Devo Reviews

I am using Devo myself. Basically, I work at an MSSP, and we provide services to the organization for Security Operation Centers. In our Security Operation Center, we provide the service of SIEM via Devo. We also provide the service of SOAR via Devo. We are the vendors of Devo, which is why I have a great experience with it.

The features I find most valuable in Devo are that it works on unstructured data. That is the thing that I appreciate about it. It works on the LINQ query, which is similar to SQL syntax. I appreciate this aspect about it, the searching mechanism and the detection mechanism, making and creating the alerts.

Another valuable aspect is the flow editor, which has helped me a lot in my data analysis. Devo has 400 days of hot storage and you can draw your attack chain from more than a year if you are hunting for threats. The results are very faster because it is working on unstructured data.

Visualizations in Devo are great. You can create dashboards, and in Devo, we call them active boards. So visualization is very good in Devo. We have created active boards with the LINQ query. It is a similar process like Splunk. In Splunk, you have to write the query for rules, alerts, and dashboards, and in Devo it is the same thing. We create active boards via LINQ query and visualize and select the layout and which layout we want to see the things we want to see on our dashboards. We also utilize this visualization in height and monitoring. For instance, if there are geopolitical tensions between countries and we are monitoring one of the SOCs of those countries, we utilize these dashboards and active boards in height and monitoring.

Devo can improve in how its connectors enhance integration with third-party tools. Devo's architecture works by having you deploy a relay server in the data center of the client side and Devo SIEM is basically on the AWS cloud. There are specific ports which are enabled on the relay server, which are 514 and 13000, 13151, 152. However, when we talk about databases and custom integrations, there are not default ports in the relay server. No default ports are defined. For JDBC drivers, the port number is 1433, but it is not in the relay server. You have to add it manually. For Oracle RDBMS, the port is 1521, and it is also not there by default.

I would appreciate more third-party integrations including Fortinet and others. Machine learning models can also be improved. Playbooks in the SOAR can also be improved.

Regarding playbooks for automation, we utilize playbooks for automation in SOAR for automated IOC blocking on a firewall, on a web application firewall, on DNS security, etc. The only option for us to run the playbook is to schedule the job for it. However, if I want to manually run the playbook, there is no option for doing so. This needs improvement.

I have been using Devo for a year.

I would rate technical support from Devo around 7.5 out of 10. Both response time and support quality need attention.

The pricing of the product is reasonable if we compare it with other Gartner leading products like Splunk, LogRhythm, Microsoft Sentinel, Google SecOps. Its licensing model is basically on per-day ingestion on the storage, per GB data. It is calculated on the basis of that. However, I do not exactly know how much they charge for per GB data on a day-to-day basis.

I have majority of experience with Devo and a little bit of experience with Splunk and LogRhythm. I have used its advanced querying capabilities.

MTTR and MTTD are the most critical metrics for me when using Devo's analytics engine. I utilize the threat link metrics in SOAR for calculating my metrics.

Devo's automated machine learning models have helped in predicting potential threats, but it needs improvement. It still requires some work because it is not so much vendor agnostic.

Their SOAR support team is very good, but the SIEM team can do better.

I would rate Devo around 7.5 out of 10 for technical support. Overall, Devo as a product, I would rate it 9 out of 10.

I would appreciate seeing more AI automations in Devo and enhancing Security Operation Center's day-to-day tasks. My overall rating for this review is 9 out of 10.

Devo is the bank's centralized log management platform that my team and I rely on the most.

For centralized log management in our day-to-day work, one of the biggest data users would be our Red Hat Linux, so the RHEL, which is called the box.unix.rhel table. We get a lot of server endpoints, specifically Red Hat Linux, come into Devo, and then we forward that to our SIEM system. When our security teams need to review those logs, they're there, and they can perform queries.

It depends on what you're looking for, but it's hard to be specific when we do use Devo for a lot of different platforms that send their syslogs to us.

Devo has impacted my organization positively, starting at the beginning of the project to now where it is maturing. It has been a good book of record for us because it is our CLM go-to. I believe it has been a pretty good upgrade on what we had in the past, although I wasn't at the bank for that. However, I'd say that it's been a useful tool for us.

From using Devo, I can share that it has reduced time for investigations, but I don't know if costs have been reduced. I don't have that visibility, though I know that with their support structure and the contract, it's not cheap, so I don't know if there was necessarily a cost reduction, especially since we did scale it out and required the vendor for help with that. So there was a cost associated.

In my experience, Devo has the best features for us because we store close to two terabytes a day of data, and it has come in handy for that as I don't find the system to really lag. It's been pretty reliable for us in that way, and with a lot of different types of servers, just to sum it up, let's say Windows, Linux, database, mainframe, etc., sending logs into there, it's pretty easy to find the table that you're looking for when you want to search a query or when a security investigation does come up.

