We performed a comparison between LogicMonitor and Sumo Logic Security based on real PeerSpot user reviews.
Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The best feature is that onboarding to the SIM solution is quite easy. If you are using cloud-based solutions, it's just a few clicks to migrate it."
"The scalability is great. You can put unlimited logs in, as long as you can pay for it. There are commitment tiers, up to six terabytes per day, which is nowhere close to what any one of our customers is running."
"There are a lot of things you can explore as a user. You can even go and actively hunt for threats. You can go on the offensive rather than on the defensive."
"I've worked on most of the top SIEM solutions, and Sentinel has an edge in most areas. For example, it has built-in SOAR capabilities, allowing you to run playbooks automatically. Other vendors typically offer SOAR as a separate licensed solution or module, but you get it free with Sentinel. In-depth incident integration is available out of the box."
"Log aggregation and data connectors are the most valuable features."
"Sentinel uses Azure Logic Apps for automation, which is really powerful. This allows us to easily automate responses to incidents."
"Sentinel enables us to ingest data from our entire ecosystem. In addition to integrating our Cisco ASA Firewall logs, we get our Palo Alto proxy logs and some on-premises data coming from our hardware devices... That is very important and is one way Sentinel is playing a wider role in our environment."
"It is able to connect to an ever-growing number of platforms and systems within the Microsoft ecosystem, such as Azure Active Directory and Microsoft 365 or Office 365, as well as to external services and systems that can be brought in and managed. We can manage on-premises infrastructure. We can manage not just the things that are running in Azure in the public cloud, but through Azure Arc and the hybrid capabilities, we can monitor on-premises servers and endpoints. We can monitor VMware infrastructure, for instance, running as part of a hybrid environment."
"We only have one monitoring tool, and that is LogicMonitor. It does pretty much everything we need under one roof. They are very good at rapidly releasing new features. It's not like we have to wait six months or a year between new features and data sources. There is very quick development. If there is something that doesn't do it for us, I know I can just raise it with support or our delivery representative, and there is a good chance that that will be looked at. If it's not too much effort, we will see it released in the next few months. So, the solution is very good from that perspective. We have everything in LogicMonitor."
"The alerting would be number one in my book. The thresholds for getting alerts for different criteria are pretty well-thought-out. We don't get many false positives or negatives on the alerting side. If we do get an email alert or some similar alert, we know that it is something that has to be looked at."
"LogicMonitor improved on-premises infrastructure monitoring in several ways. One key feature was dynamic resource allocation, although we didn't utilize it much in our system. The main functionalities we benefited from were email alerts, network mapping, and dashboards."
"We have very fine-tuned alerting that lets us know when there are issues by identifying where exactly that issue is, so we can troubleshoot and resolve them quickly. This is hopefully before the customer even notices. Then, it gives us some insight into potential issues coming down the road through our environmental health dashboards."
"The most valuable feature of LogicMonitor is the infrastructure monitoring capability."
"It has improved our organization with its capacity planning. We have a performance environment that we use to benchmark our applications. We use it to say, "Okay, at a certain level of concurrency, we know where our application will fall over." Therefore, we are using LogicMonitor dashboards to tell us that we're good. Our platform can handle X number of clients concurrently hitting us at a time."
"The plugins are easy to integrate, and LogicMonitor provides these add-ons for vendors like VMware. It becomes very easy to integrate them and take the data sources."
"I really appreciate the reporting function because it allows me to create dashboards that will be emailed to me during the morning so that I have a complete overview of my client's health, within a specific time frame."
"Scalability has been good for our needs. We haven't run into any scaling issues in regards to size so far."
"The solution is quite stable."
"It provides easy visibility. I also like the shareable queries because we share a lot across groups."
"For many of our services, we use Sumo Logic to track errors and send notifications to our Slack channel, if there are issues. Then, we have our support people monitoring this, and they can react quickly."
"With this tool, we provide access to every developer team the ability to find errors, then they come to us and ask for specific help."
"It helps a lot because we can troubleshoot issues pretty easily."
"We can integrate threat intelligence solutions into the product."
"It gives us a bird's eye view of what's happening from our connection's point of view."
"It would be good to have some connectors for third-party SIEM solutions. Many customers are struggling with the integration of Azure Sentinel with their on-premise SIEM. Microsoft is changing the log structure many times a year, which can corrupt a custom integration. It would be good to have some connectors developed by Microsoft or supply vendors, but they are not providing such functionality or tools."
"I believe one of the challenges I encountered was the absence of live training sessions, even with the option to pay for them."
"When it comes to ingesting Azure native log sources, some of the log sources are specific to the subscription, and it is not always very clear."
"They should integrate it with many other software-as-a-service providers and make connectors available so that you don't have to do any sort of log normalization."
