Graylog vs LogRhythm SIEM comparison

Cancel
You must select at least 2 products to compare!
Graylog Logo
10,699 views|9,032 comparisons
LogRhythm Logo
10,474 views|6,015 comparisons
Comparison Buyer's Guide
Executive Summary
Updated on Jul 23, 2023

We compared Graylog and LogRhythm SIEM based on our users' reviews in five categories. We reviewed all of the data, and you can find the conclusion below.

  • Features: Graylog stands out with its exceptional search functions, seamless integration with Elasticsearch, and real-time data access. Users praised LogRhythm SIEM for its user-friendly centralized dashboard, strong integration capabilities, and event-filtering capabilities. Graylog could benefit from additional customization options and an improved rule-creation process. LogRhythm SIEM has the potential to improve its SOAR and NDR features, platform stability, and MDI integration. LogRhythm users requested expanded log storage, better load balancing, and streamlined search capabilities.

  • Service and Support: Graylog's customer service is generally well-regarded, with reviewers noting effective solutions and satisfactory experiences. While response times may differ, Graylog's support is considered superior compared to that of other products. LogRhythm SIEM was generally praised for its helpful and knowledgeable support, although there have been occasional delays and knowledge problems.

  • Ease of Deployment: Some Graylog users said the setup was easy. Other reviewers faced challenges, but these were easily resolved with help from the vendor’s support staff. Graylog is easier to set up in smaller environments, but it could get complicated in large clusters. LogRhythm SIEM's setup is considered to be straightforward. However, it is more time-consuming and complex for enterprise deployments involving multiple components or vendors, and users often require assistance from professional services or LogRhythm-certified engineers.

  • Pricing: Graylog offers an enterprise edition and an open-source option with a daily capacity restriction. Some users said that data costs can be expensive. LogRhythm SIEM’s license typically includes all elements. However, enterprise customers may encounter complexities related to additional features and add-ons. 

  • ROI: Graylog can offer some cost savings. The precise ROI may vary depending on the organization’s size and use case. LogRhythm SIEM has proven to be highly valuable, delivering a significant ROI by reducing the mean time to detect and respond.

Conclusion: Users find LogRhythm SIEM easy to set up initially and appreciate its scalability, stability, and integration capabilities. They also like the centralized dashboard and user-friendly interface, along with valuable features like UEBA functionality and event log filtering. While Graylog offers detailed search capabilities and integration with Elasticsearch, LogRhythm SIEM is considered a more comprehensive and user-friendly solution for managing cybersecurity tasks and identifying blind spots. Additionally, LogRhythm SIEM's customer service and support are highly rated, further reinforcing its preference over Graylog.
To learn more, read our detailed Graylog vs. LogRhythm SIEM Report (Updated: March 2024).
765,234 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"Real-time UDP/GELF logging and full text-based searching.""I am very proud of how very stable the solution is.""The ability to write custom alerts is key to information security and compliance.""We have scaled from a single machine installation (a VM with a Graylog + ES + MongoDB) to (2 Graylog + 2 ES + 3 MongoDB). This was done smoothly with a minimal impact on logging.""Everything stands out as valuable, including the fact that I can quantify and qualify the logs, create pipelines and process the logs in any way I like, and create charts or data maps.""One of the most valuable features is that you are able to do a very detailed search through the log messages in the overview.""We run a containerized microservices environment. Being able to set up streams and search for errors and anomalies across hundreds of containers is why a log aggregation platform like Graylog is valuable to us.""It is used as a log manager/SIEM. It provides visibility into the infrastructure and security related events."