Devo makes it easy to find the tables or search for queries, especially during a security investigation. However, I don't want to give too much detail because I don't want to be a security risk. If an account has been compromised, you can do a search on the box.unix.rhel table, for example, and then there's a user field or an IP field. You can try and trace it down that way, and it does give you customizable date ranges. You can do real-time, 15 minutes, one hour, 24 hours, or go back a few months, so it allows you to trace it.

In terms of improvements, I think Devo falls short with their support model, as they rely mainly on their support team in Spain. Although they do have a support team in North America, they lack knowledge. Usually, if we have support cases open and they pick it up, they need to go back to the team in Spain, and with a six-hour difference from North America, it means that issues get dragged out and take longer for resolution because of that.

Beyond support, I see another common complaint that I notice when we have some disk space issues with it. Sometimes it could be day to day, and then we have to clean it up. It's hard for us to keep pace since our original use case was 250 to 500 megabytes a day, and then it became two terabytes a day. We didn't really have the infrastructure in place to support that, so disk space did fill up quickly and then we have to manually intervene to get it back to an acceptable threshold.

We've been using Devo since late 2020, and the project started in about September 2020.

In my experience, Devo is stable.

Devo's scalability has its challenges. We had to do a CCR refresh to add more space, and I think it took half a year to a year to finish that, and we were already a few versions behind.

Overall, customer support needs a lot of improvement.

In terms of return on investment with Devo, I'd say it has been costly due to the need for support and the overtime required for issues experienced at the beginning of the project. I know when we renewed our contract with them, we were supposed to get our own dedicated support, but I don't think that happened. I don't really see those metrics.

I would give Devo a seven out of ten because it has been a good tool, but with the lack of support, it kind of gives me some bias for using the product since it takes a while for issues to get resolved. We are relying on them for enhancements, which is another thing that could take a while to get addressed as well, just based on them being in Spain where their main support team is located, and knowing that they do have other clients as well. Sometimes, as a client, you don't feel prioritized.

My advice for others looking into using Devo is that it's a good product, but I would reiterate its challenges with support. Devo is a good product with poor support. I rate Devo a seven out of ten.

My main use case for Devo is predominantly data storage, specifically security log data storage, which provides a great opportunity in terms of cloud data storage. The primary use case I focus on is data sovereignty with country-specific restrictions that helps significantly.

A specific example of how I use Devo for security log data storage includes two components: incident information and raw logs that are being generated. We have specific storage requirements for the customer that we addressed using Devo's SIEM solution.

Regarding my main use case for Devo, since it is a cloud-based platform, I do not need much local or on-premise infrastructure to be hosted, which solves the delays caused by procuring hardware.

Let me dive into one of the customers we have recently worked with, where the key impact points are mean time to detect and mean time to respond. These metrics help any organization identify threats faster, initiate threat hunting activities, and allow us to reduce alert noise and analyst burnout through Devo's SOAR playbooks, making incident investigation efficient without overwhelming tier one analysts with numerous notifications.

Regarding the reduction in analyst burnout and alert noise, the prime concern in security is the time to respond to detected incidents. If an analyst takes hours to respond to a detected threat, the organization risks more breaches, which is mitigated by automated playbooks that assist analysts in focusing on responses rather than spending extensive time investigating incidents.

The best features Devo offers include processing, parsing, and enrichment, which involves parsers that come with logic engines that transform into standardized and searchable schema events, helping in multiple technological environments. I particularly appreciate the Hyperstream engine for analytics and core detection, which powers Devo, driving real-time alerting and the multi-tenancy capability.

These capabilities enhance query performance over massive rolling windows of data without traditional indexing shutdowns, and the correlation and detection rules at large scales for complex multi-stage rules that detect suspicious patterns and anomalous behaviors on attacks are very impressive.

The Hyperstream engine and real-time alerting help my team by leveraging a stream-oriented architecture that minimizes latency during data ingestion. It helps bypass traditional indexing bottlenecks and utilizes advanced nested file storage to achieve high compression ratios, such as 10:1, which reduces storage footprints. Query performance allows for executing complex searches across massive rolling windows, while also eliminating batch processing delays significantly.

In terms of improvements, I believe Devo should focus on refining the pricing component.

Another needed improvement is related to index-free query functionality. Sometimes raw logs are stored without initial normalization, causing some issues. I believe integrating custom parsing and mapping for non-standard logs is essential due to compatibility challenges with various technologies.

I have been using Devo for six years.

Devo is stable.

Regarding Devo's scalability, its horizontal scalability is quite good with no significant hassle, although data storage can be on the expensive side.

Customer support can be improved, particularly in APAC, as they have a small team and response quality sometimes lacks. I would rate the customer support around 5.5 or 6.

We used various SIEM solutions including Microsoft Sentinel, IBM QRadar, Splunk, and FortiSIEM, along with some proprietary SIEM engines including Palo Alto XCM Cortex. Our choice of Devo is often dependent on customer inclination and cost considerations.

