Splunk Enterprise Security is a SIEM, log management, and IT operations analytics tool. The solution provides users with the ability to secure their information and manage their data in the cloud, data centers, or other applications. Splunk Enterprise Security also offers visibility from different areas, levels, and devices, rather than from a single system, thus, providing its users with flexibility. Splunk Enterprise Security can monitor data and analyze, detect, and prevent intrusions. This benefits users as it provides alerts to possible intrusions, helps users to be proactive, and reduces risk factors.
It is not cheap.
Pricing and licensing is quite expensive. But for the value the product provides, it seems at par in the market.
It is not cheap.
Pricing and licensing is quite expensive. But for the value the product provides, it seems at par in the market.
Wazuh is an enterprise-ready platform used for security monitoring. It is a free and open-source platform that is used for threat detection, incident response and compliance, and integrity monitoring. Wazuh is capable of protecting workloads across virtualized, on-premises, containerized, and cloud-based environments.
Wazuh is open-source, so I think it's an option for a small organization that cannot go for enterprise-grade solutions like Splunk.
There is not a license required for Wazuh.
Wazuh is open-source, so I think it's an option for a small organization that cannot go for enterprise-grade solutions like Splunk.
There is not a license required for Wazuh.
Dynatrace is an AI-powered software intelligence monitoring platform that accelerates digital transformation and simplifies cloud complexities. Dynatrace is an entirely automated full-stack solution that provides data and answers about the performance of your applications and deep insight into every transaction throughout every application, including the end-user experience. By modernizing and automating enterprise cloud operations, users can deliver an optimal digital experience with higher quality software to customers faster.
Decodes on less used/popular protocols are available, but they should be included. Additional investment should not be required.
Pricing is based on the number of servers monitored, so for big applications, it is a bit expensive.
Decodes on less used/popular protocols are available, but they should be included. Additional investment should not be required.
Pricing is based on the number of servers monitored, so for big applications, it is a bit expensive.
Datadog is a cloud monitoring solution that is designed to assist administrators, IT teams, and other members of an organization who are charged with keeping a close eye on their networks. Administrators can use Datadog to set real-time alerts and schedule automated report generation. They can deal with issues as they arise and keep up to date with the overall health of their network while still being able to focus on other tasks. Users can also track the historical performance of their networks and ensure that they operate at the highest possible level.
It has always scaled for us. Cost scales up too, but that is not necessarily a bad thing. It's reasonable for what they're providing.
It costs the same amount it would if we were hosting it ourselves, so we are incredibly happy with the cost.
It has always scaled for us. Cost scales up too, but that is not necessarily a bad thing. It's reasonable for what they're providing.
It costs the same amount it would if we were hosting it ourselves, so we are incredibly happy with the cost.
IBM Security QRadar is a security and analytics platform designed to defend against threats and scale security operations. This is done through integrated visibility, investigation, detection, and response. QRadar empowers security groups with actionable insights into high-priority threats by providing visibility into enterprise security data. Through centralized visibility, security teams and analysts can determine their security stance, which areas pose a potential threat, and which areas are critical. This will help streamline workflows by eliminating the need to pivot between tools.
Go through a vulnerability assessment review for price breaks. A virtualized solution will also cut down on cost.
found other solutions, with more features at the same cost or less. You don’t have to leave the Gartner Magic Quadrant to beat their price.
Go through a vulnerability assessment review for price breaks. A virtualized solution will also cut down on cost.
found other solutions, with more features at the same cost or less. You don’t have to leave the Gartner Magic Quadrant to beat their price.
Pricing is one of those situations where the more you use it, the more you pay.
The price of Elastic Observability is expensive.
Pricing is one of those situations where the more you use it, the more you pay.
The price of Elastic Observability is expensive.
LogRhythm SIEM Platform is an award-winning platform in security analytics. With more than 4,000 customers globally, LogRhythm SIEM is an integrated platform that helps security operations teams protect critical infrastructure and information from emerging cyberthreats. Ultimately, LogRhythm SIEM is an integrated set of modules that contribute to the security team’s fundamental mission: rapid threat monitoring, threat detection, threat investigation, and threat neutralization. LogRhythm SIEM is for organizations that require an on-premises solution and offers:
If you don't have your staff, absolutely look into the co-pilot and factor that into your cost evaluation.
Look for whatever will give you the most value. That's the main point. It is not one size fits all.
If you don't have your staff, absolutely look into the co-pilot and factor that into your cost evaluation.