"They should just add more and more out-of-the-box connectors. It is quite a new product, and it has a lot of connectors, and even more would be good."
"If I can use Sentinel offline at home and use it on a local network, it would be great. I'm not sure if I can use Sentinel offline versus the tools I have."
"Its implementation could be simpler. It is not really simple or straightforward. It is in the middle. Sometimes, connectors are a little bit complex."
"Sentinel's alerts and notifications are not fully optimized for mobile devices. The overall reporting and the analytics processes for the end user should also be improved. Also, the compatibility and availability of data sources and reports are not always perfect."
"LogicMonitor should always improve AI because we are always striving for real intelligence. An additional feature we'd like to see in the next release of LogicMonitor is more in the area of identification of when the dominant workload is working. There are certain devices and applications that have cycles of their own. Some are used primarily during prime time, and some are used during the overnight timeframe, and better identification and classification of those workloads would be helpful. For example, we could then do some more planning about, for this particular set of devices, as it has a prime time environment, and we don't want to see a 24-hour average, as we want to see what is the 75th or 90th percentile utilization during the prime time when it is being used, whenever that prime time is."
"The process of upgrading some of the collectors has been a little bit confusing. I need to understand that better."
"We are working with LogicMonitor to get flexibility to see the absolute running numbers, rather than doing an average. They can keep the average for customers who want it, but there should be a way to at least show the real numbers, which are coming every second on the screen."
"Automated remediation of issues has room for improvement. I don't know how best to handle it, but I know that they're kind of working on it. I know there are some resources that can do automated remediation. I would like them to improve this area so it could be completely hands-free, where it detects an issue, such as, if a CPU is running high. There are ways to do it even now, but it's a bit more involved."
"Their Logs feature is quite new. It is not as feature-rich as we would like it to be. There have been a couple of conversations internally around other log management tools, like Splunk, which may do more for us than LM Logs. The benefit of LogicMonitor is that our staff know how to use it, so we don't really want to move away from it, if we don't have to. I fully expect there to be more development in this area. It is their newest feature, so it is understandable that it hasn't evolved as some of the other stuff. It would be good to see a bit more development in this area, but I think the monitoring side of things is spot on."
"There is a lack of automation, especially in terms of remediating problems. The problem is seen and identified, but there is a need and a gap where LogicMonitor can help us automate the remediation of the problem."
"One thing I would like to see is parent/child relationships and the ability to build a "suppression parent/child." For example, If I know that a top gateway is offline and I can't talk to it anymore, and anything that's connected below it or to it is also going to be offline, there is no need to alarm on those. In that situation it should create one ticket or one alarm for the parent. I know they're working towards that with their mapping technology, but it's not quite to that level where you can build out alarm logic or a correlation logic like that."
"The ease of use with data source tuning could be improved. That can get hairy quickly. When I reach out for help, it's usually around a data source or event source configuration. That can get challenging."
"From the network segmentation side, there is some discrepancy in log onboarding. The tool needs to improve direct API integrations, login integration, native login integration, etc."
"The solution should improve its UI."
"The API integration in Sumo Logic Security could improve. There are delayed connections or they stop and then automatically start. Having a seamless log collection would be beneficial."
"It would be nice to have an improved ability to scroll through logs within a time frame. Right now, we can search for specific errors. However, if we want to look for "before and after" within a specific time frame, it's not easy using the tool. This would be an improvement."
"The integration with multiple sources could be better."
"Sumo Logic needs to make sure integrating solutions are seamless."
"I would like better UI-driven functionality to create alerts and reports. Now, we have to understand the syntax, so it is a little difficult for someone to pick it up without using the manuals. If there was more of a graphical user interface, it would be beneficial."
"If you want to up your subscription through the AWS Marketplace, it can be difficult. You can't just go back to the AWS Marketplace, and say, "I want a bigger one now." You have to contact the sales team, then they do it on the back-end. This could definitely be improved."
LogicMonitor is ranked 17th in Network Monitoring Software with 25 reviews while Sumo Logic Security is ranked 20th in Security Information and Event Management (SIEM) with 18 reviews. LogicMonitor is rated 9.0, while Sumo Logic Security is rated 8.6. The top reviewer of LogicMonitor writes "We went from nothing to full visibility across our internal and external estates of equipment". On the other hand, the top reviewer of Sumo Logic Security writes "Used to store and monitor application logs and VPC flow logs". LogicMonitor is most compared with SolarWinds NPM, ScienceLogic, Zabbix, SCOM and OpsRamp, whereas Sumo Logic Security is most compared with Wazuh, Rapid7 InsightIDR, Splunk Enterprise Security, VMware Aria Operations for Logs and IBM Security QRadar. See our LogicMonitor vs. Sumo Logic Security report.
See our list of best Security Information and Event Management (SIEM) vendors.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