I do not have a hard number for ROI, but we achieve early identification of security incidents that could potentially breach the customer environment, which would have been costly. Currently, we are running a lean L1 team, allowing us to provide 24x7 services with reduced operational costs.

The pricing could be simpler, and while the initial setup cost for a new instance is a bit expensive, the licensing can currently be user-based or driven by log volume, which is better if there is expansion of our user base.

Before choosing Devo, we evaluated options including Microsoft Sentinel, FortiSIEM, and Cortex XCM from Palo Alto. It is standard for customers to request comparative views when proposing Devo as a solution.

On a scale of 1 to 10, I would rate Devo a 7.

I chose 7 out of 10 because despite having amazing features, there are still improvements needed in areas such as supportability and integration capabilities with third-party solutions.

Regarding Devo's AI capabilities, the governance and security aspects still need verification as I lack visibility on how AI models are developed and governed.

The accuracy of Devo's AI capabilities is roughly 85 to 90% reliable in terms of output. In terms of deployment, we primarily use public cloud, but have opted for private cloud for one customer due to data sovereignty restrictions.

For our public cloud deployments, we predominantly use AWS and Azure in APAC.

For those looking into using Devo, I would recommend focusing on scalability and out-of-the-box detection engines, particularly on the processing speed of events, MTTD, and MTTR reductions.

During my time at MetaBase Q and as a partner integrator of ServiceNow, I had the chance to understand and be part of projects integrating SOCs, NOCs, and Security Operation Centers with Devo.

Mostly enterprise customers invest money in security information and event management or security orchestration, automation, and response, such as SOAR or SIEMs.

Devo integrates with QRadar, Mitre clouds, and Watson.

For complex ecosystems with Fortinet, ServiceNow, and configuration management of the database with ServiceNow, the dashboards and reports that Devo brings together with their interfaces are very effective. I don't have experience working with other tools besides Devo related to these use cases. Comparing with the SIEM of IBM, one needs great skills in interpreting data on IBM, Fortinet, or Palo Alto. Devo offers quick dashboards that are easy to understand and use.

The data analytics cloud component focuses on real-time analytics, which is very impressive. The SIEM collects and correlates logs data from different sources and can integrate with ServiceNow, hardware asset management, and software asset management. The security orchestration, automation, and response (SOAR) is another valuable feature. The security data platform serves as the foundation of Devo.

Regarding advanced query capabilities, Devo offers several models including query logs, visual query builder, language integrated query, and SQL, with SQL being the most frequently used querying data capability.

The single pane of glass that Devo offers is the SOC. The tools in Devo's active ports are for investigating, not just viewing data. They are more interactive than other market solutions. The drill-down reports capabilities allow analysts to click on any element in a widget. When they see a spike in a line chart for a failed login, which could be a true or false attempt, they can click that spike, and a table widget on the same active board instantly populates with raw logs of data for those specific failed logins. This is particularly important for enterprise companies with numerous endpoints and users. The dynamic filtering of inputs significantly reduces the time cybersecurity analysts spend trying to figure out failed logins and identifying false positives.

The single pane of glass that Devo offers could be improved. The tools in Devo's active ports need enhancement in their investigative capabilities. The drill-down reports capabilities, while useful, could be more refined. This is particularly evident when dealing with failed login attempts and determining true versus false positives.

Integrations with other sandboxes could be improved to better interpret data using AI and machine learning models.

I am a Strategic Account Executive.

Positive

Compared to Fortinet, Devo is easier to use. However, when using ServiceNow, hardware asset management, and software asset management, there is an opportunity to improve on hardware asset management. They simplify the analyst's time to value, particularly in relation to hardware asset management and software asset management, which are very niche markets.

The primary model of SOAR is good. Compared to main competitors, Splunk, Microsoft Sentinel, or Elastic Security, Devo is average in pricing. It's not as expensive as Splunk, and not as inexpensive as other solutions.

Regional support in Mexico or Latin America could be improved, as currently almost all support is in English. For account management or partners of ServiceNow or IBM, they have local support, which is an area where Devo could improve.

On a scale of one to ten, I rate Devo a seven out of ten.

My main use case for Devo is that it serves as a primary tool for centralized logging solutions, mainly for threat investigation and alert monitoring. It helps us with security and analytic analytics, as we collect all the logs from multiple servers across our three clouds: AWS, GCP, and Microsoft Azure. Devo helps us correlate those events and assists in the investigation of any suspicious activity or improving our incident management lifecycle.

A specific example of how I use Devo for threat investigation and alert monitoring is that since Devo acts as a centralized logging solution in our company, whenever we face any kind of security alert, such as unauthorized usage of our system or alerts related to threats, we use this tool. This tool provides data in a very fast manner because it utilizes all the data in its raw format. The queries we run in Devo give results quickly, and it integrates well with our ServiceNow tool, so as soon as there is a suspicious activity in our systems, an alert gets generated from ServiceNow.

