We performed a comparison between LogicMonitor and Sumo Logic Security based on real PeerSpot user reviews.
Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."I like the KQL query. It simplifies getting data from the table and seeing the logs. All you need to know are the table names. It's quite easy to build use cases by using KQL."
"The machine learning and artificial intelligence on offer are great."
"The AI and ML of Azure Sentinel are valuable. We can use machine learning models at the tenant level and within Office 365 and Microsoft stack. We don't need to depend upon any other connectors. It automatically provisions the native Microsoft products."
"It is able to connect to an ever-growing number of platforms and systems within the Microsoft ecosystem, such as Azure Active Directory and Microsoft 365 or Office 365, as well as to external services and systems that can be brought in and managed. We can manage on-premises infrastructure. We can manage not just the things that are running in Azure in the public cloud, but through Azure Arc and the hybrid capabilities, we can monitor on-premises servers and endpoints. We can monitor VMware infrastructure, for instance, running as part of a hybrid environment."
"Mainly, this is a cloud-native product. So, there are zero concerns about managing the whole infrastructure on-premises."
"Sentinel is a Microsoft product, so they provide very robust use cases and analytic groups, which are very beneficial for the security team. I also like the ability to integrate data sources into the software for on-premise and cloud-based solutions."
"Its inbuilt Kusto Query Language is a valuable feature. It provides the flexibility needed to leverage advanced data analytics rules and policies and enables us to easily navigate all our security events in a single view. It helps any user easily understand the data or any security lags in their data and applications."
"The Identity Behavior tab furnishes us with the entire history linked to each IP or domain that has either accessed or attempted to access our system."
"We have very fine-tuned alerting that lets us know when there are issues by identifying where exactly that issue is, so we can troubleshoot and resolve them quickly. This is hopefully before the customer even notices. Then, it gives us some insight into potential issues coming down the road through our environmental health dashboards."
"It is easy to set up and monitor an entire facility. This is crucial because we have around 80 facilities that require monitoring. LifePoint is a hub-and-spoke environment, so it is essential to understand all of the WAN interfaces."
"Having a full team at LogicMonitor for support is super helpful as they are available all the time to answer any questions you may have."
"The breadth of its ability to monitor all our environments, putting it in one place, has been helpful. This way, we don't have to manage multiple tools and try to juggle multiple balls to keep our environment monitored. It presents a clear picture to us of what is going on."
"LogicMonitor saves time in terms of its ability to proxy a connection through a device. For example, if you are troubleshooting a device, which you may want to connect to, you can proxy this connection through the platform. As a support resource, I don't need to use multiple platforms to connect to a device to further investigate the issue. It is all consolidated. From that perspective, it saves time because a resource now only needs to use one platform."
"LogicMonitor improved on-premises infrastructure monitoring in several ways. One key feature was dynamic resource allocation, although we didn't utilize it much in our system. The main functionalities we benefited from were email alerts, network mapping, and dashboards."
"The plugins are easy to integrate, and LogicMonitor provides these add-ons for vendors like VMware. It becomes very easy to integrate them and take the data sources."
"The alerting would be number one in my book. The thresholds for getting alerts for different criteria are pretty well-thought-out. We don't get many false positives or negatives on the alerting side. If we do get an email alert or some similar alert, we know that it is something that has to be looked at."
"Sumo Logic Security is a good solution for searching the logs and identifying the issues."
"Sumo Logic is an easy solution to use. You can set it up very quickly, and it includes a lot of training videos."
"Scalability has been good for our needs. We haven't run into any scaling issues in regards to size so far."
"We have used it many times to find a root cause of a live issue, then fix the problem in the applications."
"The tool has key features like operability. It will alert the admins whenever a device is onboarded."
"We can integrate threat intelligence solutions into the product."
"It helps a lot because we can troubleshoot issues pretty easily."
"The most valuable features of Sumo Logic Security are the rules, use cases, and ease of use. Additionally, the integration is straightforward and good GUI."
"They should integrate it with many other software-as-a-service providers and make connectors available so that you don't have to do any sort of log normalization."
"We have been working with multiple customers, and every time we onboard a customer, we are missing an essential feature that surprisingly doesn't exist in Sentinel. We searched the forums and knowledge bases but couldn't find a solution. When you onboard new customers, you need to enable the data connectors. That part is easy, but you must create rules from scratch for every associated connector. You click "next," "next," "next," and it requires five clicks for each analytical rule. Imagine we have a customer with 150 rules."
"Given that I am in the small business space, I wish they would make it easier to operate Sentinel without being a Sentinel expert. Examples of things that could be easier are creating alerts and automations from scratch and designing workbooks."
