We performed a comparison between Fortinet FortiSIEM and SCOM based on real PeerSpot user reviews.
Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The best functionality that you can get from Azure Sentinel is the SOAR capability. So, you can estimate any type of activity, such as when an alert was triggered or an incident was found."
"The most valuable feature is the alert notifications, which are categorized by severity levels: informational, low, medium, and high."
"It is able to connect to an ever-growing number of platforms and systems within the Microsoft ecosystem, such as Azure Active Directory and Microsoft 365 or Office 365, as well as to external services and systems that can be brought in and managed. We can manage on-premises infrastructure. We can manage not just the things that are running in Azure in the public cloud, but through Azure Arc and the hybrid capabilities, we can monitor on-premises servers and endpoints. We can monitor VMware infrastructure, for instance, running as part of a hybrid environment."
"The dashboard that allows me to view all the incidents is the most valuable feature."
"The log analysis is excellent; it can predict what can or will happen regarding use patterns and vulnerabilities."
"We can use Sentinel's playbook to block threats. It covers all of the environment, giving us great visibility."
"It is quite efficient. It helps our clients in identifying their security issues and respond quickly. Our clients want to automate incident response and all those things."
"One of the most valuable features is that it creates a kind of a single pane of glass for organizations that already use Microsoft software. So, when they have things like Microsoft 365, it is very easy for them to kind of plug in or enroll those endpoints into the Azure Sentinel service."
"There are things like dashboards and reports (pre-configured and custom) that let me know that things are operating the way they should be, and when they are not."
"Our customer did not have security monitoring in the first place. With this solution, it provided security posture management and visibility about the security landscape and threats that they had."
"The CMDB and the device discovery features are most valuable."
"The event correlation is pretty robust. The GUI is pretty good."
"The product is quite well-organized. The GUI makes it easy to navigate."
"AccelOps can handle a lot of data and it's just so important to true monitoring. Also, I can create a lot of rules to detect anything I like."
"Technical support is helpful."
"FortiSIEM is a great tool for making security processes transparent."
"This solution helps our application teams by allowing them to drill further into issues and perform a root cause analysis."
"The solution has improved our overrides and the ability to start services if they're stopped."
"The most valuable feature of SCOM is the capability of using classes within your management pack development."
"The most valuable feature of SCOM is real-time alerts."
"It discovers the components automatically, which is a fantastic thing. The discovery works in an automatic way, and it has a dynamic way of discovering the components, assets, and applications. It doesn't require any manual intervention."
"Because it's Windows-based, it actually reports quite well. It reports everything you can think of on the Windows server and allows you to monitor anything. It's excellent for those in the Windows world as it's very good at it."
"The product’s auto-remediation feature helps with automation."
"The most valuable features in SCOM are Azure monitoring and integration with Azure Monitor for monitoring Azure-hosted servers from SCOM on-premises."
"Sometimes, it is hard for us to estimate the costs of Microsoft Sentinel."
"There is some relatively advanced knowledge that you have to have to properly leverage Sentinel's full capabilities. I'm thinking about things like the creation of workbooks, how you do threat-hunting, and the kinds of notifications you're getting... It takes time for people to ramp up on that and develop a familiarity or expertise with it."
"If Sentinel had a graphical user interface, it would be easier to use. I would also like it to be more customizable."
"Microsoft should improve Sentinel, considering that from the legacy systems, it cannot collect logs."
"If you're looking to use canned queries, the interface could be a little more straightforward. It's not immediately intuitive regarding how you use it. You have to take a canned query and paste it into an operational box and then you hit a button... They could improve the ease of deploying these queries."
"It could have a better API to be able to automate many things more extensively and get more extensive data and more expensive deployment possibilities. It can gain some points on the automation part and the integration part. The API is very limited, and I would like to see it extended a bit more."
"For certain vendors, some of the data that Microsoft Sentinel captures is redacted due to privacy reasons."
"Microsoft Defender has a built-in threat expert option that enables you to contact an expert. That feature isn't available in Sentinel because it's a huge product that integrates all the technologies. I would like Microsoft to add the threat expert option so we can contact them. There are a few other features, like threat assessment that the PG team is working on. I expect them to release this feature in the next quarter."
"If there is a configuration on the wrong side of the network or there are changes that result in harm to our IT infrastructure, the solution should immediately fix it."
"The product does not have Security Orchestration and Automation Response, I would recommend adding this feature."
"I would like to see easier implementation in the future."
"The interface needs some improvements because it's a bit cumbersome when you're trying to view items. It takes some time to get used to. Additionally, sometimes the scrolling does not work."
"Patching is not great - we're not getting the support we'd expect."
"Our team tried configuring MS SQL database logs with Fortinet FortiSIEM, but it did not work for some time."
"The support of the product changed recently, and I don't think it's for the better. They should work to improve the support they offer to clients."
"The process of installing Fortinet FortiSIEM and the customization of the alerts take too long."
"There are some negative points about this product. Sometimes, the capabilities of the software don't appear, and you can't directly see the results. You have to wait for a long period to refresh the policy to push it to the software or other patches."
"We didn't know the solution enough, and therefore, it took a while to set everything up correctly. There was a learning curve."
"There could be more integration of SIM in the solution."
"The end-user components, including the dashboards, the administration console, and the web console, need to be improved."
"The solution can be improved by expanding to cloud usage."
"Application monitoring must be improved."
"The management of the servers could be better."
"Stability and some performance issues exist and they need improvement."
Fortinet FortiSIEM is ranked 8th in Security Information and Event Management (SIEM) with 63 reviews while SCOM is ranked 3rd in Event Monitoring with 77 reviews. Fortinet FortiSIEM is rated 7.6, while SCOM is rated 7.8. The top reviewer of Fortinet FortiSIEM writes "It's cheaper than other solutions with the same features but lacks integration with many third-party vendors". On the other hand, the top reviewer of SCOM writes "Has a good reporting engine, but its monitoring of the cloud-based environment could be improved". Fortinet FortiSIEM is most compared with IBM Security QRadar, Splunk Enterprise Security, LogRhythm SIEM, Wazuh and AlienVault OSSIM, whereas SCOM is most compared with Zabbix, Dynatrace, Datadog, AppDynamics and Nagios XI. See our Fortinet FortiSIEM vs. SCOM report.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