Devo has positively impacted our organization because we have been using only one tool for our centralized logging systems. Previously, we used Microsoft Azure's Microsoft Sentinel, which gathered data but was costly and less user-friendly. When we learned about Devo and its features, UI experience, reporting capabilities, and threat detection automation, we moved to Devo. We also manage other customers, and whenever they come to us, we introduce them to Devo's logging tools, and they are always happy to accept it as their centralized logging system. No one has provided negative or bad reviews for using Devo, and I believe both we and our customers are very happy using it.

I can say there has been an improvement in incident response with Devo. It serves as the main solution for all log ingestion across AWS, Azure, GCP, or Oracle Cloud, capturing data from all these clouds. Any unexpected or suspicious behavior or activity from unknown users simply generates a ticket with the help of ServiceNow, integrating seamlessly with third-party tools. I think that is a great feature for us and our customers, as they receive incident reports in a very fast manner with Devo's assistance.

The best features Devo offers include its focus on security investigation as a SIEM tool. Our SOC and NOC teams mainly depend on this tool for security operations and data analytics. For them, this tool is the main foundation for their daily work, which I believe is a key feature for Devo.

Devo stands out for our SOC and NOC teams compared to other tools such as Elastic because of its SIEM capabilities for threat detection and investigation. It utilizes 400 days of hot data, allowing queries to run very fast and yield results quicker than other tools in terms of security and SIEM capability. The 400 days of long-term data retention for searchable log data without transitioning to cold storage is significant. If data moves to cold storage, it takes time to retrieve it into hot storage, but Devo provides hot data for 400 days. The security orchestration is an exceptional feature of Devo for our SOC and NOC teams.

I think some features could be added to Devo. The cost is a little higher compared to other tools such as DataDog or Elasticsearch, so they could work on reducing costs. Additionally, while the support team is good, I feel that the documentation is not always very helpful for some use cases, so improvements could be made in the documentation as well.

The UI configuration could be simplified for new users. While it may be straightforward for seasoned users, new users often feel confused by the vast options available in Devo's UI. I believe there is room for improvement in that area.

I have been using Devo since I started working in my current company, which has been for the last two years.

Previously, we used Microsoft Azure's Microsoft Sentinel, which gathered data but was costly and less user-friendly. When we learned about Devo and its features, UI experience, reporting capabilities, and threat detection automation, we moved to Devo.

Devo stands out for our SOC and NOC teams compared to other tools such as Elastic because of its SIEM capabilities for threat detection and investigation.

There are other improvements needed when comparing Devo with other tools on the market, especially since we have started using Elasticsearch for DevOps and infrastructure. Elastic is much better and less costly than Devo, and it offers a free tier for first-time use, allowing users to gain a good understanding of the tool. Due to this, we have stopped using Devo in our company for the past six months and have transitioned to Elasticsearch, which is performing well.

Devo's main job is to provide a centralized logging system, so we do not have to use other logging systems for other servers. It helps us correlate events from our clouds and third-party clouds, providing all those solutions in one system. Devo is a great tool for anyone to analyze logs and reports.

Devo helps our teams with incident investigation and security monitoring, and it also assists in providing compliance reports, which helps us improve our systems day by day.

My advice to others looking into using Devo is that if you have a large or even small customer project and want to utilize SIEM and security threat analytics, you should consider Devo. It is a great tool. However, if you need infrastructure monitoring and DevOps observability, you might want to opt for Elasticsearch. I rate Devo an eight out of ten.

One practical scenario involved investigating suspicious authentication activity where we had to review logs from multiple sources. Devo helped us centralize the data and allowed the team to investigate faster by correlating the logs instead of checking multiple systems separately.

Devo functions as our centralized visibility and investigation platform, integrated with security workflows. It becomes more valuable when multiple log sources are connected together because it provides a unified SIEM solution.

Typically, we have integrated Devo into an enterprise monitoring environment, which supports centralized log collection and analytics.

In our day-to-day work, fast querying and correlation help reduce our effort because our SOC analysts do not need to manually switch across systems for logs. Correlated visibility helps speed up the investigation and provides more context for decision making. When the analyst uses queries to search, it pulls the data quickly, in a second, which aids us greatly with the investigation.

Devo helps us improve visibility across different environments and allows better incident tracking. The search and analytics capability is also useful for our teams as well as the security teams.

Devo has improved our visibility, log management efficiency, and investigation capabilities positively. Teams are able to investigate events with better context and faster access to the relevant data.

Our analysts can investigate faster when using Devo. It has absolutely reduced our investigation time, improving our investigation quality as well. This helps security teams respond more efficiently.

Devo's main value comes from improved investigation speed. It has improved significantly, and its centralized visibility has reduced our effort in log analysis.

UI improvements, a simplified dashboard, or an easier reporting workflow could further improve analyst productivity.