"I can't think of anything other than just getting the name out there. I think a lot of customers don't fully understand the full capabilities of Azure Sentinel yet. It is kind of like when they're first starting to use Azure, it might not be something they first think about. So, they should just kind of get to the point where it is more widely used."
"If Sentinel had a graphical user interface, it would be easier to use. I would also like it to be more customizable."
"Microsoft Sentinel should provide an alternative query language to KQL for users who lack KQL expertise."
"For certain vendors, some of the data that Microsoft Sentinel captures is redacted due to privacy reasons."
"Add more out-of-the-box connectors with other SaaS platforms/applications."
"Automated remediation of issues has room for improvement. I don't know how best to handle it, but I know that they're kind of working on it. I know there are some resources that can do automated remediation. I would like them to improve this area so it could be completely hands-free, where it detects an issue, such as, if a CPU is running high. There are ways to do it even now, but it's a bit more involved."
"LogicMonitor's reporting capabilities definitely could use an improvement. We have made do with the dashboarding and done what we can to make that work for our customers. However, there are definitely customers who would like a PDF or some kind of report along those lines, where we have been utilizing other tools to provide them. The out-of-the-box LogicMonitor reporting is the only thing that we have been less than impressed with."
"Role-based permissions could be better and updating modules could be smoother."
"Dashboarding capabilities could be enhanced. It is cumbersome, you must do it all at once, and then you must repeat the process every now and then."
"The topology mapping is all based on the dynamic discovery of devices that could talk to each other. There is no real manual way that you can set up a join between two devices to say, "This is how this network is actually set up." For example, if you have a device, and you're only pinning that device and not getting any real intelligent information from it, then it can't appear on the map with other devices. Or if it can appear, then it won't show you which devices are actually joined to it."
"The only functional area I can think of that has room for improvement would be the dashboards. They could use a refresh. It would be nice if there were more widgets and more types of widgets."
"There are some very specific things that need improvement in LogicMonitor. One is the lack of formatting for customized alerts, particularly the delivery of them to our email channel. We'd also like to see further customization of dashboards. Finally, something that is specific to us as an MSP that uses LogicMonitor, is white-labeling or skinning of the product, so we can make it look more customer-focused for our customers."
"LogicMonitor should always improve AI because we are always striving for real intelligence. An additional feature we'd like to see in the next release of LogicMonitor is more in the area of identification of when the dominant workload is working. There are certain devices and applications that have cycles of their own. Some are used primarily during prime time, and some are used during the overnight timeframe, and better identification and classification of those workloads would be helpful. For example, we could then do some more planning about, for this particular set of devices, as it has a prime time environment, and we don't want to see a 24-hour average, as we want to see what is the 75th or 90th percentile utilization during the prime time when it is being used, whenever that prime time is."
"In my opinion, this solution has a steep learning curve and requires practice if users to be able to use this tool very efficiently."
"We would like the ability to drill down into a dashboard and get into deeper levels."
"I would like better UI-driven functionality to create alerts and reports. Now, we have to understand the syntax, so it is a little difficult for someone to pick it up without using the manuals. If there was more of a graphical user interface, it would be beneficial."
"It would be nice to have an improved ability to scroll through logs within a time frame. Right now, we can search for specific errors. However, if we want to look for "before and after" within a specific time frame, it's not easy using the tool. This would be an improvement."
"Sumo Logic needs to make sure integrating solutions are seamless."
"We would like to have some type of predefined setup for the logs, making the setup easier by default."
"The initial setup is the most stressful, like learning how to use it."
"The dashboard has room for improvement, because sometimes it is a difficult to create a specific dashboard or query. This would be a nice place to correct problems."
LogicMonitor is ranked 17th in Network Monitoring Software with 25 reviews while Sumo Logic Security is ranked 20th in Security Information and Event Management (SIEM) with 18 reviews. LogicMonitor is rated 9.0, while Sumo Logic Security is rated 8.6. The top reviewer of LogicMonitor writes "We went from nothing to full visibility across our internal and external estates of equipment". On the other hand, the top reviewer of Sumo Logic Security writes "Used to store and monitor application logs and VPC flow logs". LogicMonitor is most compared with ScienceLogic, SolarWinds NPM, Zabbix, SCOM and Auvik Network Management (ANM), whereas Sumo Logic Security is most compared with Wazuh, Rapid7 InsightIDR, Splunk Enterprise Security, VMware Aria Operations for Logs and IBM Security QRadar. See our LogicMonitor vs. Sumo Logic Security report.
See our list of best Security Information and Event Management (SIEM) vendors.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