More Graylog Pros →

"The dashboards in the LogRhythm SIEM really help us as a starting point. It gives us a starting point we can go to every day. We walk through several dashboards to see anomalous activity for further investigation.""LogRhythm NextGen SIEM covers all our primary security analysis needs. It makes it easier for us to analyze threats and improves our response times. It's a versatile platform that performs queries fast compared to other SIEM solutions.""I have found the Advanced Intelligence Engine has provided the most value to us because we can customize alarms based on our requirements and have created hundreds of alarms that notify different people for different scenarios.""Alarms are the most valuable feature. We also like the dashboard and how things are at your fingertips. The fact that we can now edit the report templates is going to be a great thing.""Its ability to work with all different sorts of log sources has been extremely valuable.""I would say the most valuable feature of LogRhythm is that it has built-in UEBA functionality, among other basic Windows packages.""The content in the community is very helpful and useful for new users.""The initial setup process is very user-friendly."

More LogRhythm SIEM Pros →

Cons
"It would be great if Graylog could provide a better Python package in order to make it easier to use for the Python community.""More complex visualizations and the ability to execute custom Elasticsearch queries would be great.""Elasticsearch recommendations for tuning could be better. Graylog doesn't have direct support for running the system inside of Kubernetes, so it can be challenging to fill in the gaps and set up containers in a way that is both performant and stable.""We ran into problems with Elasticsearch throwing a circuit-breaking exception due to field data size being too large. It turned out that the heap size directly impacted this size in a high-throughput environment, causing unexplained instability in Graylog. We were able to troubleshoot on the Elasticsearch size, but we should have been able to reference some minimum requirements for Graylog to know that our settings weren't sufficient.""Dashboards, stream alerts and parsing could be improved.""I hope to see improvements in Graylog for more interactivity, user-friendliness, and creating alerts. The initial setup is complex.""There should be some user groups and an auto sign-in feature.​""Graylog needs to improve their authentication. Also, the fact that Graylog displays logs from the top down is just ridiculous."

More Graylog Cons →

"There are other security technologies outside of this SIEM that should be inside of this SIEM. I can see in their roadmap that they're trying to address a lot of these things, and have these technologies built into the solution, because there is no point in going to another vendor or opening up a second window to obtain the data that you need.""We've tried to work with a couple of engineering department guys there. We've called them and called them but we never hear anything back.""LogRhythm's SOAR and NDR features don't stack up well against competitors. maybe integrating theme functionality as the other do. But in general, it's okay.""The built-in functionality of the solution for NDR, SOAR, SIEM, and EDS has room for improvement.""I have probably submitted half a dozen log parser requests, and I keep finding more stuff that we need to keep an eye on that doesn't have a definition in LogRhythm.""NextGen SIEM has separate rules for AI, advanced intelligence, and MP rules - it would be better to have a centralized way to write the rules and create alarms.""Parsing is totally controlled by LogRhythm and they do not allow any partner or any third-party to handle this part and this is a key challenge on my end.""The solution is likely not the best option for a smaller organization."

More LogRhythm SIEM Cons →

Pricing and Cost Advice
  • "Having paid official support is wise for projects."
  • "I am using a community edition. I have not looked at the enterprise offering from Graylog."
  • "If you want something that works and do not have the money for Splunk or QRadar, take Graylog.​​"
  • "​You get a lot out-of-the-box with the non-enterprise version, so give it a try first."
  • "Consider Enterprise support if you have atypical needs or setup requirements.​"
  • "I use the free version of Graylog."
  • "It's an open-source solution that can be used free of charge."
  • "We're using the Community edition."
  • More Graylog Pricing and Cost Advice →