I rate the customer support a nine out of ten because of their timely technical guidance and responsiveness during the deployment and troubleshooting periods.

Devo provides a good experience overall. It is an enterprise-grade monitoring platform.

I would rate this review an eight out of ten.

I have been using Devo as a partner and system integrator for three years. For log monitoring, the clients' use cases can utilize Devo perfectly.

Compliance and security operation monitoring are the biggest benefits from the product.

Integration is easy, and Devo integrates with most products. Devo has connectors that enhance integration with third-party tools such as firewalls and servers.

Querying helps my data analysis, and it is quite fast. The product provides insight and analytics, and the visualization part contributes to how I understand data insights.

Perhaps Devo could add some features in the future on the network part.

Specifically, I think they could improve network traffic analysis capabilities.

I have been using Devo for three years.

Devo is 99% stable and reliable.

I think it is easy to scale up, but we never did a request for that.

The customer service is average. Technical support from Devo is helpful, but they can improve on the support model.

I think they could improve on the response time.

I have used ArcSight and Splunk previously.

The installation is very easy and seamless.

Devo gives value to the end user and is saving compared to other products in the same category.

I think it saves approximately 10 to 15% compared to similar products.

The price is considered okay.

I work with Devo. When comparing Devo with Splunk and Carbon Black, I think Devo is the leader.

I believe this is because it has the updated technology and component.

Devo has automated machine learning modules that help predict potential threats. The product learns the data and provides additional correlation rules on top of that.

I gave this review a rating of 8.

We have most of our major log sources going to it, and we have both an internal NOC as well as an external MSSP that does 24/7 monitoring. We use it for writing all of our alerting use cases for different correlations between all of our different logging apps.

In terms of our environment, we have several departments. We're a staffing company, and we have a lot of different contractual obligations with other companies. So, it's a fairly complex environment. We have multiple domains. We have several DMZ environments, and we have three active data centers.

We now spend a lot less time supporting different pieces of the SIEM. Log integration is super easy and super fast, and it handles all the data we can throw at it. That was a big deal because we send quite a bit of data to it.

We started using Devo Exchange within the last few months. We've used it to install some active boards and to get some help with different log sources. We used it to access community-driven content. That's how we got some of the active boards. This community-driven content for protecting our organization is very important. One of the problems we had with our previous SIEM was getting adequate support and information about the things we needed, and that hasn't been an issue since the community has been helping us.

It's very easy to use Devo Exchange. There is a bit of a learning curve to learn how they classify and use the data, but once you understand it, it's a very simple platform. This ease of use has improved our incident response capabilities. We've got a much more robust alert stack now. We've been able to build out use cases for things we couldn't in the past. It has been very helpful.

Devo Exchange has saved us weeks. The community gets back really quickly, whereas, for some of the support tickets that we opened previously, it would take so long.

Devo Exchange has been great. With our previous SIEM, there were log sources where we couldn't get any help, and we couldn't get much support because even the company we were working with didn't understand them. With Exchange, because people all over the place have had experience with it, and they are able to give us some ideas.

Devo has absolutely improved our visibility. We had a lot of visibility gaps, especially in our cloud solutions, and integrating cloud solutions with Devo has been great. It increased visibility into our organization.

Devo has allowed us to ingest quite a bit more data. Our data ingestion has almost doubled.

Devo saves us hours in every investigation. Previously, just getting the data to return with searches and things like that was cumbersome. A lot of the interfaces were very slow. We haven't had any issues like that with Devo. It has been very quick.

The most useful feature for us, because of some of the issues we had previously, was the simplicity of log integrations. It's much easier with this platform to integrate log sources that might not have standard logging and things like that. 

Alerting is very easy to set up and use, and it's pretty robust. It takes a lot of ingests. We had some issues previously where we were overwhelming our old SIEM. We were setting too many logs, and it couldn't handle the load. That's why we looked for something that could have much higher rates of ingestion.

The fact that the solution manages 400 days of hot data was a huge selling point. In our organization, we have to have 365 days of hot data all the time, and licensing that with other solutions was extremely expensive.

Some of the documentation could be improved a little bit. A lot of times it doesn't go as deep into some of the critical issues you might run into. They've been really good to shore us up with support, but some of the documentation could be a little bit better.

The other thing is the interface. It's super easy to use, but it takes a little time to get used to. Definitely, the training helped a lot, but it's not like most other SIEMs. That's because of the way they ingest the data. So, it's totally understandable.

We've been using it for seven months.

So far, it has been really good. They have an alert console for any time they're having some slowdowns or anything like that. They're very proactive in alerting us, but there have been very few occasions where we experienced too much lag or slow down. It has been pretty robust.

It's great. That's the reason we like it. It offers us so many tools that we're building out even more in our toolset. It gives us things we didn't have in the past, such as some of the SOAR capabilities and things like SecOps.

I have contacted them a couple of times. They were great. They were quick to assist us. Two different times, we were hitting some issues that were rather complex, and they jumped on calls with us, and we were able to resolve them.