Look for whatever will give you the most value. That's the main point. It is not one size fits all.
Graylog is purpose-built to deliver the best log collection, storage, enrichment, and analysis. Graylog is:
Having paid official support is wise for projects.
I am using a community edition. I have not looked at the enterprise offering from Graylog.
Having paid official support is wise for projects.
I am using a community edition. I have not looked at the enterprise offering from Graylog.
Sumo Logic
Purchasing Sumo Logic through the AWS Marketplace was a simple step.
Purchasing the solution through the AWS Marketplace is very easy.
Purchasing Sumo Logic through the AWS Marketplace was a simple step.
Purchasing the solution through the AWS Marketplace is very easy.
Fortinet FortiAnalyzer is a powerful platform used for log management, analytics, and reporting. The solution is designed to provide organizations with automation, single-pane orchestration, and response for simplified security operations, as well as proactive identification and remediation of risks and complete visibility of the entire attack surface.
Its worth spending on FortiAnalyzer if you have multiple firewalls in your network.
The hardware cost and services contract are fair.
Its worth spending on FortiAnalyzer if you have multiple firewalls in your network.
The hardware cost and services contract are fair.
Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!
Security Onion includes a native web interface with built-in tools analysts use to respond to alerts, hunt for evil, catalog evidence into cases, monitor grid performance, and much more. Additionally, third-party tools, such as Elasticsearch, Logstash, Kibana, Suricata, Zeek (formerly known as Bro), Wazuh, Stenographer, CyberChef, NetworkMiner, and many more are included.
Security Onion is a free solution.
It is an open-source solution.
Security Onion is a free solution.
It is an open-source solution.
Real-time log management and analysis
The cost of using Stackdriver depends on usage.
The cost could be lower.
The cost of using Stackdriver depends on usage.
The cost could be lower.
Amazon CloudWatch is a monitoring and observability service provided by Amazon Web Services (AWS). It allows users to collect and track metrics, collect and monitor log files, and set alarms. With CloudWatch, users can gain insights into their applications, infrastructure, and services, enabling them to make informed decisions and take necessary actions.
We have monthly licensing costs. The licenses are probably in the vicinity of about $300 - $350/month.
Its pricing is reasonable. It is sometimes tricky, but it is reasonable as compared to others.
We have monthly licensing costs. The licenses are probably in the vicinity of about $300 - $350/month.
Its pricing is reasonable. It is sometimes tricky, but it is reasonable as compared to others.
Optimizing SIEM
syslog-ng is the log management solution that improves the performance of your SIEM solution by reducing the amount and improving the quality of data feeding your SIEM.
Syslog-ng is a free open-source solution.
Syslog-ng is open-source.
Syslog-ng is a free open-source solution.
Syslog-ng is open-source.
A syslog server is a logging server that allows for the centralized collection of syslog messages, known as events, from a variety of networking devices such as routers, switches, and firewalls, in addition to servers running a variety of operating systems.
We subscribe and pay directly on the website.
The price of SolarWinds Kiwi Syslog Server could improve.
We subscribe and pay directly on the website.
The price of SolarWinds Kiwi Syslog Server could improve.
Pricing could always be lower. If it were free, I would be more satisfied.
The license cost for any other monitoring tool is too high compared to this product.
Pricing could always be lower. If it were free, I would be more satisfied.
The license cost for any other monitoring tool is too high compared to this product.
Coralogix is a stateful streaming data platform that provides real-time insights and long-term trend analysis with no reliance on storage or indexing, solving the monitoring challenges of data growth in large-scale systems.
We are paying roughly $5,000 a month.
The cost of the solution is per volume of data ingested.
We are paying roughly $5,000 a month.
The cost of the solution is per volume of data ingested.
The pricing is quite harsh.
It's not cheap at all as it's a big product and has been in the market for quite some time now.
The pricing is quite harsh.
It's not cheap at all as it's a big product and has been in the market for quite some time now.
It's comprised of Elasticsearch, Kibana, Beats, and Logstash (also known as the ELK Stack) and more. Reliably and securely take data from any source, in any format, then search, analyze, and visualize.
Built on a foundation of free and open, Elasticsearch and Kibana pave the way for diverse use cases that start with logging and span as far as your imagination takes you. Elastic features like machine learning, security, and reporting compound that value — and since they’re made for Elastic, you'll only find them.
I used the open-source version of Elastic Stack, because of which I did not have to pay anything.
The pricing is reasonable.
I used the open-source version of Elastic Stack, because of which I did not have to pay anything.