  • "Look closely at the cost of licensing of other products. This should include setups and the need for support services. I did a RFQ to 2 other vendors before choosing this product."
  • "If you don't have your staff, absolutely look into the co-pilot and factor that into your cost evaluation."
  • "I would recommend that whatever sales quotes to them upfront, they will probably go up. Because they are probably going to outgrow that very quickly or once they start getting everything into it, they are going to have to move up anyway."
  • "Look for whatever will give you the most value. That's the main point. It is not one size fits all."
  • "I would recommend talking to the rep. That's the biggest thing because they will know what questions to ask."
  • "In comparison to the competition, they are more affordable. This allows us to do more with less."
  • "The solution has provided us with consistency and increased staff productivity through orchestrated automated work flows by at least 20 percent."
  • "I have seen a measurable decrease in the mean time to detect and respond to threats. We went from not detecting them to detecting them. We can actually pick up what is anomalous in our network now."
  • More LogRhythm SIEM Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Log Management solutions are best for your needs.
    765,234 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:The product is scalable. The solution is stable.
    Top Answer:We are using the free version of the product. However, the paid version is expensive.
    Top Answer:Since it's a free tool, I don't have much to say. Troubleshooting is important to me. The initial setup is complex. I hope to see improvements in Graylog for more interactivity, user-friendliness, and… more »
    Top Answer:Rony, Daniel's answer is right on the money.  There are many solutions for each in the market, a lot depends upon your ability to manage such tools and your budget.  A small operation may be best… more »
    Top Answer:LogRhythm does a very good job of helping SOCs manage their workflows.
    Top Answer:LogRhythm's pricing and licensing are extremely competitive and it's one of the top three reasons we continue to invest in the platform.
    Ranking
    11th
    out of 94 in Log Management
    Views
    10,699
    Comparisons
    9,032
    Reviews
    6
    Average Words per Review
    802
    Rating
    7.3
    8th
    out of 94 in Log Management
    Views
    10,474
    Comparisons
    6,015
    Reviews
    24
    Average Words per Review
    605
    Rating
    8.0
    Comparisons
    Also Known As
    Graylog2
    LogRhythm NextGen SIEM, LogRhythm, LogRhythm Threat Lifecycle Management, LogRhythm TLM
    Learn More
    Overview

    Graylog is purpose-built to deliver the best log collection, storage, enrichment, and analysis. Graylog is:

    • Considerably faster analysis speeds.
    • More robust and easier-to-use analysis platform.
    • Simpler administration and infrastructure management.
    • Lower cost than alternatives.
    • Full-scale customer service.
    • No expensive training or tool experts required.

    LogRhythm SIEM Platform is an award-winning platform in security analytics. With more than 4,000 customers globally, LogRhythm SIEM is an integrated platform that helps security operations teams protect critical infrastructure and information from emerging cyberthreats. Ultimately, LogRhythm SIEM is an integrated set of modules that contribute to the security team’s fundamental mission: rapid threat monitoring, threat detection, threat investigation, and threat neutralization. LogRhythm SIEM is for organizations that require an on-premises solution and offers:

    ● Streamlined workflow

    ● Secure data access

    ● Real-time visibility

    ● A unified user experience

    ● Management customization

    Security information and event management (SIEM) solutions have been evolving for over a decade; their core functionality still acts as the most effective foundation for any organization’s technology stack. A SIEM solution enables an organization to centrally collect data across its entire network environment to gain real-time visibility into activity that may pose a risk to the organization. SIEM technology addresses threats before they become significant financial risks while simultaneously helping better manage an organization’s assets.

    LogRhythm SIEM has many key features and capabilities, including:

    High-Performance Log Management: LogRhythm SIEM offers structured and unstructured search capabilities which allows users to swiftly search across an organization’s vast data to easily find answers, identify IT and security issues, and troubleshoot issues. Users can efficiently process and index terabytes of log data daily.

    Network and Endpoint Monitoring: Forensic sensors allow users to gain deep visibility into endpoint and network activity. Users can see behavioral anomalies and better respond to incidents.

    SmartResponse™ Automation: LogRhythm SIEM allows users to centrally execute pre-staged actions that automate incident investigatory tasks and responses.

    Automated Machine Analytics: LogRhythm SIEM's AI Engine continuously analyzes all collected security incidents and forensic data. Security teams are delivered precise, real-time intelligence about risk-prioritized threats.