Positive

We used McAfee Nitro. We switched because the technology was very slow and outdated. It wasn't keeping up with the times. Keeping the 365 days of hot data was getting extremely expensive and cumbersome because of the number of disk resources we had to throw at it. The support and updates to the platform were manual because it was an on-prem solution. So, anytime we had to do a major rollout of a SIEM upgrade, it took hours, and it was always problematic, whereas, with a SaaS solution, it's just done in the backend for us.

Implementing Devo has helped reduce blind spots versus our previous SIEM solution especially when it comes to cloud products. McAfee Nitro SIEM had pretty much zero cloud connectivity. We're pretty heavy with Azure and M365 stack, and they had no connectors to get any of those logs into our SIEM. So, we were completely blind to our cloud products.

The biggest impact is that we're able to proactively recognize issues that we're having in those cloud environments. Previously, they were either discovered by somebody accidentally, or an issue arose or an incident happened and we had no alerting around it. We had to triage afterward, whereas now, we have alerting. So, we get those alerts ahead of time.

I led the deployment project. Any project is complex to a degree, but it was as straightforward as they could make it.

In terms of the implementation strategy, we mapped out everything. We had a corporate-wide project around it. The Devo team was completely a part of the deployment project along with our third-party MSSP. The three teams worked together through the entire project. From Devo's side, Rory gave us a hand. Yailin Perez was great. William Wilde was really good. He's a great engineer over there.

The migration piece wasn't bad at all. The initial build-out was a little bit cumbersome, but that goes with any system. For standing up the relays, endpoint managers, and things like that, there was some lead time. It took us about three months just to get everything built and in place for our on-prem pieces to send the information to Devo, but once we were up and rolling, we moved all of our log sources and all of our alerting in just over 90 days.

The ease of migration was extremely important because we were very close to the end of our licensing with our previous SIEM, and we didn't want to relicense and pay for support if we didn't have to. We were able to migrate quickly and avoid that expense.

Devo's team was with us every step of the way. We had weekly stand-ups three times a week, and anytime we reached out to them, they jumped on a call with us immediately. They gave us really good first-line support, and their professional services team was great. They were very knowledgeable, and they assisted us a lot. Our experience was great.

It wasn't difficult at all to get our staff up to speed on using the solution. They provided us with some free training and most of our teams took the free training. So, we were able to hit the ground running as soon as we had the solution in place.

For deployment, internally, we had four resources from four different teams. We had representatives of the Linux team, the Windows team, the security team, and then our procurement team. We also had members from our MSSP as well as from Devo.

In terms of maintenance, it requires very little maintenance. There are just the log sources themselves and other day-to-day things. The solution itself has been no problem. We don't have anybody dedicated to its maintenance. I own the product from a team perspective. So, I'm 100% engaged with it, but everybody in our team uses it, and we all manage it to some degree. We don't have anybody dedicated to just it. It doesn't need it.

We have absolutely seen an ROI. We've been able to hire one more analyst with the money we saved on our licensing.

We extracted value within the first two weeks because we were able to ingest our cloud solutions, but at the 60 to 90 day point, we 100% realized our investment, and we were completely satisfied.

It's very competitive. That was also a primary draw for us. Some of the licensing models with solutions like Splunk and Sentinel were attractive upfront, but there were so many micro-charges and services we would've had to add on to make them what we wanted. We had to include things like SOAR and extended capabilities, whereas all those capabilities are completely included with the Devo platform.

I haven't seen any additional fee. 

We looked at seven different competitors. We looked at Splunk. We looked at Sentinel. We looked at LogRhythm, and we reviewed the newer McAfee SIEM. We did our due diligence. We looked at a lot of them. We did a POC on LogRhythm as well as Sentinel and Devo. We did a bake-off, and Devo was the clear leader.

The biggest thing that we were very careful about was figuring out what our ingest level is ahead of time. It can be very difficult to reach that conclusion, especially when native SIEMs or legacy SIEMs do more ingest on logs per second or events per second, whereas Devo ingests using gigs per day. So, spending some time to figure out that calculation so that you don't over-license or under-license is critical. We were very lucky, and we hit those numbers, but a primary concern of ours at the beginning was making sure we didn't under-license. You don't want to have to expand your licensing and go back to ask for more money.

The biggest lesson that I've learned from using this solution is the way they do the ingest. You don't have to categorize the data ahead of time before ingestion. You can throw all the logs you want at it and then go back and do a correlation afterward. That's the biggest thing we learned. It's a great solution and most other SIEMs don't do that.

Overall, I'd rate it a nine out of ten.

Devo is a SIEM replacement technology used to run security operations. It centralizes security management within a business, functioning as a core system for a SOC. This system is the central cybersecurity hub, helping manage and streamline service tickets.

