Try our new research platform with insights from 80,000+ expert users

AlienVault OSSIM vs Cribl comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

AlienVault OSSIM
Ranking in Security Information and Event Management (SIEM)
11th
Average Rating
7.4
Reviews Sentiment
7.1
Number of Reviews
31
Ranking in other categories
No ranking in other categories
Cribl
Ranking in Security Information and Event Management (SIEM)
12th
Average Rating
8.4
Reviews Sentiment
6.2
Number of Reviews
15
Ranking in other categories
Application Performance Monitoring (APM) and Observability (14th), Log Management (8th), Observability Pipeline Software (1st)
 

Mindshare comparison

As of August 2025, in the Security Information and Event Management (SIEM) category, the mindshare of AlienVault OSSIM is 3.2%, down from 4.3% compared to the previous year. The mindshare of Cribl is 1.0%, up from 0.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM)
 

Featured Reviews

HarshBhardiya - PeerSpot reviewer
An open-source solution that provide good detection and more visibility
The solution is not scalable. It impacts so hard. In the initial stages, AlienVault OSSIM can be suitable for small environments. There may be limitations if the customer expresses a desire to expand and add more devices. In such cases, we would need to either explore additional solutions or work within the constraints of the existing setup. We have set up alerts and configured everything in AlienVault OSSIM. It actively monitors for any security incidents. It provides us with regular updates and notifications about any ongoing activities. Only one person is using the solution. It is the perfect solution for small businesses. I rate the solution’s scalability a three out of ten.
Joe Cicero - PeerSpot reviewer
Facilitates seamless log integration and reduces data costs with efficient compression
My favorite feature is Cribl Stream. That's probably the only Cribl product I have a lot of experience with, and Cribl Stream makes it very easy to identify where all the customer's log sources are and to quickly connect them to a destination source such as Microsoft Sentinel and Microsoft Azure Data Storage. Cribl Stream does two things: not only does it make it easy to connect one log source or one dataset to multiple storage locations, but it also has compression features, which greatly reduce the storage cost for that data. It strips out and compresses data so that only the absolute information remains and not any duplicates. Dual destination and compression are the two top features.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution is free to use."
"The initial setup is straightforward."
"Its user-friendliness is the most valuable. It is very easy to use and explore. The dashboard is very well packaged and integrated. You don't have to spend a lot of time in configuring it and checking out the RPM etc. It is also free and very powerful."
"The dashboard is the solution's most valuable aspect. It brings everything into one central point where I can actually look at it and go, "Okay, I understand what's going on.""
"The solution is very stable. Compared to Qradar and Splunk, it's very stable."
"The most valuable features of this solution are the data correlation and vulnerability assessment."
"AlienVault OSSIM is an enterprise solution that sells easily. It is rated highly by organizations."
"It has helped us remediate threats in the past by providing significant events that assisted in identifying suspicious activities, such as logins from multiple countries."
"Features such as Cribl Stream, Cribl LogStream, and Cribl Edge have been the most beneficial. The Cribl LogStream, in particular, is valuable for routing data, creating firewalls on pipelines, and putting security measures in place to ensure data reaches its destination without issues."
"The product's most valuable features include the internal management of events, coding perspective, data processing, and serialization."
"Cribl offers other valuable features. For instance, you can replay data from an edge device, store your daily data in a stream, and replay specific event data into Splunk if a security incident occurs"
"Cribl definitely helps with the complexity because you don't have to push for deployment—they provide the interface where you can mimic what the output will look like, and you can see that in real time when setting up the Cribl configuration, which definitely helps considerably."
"My favorite option in Cribl is the Stream product."
"The platform's most valuable feature is the ability to transform data in real-time within the pipeline without sending it to a destination."
"I'd rate the solution ten out of ten."
"The support team was very helpful and managed to get everything production-ready."
 

Cons

"We need more dashboards and we need more customization for dashboards."
"They can add more compliance templates."
"The main area where the AlienVault product was lacking around the 2018 timeframe was in its ability to scale."
"The initial setup was a bit complex. You've got to do a lot of reading. It's not an intuitive implementation."
"I would like the solution to be able to integrate with my firewall, my IDS and my Honeypot solutions so that it can provide real-time reporting as things occur and then have alert sent to me on my phone when suspicious activity is happening."
"The solution needs more integration with cyber intelligence systems."
"AlienVault OSSIM should improve the deployment and make it unified like the USM."
"It's so hard to configure and explore something new on it."
"Cribl could improve by offering easier integrations with enterprise products, similar to what Splunk provides."
"There have been several administrative issues. Another point is that the browsing functions aren't very intuitive."
"The sys logging could be enhanced to make it easier to identify errors, especially when dealing with multiple functions."
"Cribl should consider adding more features that are applicable to smaller firms, allowing broader access to their data migration through Cribl."
"There is no alerting mechanism for the leader/worker nodes status."
"Perhaps more flexibility in terms of metrics would be helpful."
"Cribl doesn't have as many packs available"
"There is room for improvement in the documentation and knowledge base, particularly regarding configurations like sources where logs are being ingested"
 

Pricing and Cost Advice

"AlienVault OSSIM is expensive compared to its competitors."
"The price of AlienVault OSSIM is too high sometimes for us to present to our customers. The price should be lower. We are on a three-year license to use the solution. We had to pay extra for the support."
"The solution is open source, so it's free to use."
"OSSIM is open source, and USM is the paid license. So, if you want, you can switch to USM. There you will have to buy a license, and they have a support team that helps you out on issues you face."
"The licensing fees for the non-community edition are paid on an annual basis, and there are no costs in addition to this."
"We are using a free version of the solution. If you purchase a license there are more features available but the price is a little high. The solution should be cheaper to allow more customers to be able to afford it."
"I used the paid version of the tool and found it to be expensive. It has been a while since I changed to Securonix. I will have to check whether AlienVault charges per device, user, or log."
"OSSIM is free."
"I would not say it is a cheaply priced tool as it has been doing wonders in the market. The tool has been budget-friendly for organizations."
"The product pricing is reasonable compared to other solutions."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
865,384 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Comms Service Provider
11%
University
8%
Educational Organization
8%
Financial Services Firm
16%
Computer Software Company
9%
Healthcare Company
8%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What is your experience regarding pricing and costs for AlienVault OSSIM?
It depends. I would need to review their cost models, but generally, they are on a scaled basis based on throughput usage. Because it's a software as a service solution for their core product for U...
What needs improvement with AlienVault OSSIM?
Scaling for USM is always challenging for any product unless it is purpose-built or overbuilt at the front end. They will use Palo Alto and its competitors, and LevelBlue will manage that implement...
What needs improvement with Cribl?
Something that Cribl could do better is processing time. There is not enough customization to improve performance. An example would be with AWS Lambda functions, the way we were doing it before. Th...
What is your primary use case for Cribl?
Our use cases that we are exploring Cribl for right now are for data parsing and data manipulation.
 

Comparisons

 

Also Known As

OSSIM
No data available
 

Overview

 

Sample Customers

Council Rock School District
Information Not Available
Find out what your peers are saying about AlienVault OSSIM vs. Cribl and other solutions. Updated: July 2025.
865,384 professionals have used our research since 2012.