    Case and Security Incident Management: LogRhythm SIEM offers an integrated workflow so that threats don’t slip through the cracks. Collaboration tools help centrally manage and track investigations.

    User and entity behavior analytics (UEBA): Embedded deterministic UEBA monitoring helps protect against insider threats.

    Security orchestration, automation, and response (SOAR): LogRhythm SIEM includes our embedded SOAR solution to increase efficiency and higher-quality incident response with low mean time to response (MTTR).

    Benefits to Using LogRhythm SIEM

    The platform offers great value to security and IT operations. Users have the ability to map their security and IT operations to existing frameworks such as NIST and MITRE ATT&CK.

    ● The platform offers broad integration across security and IT vendors: Users benefit from support for integration with hundreds of security and IT solutions. In turn, this further extends SIEM capabilities and data collection.

    ● The platform provides compliance adherence, enforcement, and reporting: The prebuilt compliance modules automatically detect violations as they occur and remove the burden of manually reviewing audit logs.

    Reviews from Real Users

    LogRhythm SIEM stands out among its competitors for a number of reasons. Two major ones are its ability to be customized and its quick performance of queries.

    Jason G., a senior cybersecurity engineer, writes, "I have found the Advanced Intelligence Engine has provided the most value to us because we can customize alarms based on our requirements and have created hundreds of alarms that notify different people for different scenarios."

    Andy W., principal consultant at ITSEC Asia, notes, “LogRhythm SIEM covers all our primary security analysis needs. It makes it easier for us to analyze threats and improves our response times. It's a versatile platform that performs queries fast compared to other SIEM solutions.”

    Sample Customers
    Blue Cross Blue Shield, eBay, Cisco, LinkedIn, SAP, King.com, Twilio, Deutsche Presse-Agentur
    Macy's, NASA, Fujitsu, US Air Force, EY, Abbott, HD Supply, SAB Miller, UCLA, Raytheon, Amtrak, Cargill
    Top Industries
    VISITORS READING REVIEWS
    Computer Software Company16%
    Comms Service Provider11%
    Government8%
    Educational Organization8%
    REVIEWERS
    Financial Services Firm26%
    Healthcare Company11%
    Energy/Utilities Company9%
    Manufacturing Company7%
    VISITORS READING REVIEWS
    Educational Organization37%
    Computer Software Company9%
    Government6%
    Financial Services Firm6%
    Company Size
    REVIEWERS
    Small Business50%
    Midsize Enterprise7%
    Large Enterprise43%
    VISITORS READING REVIEWS
    Small Business32%
    Midsize Enterprise18%
    Large Enterprise50%
    REVIEWERS
    Small Business23%
    Midsize Enterprise23%
    Large Enterprise54%
    VISITORS READING REVIEWS
    Small Business18%
    Midsize Enterprise45%
    Large Enterprise37%
    Buyer's Guide
    Graylog vs. LogRhythm SIEM
    March 2024
    Find out what your peers are saying about Graylog vs. LogRhythm SIEM and other solutions. Updated: March 2024.
    765,234 professionals have used our research since 2012.

    Graylog is ranked 11th in Log Management with 18 reviews while LogRhythm SIEM is ranked 8th in Log Management with 166 reviews. Graylog is rated 8.0, while LogRhythm SIEM is rated 8.4. The top reviewer of Graylog writes "Great detailed search features and easy Java integration, but needs improvement in integration with Python". On the other hand, the top reviewer of LogRhythm SIEM writes "The solution reduced our investigation time from days to hours and assists in managing our workflows". Graylog is most compared with Grafana Loki, Wazuh, syslog-ng, Splunk Enterprise Security and Nagios Log Server, whereas LogRhythm SIEM is most compared with Splunk Enterprise Security, IBM Security QRadar, Microsoft Sentinel, Wazuh and Fortinet FortiAnalyzer. See our Graylog vs. LogRhythm SIEM report.

    See our list of best Log Management vendors.

    We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.