One of Devo's standout features is its cloud-first architecture, which sets it apart from many traditional SIEM providers that still rely on legacy, on-premise solutions. While many companies have started shifting to the cloud, Devo offers a hybrid solid approach with full cloud deployment. This mature architecture is one of Devo's significant strengths. Unlike other providers like Fortinet and Sentinel, which handle specific security parts, Devo offers a more comprehensive, end-to-end solution, making it one of the most advanced SaaS products.

They can improve their AI capabilities. If you look at some integrations like XDR or AI, which add to the platform to correlate situations in events, there are areas for enhancement. For instance, when an event comes in with many tickets, the best systems excel at correlating and grouping the different instances or alerts into a single instance or ticket, providing context. Their correlation engines sometimes miss the mark, leading to false positives. They're not as strong as other vendors, like SentinelOne, regarding AI power and data or event correlation.

I have been using Devo as a partner for four years now.

Devo's stability is a strong point. As a SaaS provider, they've had no performance issues. 

I rate the solution’s stability a ten out of ten.

When it comes to scale, they're architected quite well. They handle some of the biggest customers globally, with significant throughput on their platform, managing thousands of customers. One of the most impressive aspects of Devo is its customer community. A large majority, over 80 percent of their customers, actively participate on a Devo-specific community page. They're contributing to product development and support, events, and user group information, helping each other out. This high level of engagement is rare and demonstrates both the loyalty of their customer base and the quality of their product.

They offer a range of small, medium, and large options to cater to everyone. I sold Devo products while working with them, focusing on enterprise solutions. However, as a small reseller, my customers were typically smaller businesses.

I rate the solution's scalability a nine out of ten.

The community support is excellent. I rate the direct support around eight, mainly because the company is based in America and has more support infrastructure there than in Europe. In the U.S., the support level rating should be closer to ten.

Positive

The initial setup is easy. They have a lot of out-of-the-box integrations and are quite lightweight in their implementation. There are plenty of options for integration, which I would consider one of their strengths. One standout feature beyond data analytics and real-time diagnostics is something called DeepTrace. If I recall correctly, this feature involves automated threat hunting and investigation. It uses AI to expedite the investigation process, identifying attack chains and conducting root cause analysis without human intervention. Essentially, they're using AI to perform tasks typically done by analysts, automating the investigation process. When you start an investigation, their AI-driven tool provides the best guess at identifying the problem, potentially offering root cause analysis without human involvement. You can either use their suggested analysis or investigate further if needed. This DeepTrace feature is likely one of the unique selling points of their platform, making it a significant differentiator for them.

I rate the initial setup an eight out of ten, where one is difficult and ten is easy.

Compared to Splunk or SentinelOne, it is really expensive.

I rate the product’s pricing a nine out of ten, where one is cheap and ten is expensive.

It integrates several critical components, such as SIEM, SOAR, and UEBA, to make it a robust solution for SOCs. The platform's cloud-based architecture ensures excellent performance, scalability, and quick deployment, particularly beneficial in environments with heavy production loads or when integrating additional tools.

Devo provides near-real-time capability for threat alerts, analysis, and updates. This allows SOC teams to stay on top of security incidents as they happen. Additionally, the platform excels in visualization, providing clear and timely dashboards that help SOCs avoid missing critical incidents or failing to interpret data correctly. Its user-friendly design allows for high-level overviews and detailed drill-downs, ensuring security professionals can quickly grasp the situation and act.

They push AI as their differentiation, calling it a next-gen SIEM. It offers a more inclusive platform that delivers end-to-end security for the entire customer. Using some weighting system, they use AI to drive down false positive rates by determining whether something is a real threat. They have an AI-powered system that assesses if an issue is real, though the specifics of how it works are difficult to explain. This includes machine learning and algorithms designed to identify complex issues, with some of that learning built into the tool. However, this is pretty standard for most SIM platforms today. The biggest challenge for SIEMs has been to make the information they present smarter and more context-heavy. This is not a differentiation but rather being on par with other AI-driven platforms that aim to reduce false positives and minimize manual checks.

I 100% recommend the solution. It can help most medium to large enterprises develop their IT capabilities to advance quickly. However, if you're already at the top of your field and willing to invest heavily, some pedigree products might offer a ten out of ten experience, but that would be due to the higher cost and specialized features.

Overall, I rate the solution an eight out of ten.

Our primary use case is so we have historical logs in case of an event or if we need to do any troubleshooting.

Our secondary use of Devo is for incident detection; certain logs trigger alerts, so we now have a 24/7 monitoring service that detects and alerts us to incidents. 

We can ingest virtually any log source, which is much better than our previous solution. We can access those logs more quickly and efficiently, with a better focus on our points of interest.

Cloud log sources were more difficult with our previous solution. Devo isn't wholly worry-free, but it's much more manageable.

With Devo, we don't have desperate multiple log storage solutions; we can do it for the most part with one. The sheer breadth of logs we can ingest is very beneficial.

