the significant requirements for SIEM solutions. It sells products as a one-time solution rather than a subscription model. Many customers sometimes forget to renew their subscription. If someone doesn’t renew the subscription, the only options that could still operate are LockSystem and Elastic. If you don’t renew the subscription, it becomes basic and loses most functions, but you can still operate the system with limited functionality. It allows full access until the last bill is paid.

Secondly, LogRhythm offers more than SIEM; it has an EDR, MDR, and XDR. Compared to its competitors, it is the most complete solution. The downside of LogRhythm is that it is slow.

LogRhythm SIEM works well, but the biggest pain point is retrieving logs using multiple filters. Even though they use Logstash from the ELK stack, it becomes very slow. LogRhythm's system uses Logstash, and while it's very fast in Elastic, it's not as quick in LogRhythm.

LogRhythm SIEM is used for monitoring events. Analysts can click on events, drill down, analyze source IP, destination IP, time, country, and other details.

LogRhythm decreases breaches and monitors all activities inside the organization. It allows for monitoring 100 assets integrated with LogRhythm, enabling efficient security operations.

Our organisations have data centres which are in need of multiple server security devices, network devices and various other solutions. We utilise this solution to integrate Oracle security logs and use another solution to collaborate between these logs and receive alerts based on configured use cases. 

My work is currently in the government sector and my aim is to enhance the organisation's threat detection and response capabilities. I try to utilise the solution in order to provide comprehensive reports with minimum false positives.

The major feature of this solution is its easy configuration which helps different team members to work on it effectively. This kind of feature is not available in other solutions that need a special team dedicated to configure and extract reports.

Another feature that I really admire is the significant improvement in the compliance in the auditing process by the solution. Our organisation-specific complaints require where the data needs to be forwarded, stored and searchable for a certain time period. This solution categorizes different types of data: cold, warm, and hot data. These features allow faster and easier extraction of any data even if the event was occurring several years ago. I also like other features, especially user behaviour analysis and automation. It studies the user behavior and if there is unusual traffic is recorded from a user, the solution flags it very effectively. 

In my company, we use LogRhythm SIEM for integrations. We use the product for SOC use cases. If we have SOC implementations, LogRhythm is the SIEM solution we use since it can also offer a SOAR solution.

The most valuable features of the solution are network monitoring, user behavior analytics, and log collection. Our company uses almost all the features offered by the solution.

We have a lot of use cases. Originally, it started out pulling in a bunch of the logs so we could get some ideas on network traffic. More recently, we have proceeded with pulling in logs from some of our other vendors. This really helped out a lot with our AV, which didn't always notify us as quickly as we wanted it to. LogRhythm made it possible for us to get notifications faster so that we can remediate things faster. We've been expanding it more and more as we've gone through the years to include more traffic, giving us more insight into our network.

LogRhythm really gave us a better understanding of what our overall risk is within our network and has opened our eyes to include other products that helped address different types of issues. Whether it's getting into vulnerability scanners or different pieces of other software, it's opened the door to what's out there. It helped us to turn on different features or other products along the way and helped us to identify what we need to improve on and present it to our executive team.