What is our primary use case?
Hunter is a very new SIEM in the market. It is definitely a broad market for us as they are trying to establish a new place against competitors like Splunk and QRadar. This makes it challenging to establish themselves.
Hunter has an upper hand, which other SIEMs can learn from. They offer hundreds of inbuilt use cases that other SIEMs lack. We typically have to create each use case as a custom one. However, Hunter proactively provides a set of five to six hundred use cases, categorized based on cloud use cases, endpoint use cases, parameter use cases, and malicious use cases. We can select or enable these use cases according to our requirements, adjusting them to fit our customer environment and company environment.
They also provide the ability to tweak those use cases, numbers, timings, and thresholds as per our client or company needs. This is a great move by Hunter.
Another great move is their pricing model. Other SIEM tools base their license cost on the volume of data processed, often charging by how much TB or GB data is processed. Hunter, however, charges based on the number of data sources and the number of data entities integrated, which saves money. This helps us save a lot of money compared to releasing a lot of money with other SIEMs. However, Hunter still has a long way to go.
What is most valuable?
In Hunter, 'detectors' are a key term. Instead of calling them use cases or correlation rules, Hunter refers to them as detectors. Their inbuilt detectors are quite advanced and intelligent. We can use them freely without making any changes, though we can adjust thresholds to fit our environment's size. What's commendable is that they keep updating their detectors from the back end, maintaining continual efforts without client prompts. However, initially, they deactivated detectors without client approval, which impacted security monitoring as SOC engineers were monitoring alerts triggered by these detectors.
Hunter has since learned and improved their process by obtaining client approval first. They consistently update detectors to match the evolving threat landscape, ensuring the tool's uptime, resiliency, and availability. Additionally, they provide a niche module like UEBA (User Entity Behavior Analytics) free of charge, whereas other SIEM tools charge for it. This tool is vital for monitoring internal threats, especially among VVIP and VIP users.
Hunter also plans to expand features like spam score and reputation score insights within their tool, removing the need for external checks. They are at an early stage, but they are working on expanding this feature.
What needs improvement?
Hunter support is functional yet not exceptional. Their support engineers could be more advanced and faster in providing solutions. Their turnaround time could improve to match other tools. When feedback is provided, they consider it and indicate if it is in the development stage. They commit to fixing bugs and developing the module or feature, however, take quite a lot of time. I would rate their customer support as needing improvement.
Another area needing improvement is integration capabilities, as they are not yet fully compatible. Users still have to rely on third-party software or integration tools.
Furthermore, they should incorporate more GenAI capabilities, a current buzzword, and enable predictive use cases. Their tools should be capable of reading the environment, making adaptations, and automatically tweaking settings as per client or environmental needs, similar to capabilities provided by other SIEM tools.
For how long have I used the solution?
I have been using the solution for two years.
What do I think about the stability of the solution?
I've never encountered instability or downtime with Hunter. Their system ensures availability even during back-end advancements. It is reliable and maintains service readiness for clients, demonstrating considerable stability.
What do I think about the scalability of the solution?
Hunter has much to learn and is working to establish its market presence. Scalability-wise, they are attempting consistency amid feature development, yet occasionally they backtrack and take excessive time. While expected during their learning phase, I am confident their ongoing progress will lead to becoming one of the premier solutions available.
How are customer service and support?
Hunter support is functional yet not exceptional. Their support engineers could be more advanced and faster in providing solutions. Their turnaround time could improve to match other tools. When feedback is provided, they consider it and indicate if it is in the development stage. They commit to fixing bugs and developing the module or feature, and yet take quite a lot of time.
How would you rate customer service and support?
How was the initial setup?
For the initial setup, I would rate it out of 10. It was fine.
What about the implementation team?
I'll be honest. I was not part of the implementation. There were dedicated engineers from the client side and vendor side who managed implementation.
What other advice do I have?
Their knowledge base is good. When starting with Hunter, ensure you have one or two sessions to understand navigation, features, and modules, along with obtaining proper documentation. This will help SOC users navigate effectively due to their comprehensive knowledge base. However, initial sessions with the vendor are recommended to facilitate easier ongoing use.
Overall product rating is eight out of ten.