The solution allows us to ingest much more data; our event volume is around 100 GB. That's ten times the volume we were ingesting before. 

The alerting is much better than I anticipated. We don't get as many alerts as I thought we would, but that nobody's fault, it's just the way it is. 

Having at least one year of data was one of our requirements, so 400 days of hot data benefits us. We are used to this capability, as our previous solution offered the same, and we wouldn't have purchased Devo if it didn't provide that.  

There are some issues from an availability and functionality standpoint, meaning the tool is somewhat slow. There were some slow response periods over the past six to nine months, though it has yet to impact us terribly as we are a relatively small shop. We've noticed it, however, so Devo could improve the responsiveness.

When we first started implementing the solution, the staff that helped us with the migration and getting it set up seemed very new. The tool could be more mature, which we knew going in, but we were hopeful for quick improvements. We would prefer to be further along than we are in that respect, but 18 months later, we still feel pretty good about adopting Devo.

The price could be more friendly as we pay significantly more than what we were paying before, but it's in line with other solutions on the market.

We've used the solution for 18 months. 

The solution is relatively stable; I'd rate it eight out of ten here. We heard about somewhat shaky performance from other customers over the last six to nine months, but we were fine.

The solution seems scalable, though we're a small shop, so we're probably not the best to answer that well.

We have 400-450 end users across three locations. 

Once we get a hold of someone and they respond, customer support is fine. It isn't extraordinary, and the escalation process is a little below average for the industry.

Neutral

We previously used IBM QRadar, and we switched because it was antiquated. We had difficulty ingesting logs from cloud solutions, which is the direction our organization is moving in. We have several cloud solutions now versus two or three years ago, so the migration to Devo from QRadar was very timely for us in that regard.

QRadar's interface was pretty antiquated. They have updated it now, but we weren't satisfied with it at the time. We also had some support-related issues around updating the solution as it was on-prem. We were coming to a point where we had to update the hardware and software, so it was a good time for us to look for another product.

The initial setup was relatively straightforward. 

In terms of maintenance, I go through every quarter to ensure that each of our log sources is still sending logs to Devo. We were a little disappointed that they didn't have a good way of informing us if a log source stopped sending logs. I appreciate that each source sends on a different frequency, but we should be able to define that frequency and receive a notification of any issues.

As is often the case with security solutions, it's hard to measure an ROI because we only need it once an incident occurs. The hope is that we get a return if an incident takes place. Devo is much better than we previously had, but it's also a lot more expensive, so it should be so.

Devo is a hosted or subscription-based solution, whereas before, we purchased QRadar, so we owned it and just had to pay a maintenance fee. We've encountered this with some other products, too, where we went over to subscription-based. Our thought process is that with subscription based, the provider hosts and maintains the tool, and it's offsite. That comes with some additional fees, but we were able to convince our upper management it was worth the price. We used to pay under 10k a year for maintenance, and now we're paying ten times that. It was a relatively tough sell to our management, but I wonder if we have a choice anymore; this is where the market is.

We focused on four solutions: Splunk, AlienVault OSSIM, the incumbent QRadar, and Devo. We narrowed it down pretty quickly to Splunk and Devo, and the latter was a bit cheaper, though less mature. We took a chance and went with Devo.

I rate the solution seven out of ten.

Devo's cloud-native SIEM increased our threat visibility, though we had hoped for a bit higher. Visibility is critical, as we rely upon knowing about security incidents as soon as possible. We expected the solution would provide additional insight, but we're finding it isn't. Devo gives us the historical logs, a fantastic capability we are very happy with. However, the incident and threat detection is not what we had hoped for. Regarding security operations, the tool is different from what we wanted.

Getting our staff up to speed with the solution was right in the middle in terms of difficulty. It wasn't as easy as we had hoped, but it wasn't insurmountable by any stretch of the imagination. Devo provided us with several training sessions, and I wonder how much that helped because our group is very technical. The tool's interface is intuitive, so our staff can find what they need. With regular use, the learning curve is relatively low, but without that, it can take some getting used to, as with any solution. Devo is broad and encompassing, so it requires familiarity to leverage it fully. We don't have dedicated internal staff to manage the solution, so we outsourced the monitoring to an MSP.  

The migration from QRadar to Devo was relatively straightforward and painless; we essentially cut the cord on QRadar, maintained the logs and moved them over to the new solution. The ease of migration was relatively important, the old solution was antiquated, so we expected any newer tool to be better. 

Migrating the bulk of the initial logs took about three months. We got some aspects up and running during a proof of concept while we were still using the old solution. Once we went live, we migrated the POC environment to a production environment, so it was much less stressful than it could have been. 

The Devo team was intimately involved in the migration. They weren't as responsive as we had hoped, and they seemed new and didn't completely understand the product. We received better support on escalation; overall, they were critical to the migration.

Before going down this path, I advise potential customers to document their log sources and what information they need based on their use cases.