The pricing is reasonable.
Nagios Enterprises delivers official products, services, and solutions for and around Nagios – the industry standard in enterprise-grade IT infrastructure monitoring. With millions of users worldwide, Nagios is the undisputed champion in the IT monitoring space. Our team of dedicated professionals works to ensure total customer satisfaction with all the services we provide. Our extensive network of partners helps extend Nagios services and solutions to new organizations and markets worldwide to meet a variety of business needs. Nagios Enterprises was founded in 2007 by Ethan Galstad. Ethan created what would later become known as Nagios in 1999, and currently serves as the President of Nagios Enterprises.
We found the pricing to be quite affordable.
For a single instance, the price is around $4,000.
We found the pricing to be quite affordable.
For a single instance, the price is around $4,000.
Logz.io is a leading cloud-native observability platform that enables engineers to use the best open source tools in the market without the complexity of operating, managing, and scaling them. Logz.io offers four products: Log Management built on ELK, Infrastructure Monitoring based on Prometheus, Distributed Tracing based on Jaeger, and an ELK-based Cloud SIEM. These are offered as fully managed, integrated cloud services designed to help engineers monitor, troubleshoot and secure their distributed cloud workloads more effectively. Engineering driven companies like Siemens, Unity and ZipRecruiter use Logz.io to simplify monitoring and security workflows, increasing developer productivity, reducing time to resolve issues, and increasing the performance and security of their mission-critical applications.
The tool is an open source product.
The product's pricing is cheaper than other solutions.
The tool is an open source product.
The product's pricing is cheaper than other solutions.
Logsign delivers automation-driven cyber security solutions and are committed to providing the smartest, easiest-to-use and most affordable cybersecurity detection and response solutions and value-added services. Logsign Next-Gen SIEM is an enterprise-grade SIEM, inline with our promise, it's easy-to-deploy, easy-to-use and affordable unlike the other enterprise-grade SIEM softwares.
Compared to other SIEMs, it has low pricing.
Compared to other SIEMs, it has low pricing.
Cribl Stream is designed for efficient log data management, allowing users to optimize and control their log data streams effectively. Key use cases include routing logs to specified destinations, transforming data into more manageable formats, filtering out superfluous details, and enriching logs with additional context. This results in enhanced system performance and cost-effectiveness, as only pertinent data is retained for analysis.
Users applaud Cribl Stream for its robust data routing capabilities, flexible data transformation, and user-friendly configuration, all accessible via an intuitive UI. The platform’s ability to scale seamlessly helps it manage massive data volumes, supporting extensive organizational operations without performance hits. Moreover, it contributes significantly to operational efficiency, helping organizations reduce process time, enhance data-driven decision-making, and foster a collaborative work environment.
Falcon LogScale is your one-stop shop to address security, IT, and DevOps logging requirements. With its high scale and affordable price, Falcon LogScale extends super-fast search, analysis, and visualization to all of your data. A powerful, index-free architecture and advanced compression technology lets you store all of the data you need for months or years.
Logstash is a free and open server-side data processing pipeline that ingests data from a multitude of sources, transforms it, and then sends it to your favorite "stash."
Seq is a log storage, analysis, and monitoring tool that has gained popularity among users due to its efficient and intuitive interface. It offers powerful search capabilities, making it an essential tool for troubleshooting and debugging. Users have praised its ability to handle large volumes of logs and its integration with platforms such as .NET and Docker.
The most valuable features of Seq include its powerful log searching capabilities, efficient error analysis and debugging tools, customizable dashboards and metrics, intuitive user interface, and seamless integration with various programming languages and frameworks. Users also appreciate the scalability and performance of Seq, as well as its support for collaboration and team workflows.
Sematext Logs is a cloud-based SaaS log management solution that offers you real-time actionable insights into your log analytics with hosted ELK as a service, in the cloud or on-premises. Logs can be aggregated from a variety of sources using it because it's compatible with a large number of log shippers, libraries, platforms, and frameworks. Sematext’s auto-discovery of logs and services lets you automatically start log monitoring from both log files and containers and forward them directly through the user interface. Sematext Logs features sophisticated full-text searching, filtering, and tagging capabilities and allows you to correlate logs with infrastructure and application metrics within a single dashboard.
Better Stack allows you to collect logs across your stack, be it from your node.js app or a Kubernetes cluster, and centralize them into one place. But it's not just storage. With Better Stack, you can live tail and query your logs with blazing speeds using SQL. You can build actionable dashboards and explore all the insights your logs have to give.
