LevelBlue Managed Detection and Response Reviews

The main use case for Alert Logic MDR in our organization is using it for endpoint detection and response as an endpoint detection system to secure our endpoints and systems, along with our clients who are securing their endpoint detection.

Whenever an alert comes to Alert Logic MDR, we download Alert Logic MDR to the endpoint of the customer in our organization. When the laptop endpoint is online and a malicious or suspicious event happens, such as a pop-up or a malware attack, we directly receive the alert on Alert Logic MDR. As a 24/7 monitoring team, we perform some basic analysis, static analysis, and raise that alert to the team.

The best features that Alert Logic MDR offers include AI and behavior analysis, which I find most valuable.

AI and behavior analysis mean that within AI there is static AI analysis and behavior analysis with subtypes. For example, if there is any file or a certain subtype, or if ransomware is happening, or any tool or app is being used, there are subtypes of AI. I appreciate that Alert Logic MDR has a separate AI for each type.

Alert Logic MDR has positively impacted our organization by minimizing the alert SLA timing. When we used our other endpoint detection and response solution, we required at least fifteen minutes to raise one alert. After using Alert Logic MDR, we integrated it with SOAR technology, so within five minutes, the alert is raised to the client.

Efficiency-wise, reducing the alert SLA timing to five minutes has been very beneficial. Whenever we receive an alert from endpoint detection and response from an endpoint to the Alert Logic MDR console, the system directly has the protect mode, conducting the kill and quarantine process itself. We only have to perform static analysis, and we have the playbooks, so they conduct some static analysis from there and directly raise the alert to the respective team.

Everything is good with Alert Logic MDR.

If I had to pick one area where Alert Logic MDR could be even better, it would be the rollback feature, which is currently for Windows only. If it existed for Linux and Mac, it would be beneficial.

I have been working in my current field for two and a half years.

Alert Logic MDR is very stable. You will find no errors or glitches with Alert Logic MDR.

Scalability is dependent on your organization and how you want to scale. Alert Logic MDR is scalable.

Customer support is very good. They help whenever we get stuck, and we raise tickets to customer support to get help.

We previously used SentinelOne, primarily for its pricing.

We purchased Alert Logic MDR through the AWS Marketplace.

Our business relationship with Alert Logic MDR's vendor is that we are a reseller, reselling the product to our customers.

We cannot say we have seen a return on investment ROI-wise, but our first priority is to secure the endpoint. As per the customer feedback, we receive good reviews.

Regarding my experience with pricing, setup cost, and licensing, the sales and management teams discuss the price, which is per endpoint around ten to twelve dollars, and it is a good setup cost.

We did not evaluate other options before choosing Alert Logic MDR.

For those looking into using Alert Logic MDR, I advise providing access before buying, and you could also consider a pilot deployment in your organization and for your customer.

There are no improvements needed with Alert Logic MDR that we have not discussed. I have covered everything.

Alert Logic MDR is a good MDR solution, and I have shared all my thoughts about it. This review has been given a rating of nine out of ten.

My main use case for Alert Logic MDR was investigating all cloud assets and generating alerts when issues or attacks were detected, whether DDoS attacks or other kinds of security attacks. Alert Logic MDR was detecting and identifying where attacks were originating.

I recall a previous instance when there were numerous attacks coming from one particular country using different IPs. Those were Chinese IPs, and when checked on VirusTotal and other sites, they were blacklisted. We put a firewall rule and placed all of them in blacklist mode for those IPs.

The best features Alert Logic MDR offers include not only detecting incidents but also providing details about where any incident is coming from. You can integrate those with your ticketing tools, such as ITSM or ServiceNow, which is a good feature.

The integration with ticketing tools such as ServiceNow helped my workflow by automatically creating a ticket and sharing it with the required team as soon as a critical alert is generated. Alert Logic MDR has a feature for critical and high-level incidents where a ticket is automatically created and shared with the required team for investigation. This helped in achieving a faster response before any major incident happened.

Alert Logic MDR has positively impacted my organization as it has helped in detection of incidents and responding through our security team, who work around the clock. Alert Logic MDR has reduced security response time for us and helped in detection. When we need to deep dive for any incident, Alert Logic also provides many helpful areas which assist in deep-dive investigation. That is beneficial.

I think Alert Logic MDR could be improved. If Alert Logic MDR not only detected incidents but also allowed us to block those incidents or isolate any affected asset, that would be beneficial.

I have used Alert Logic MDR in my previous organization for around two years.

I do not have anything else to add about my use case with Alert Logic MDR. I do not want to add anything about the features. I do not want to add more about needed improvements or any challenges I faced.

Regarding Alert Logic MDR's AI capabilities, I have not used that AI capability. At that time, AI capabilities were not evolved yet. If there is anything specific about it or any documentation related to that, I will definitely go through with it.

Regarding Alert Logic MDR's AI capabilities, I think the accuracy and reliability of output is the same because when I used Alert Logic MDR, there was no AI feature at that time. It has just launched now. I need to go through with it, and I have not used it, so I cannot say anything about it.

I do not think there are any improvements needed for Alert Logic MDR that I have not mentioned. I would rate this solution a 9 out of 10.

I am part of a reseller with two roles. We are a Managed Service Provider ourselves, and in a way, we compete with managed detection and response with the MDR product. 

In our managed service, we use the NGAV product and mainly the EDR product to provide our service. In some situations, we resell all three products or even four. We resell NGAV and EDR to customers who want to run it on their own, and we resell these products, including MDR, with a managed service from Cybereason, where the customer prefers that. 

When we sell the XDR product, MDR is always included. This depends on the customer situation. We resell MDR when the customer is price-sensitive and needs real 24/7 service. The Cybereason model is more economical than ours. We are more flexible but more expensive.

The quick reaction and the ability to restore the state before within a short time are significant. It is quick to detect, quick to react, and able to bring back the state to get rid of the damage. It's very reliable. When something happens, they see it.

If the language barrier was addressed, it would lower the barrier for a number of German customers. It would take away a unique selling point for our own specialist managed service. I'm a bit hesitant, however, this would improve the product or the offering. Detection time already is very quick. The completeness of the offering was integrating more data. I am discussing with a customer who wishes to include identity data. Detecting early when someone tries to compromise your ID would be a nice feature.

I have been using the solution for four years.

I haven't heard of problems there. I might not give a ten. That's maybe typical German, so I would say nine out of ten.

We do have very small customers, which is rather an economical limit. I would give it a seven out of ten. It scales very high. It doesn't always scale down, so there's a certain minimum amount.

I think of situations I know. There's a technical account manager, and the customers are very happy with it. I would give it an eight out of ten.

Positive

As far as I know, there are mainly two things to do. One is the settings and the control screens, and you get guided by the Cybereason onboarding team. They explain which choices to make, what the choices would mean, and do it with the customer. The second thing to do is to roll out the sensors, and that's fairly easy. There are rarely heard of problems, so I would give it an eight or nine out of ten. Eight is good.

During my experience, they added the coverage for the XDR product series, including additional alerts from firewalls. They grew their offering and adapted it to current threats and current countermeasures. When the Log4j bug got public, they were quick to provide a hunting query, showing how quick they are to react for all customers. 

Indeed, I would rate the overall solution eight out of ten.

Our client selected Alert Logic for the Voluntary Management model. We used it for return parameter management three sixty. Our team, consisting of around four to five members, along with two or three members from the client, used the TVM Model or the preprocessing management model. The client also set up a physical appliance in their environment, although I am not certain whether maintaining it was the responsibility of Alert Logic team or our client.

The standout features of Alert Logic included the topology feature, which was helpful for mapping assets on the network, giving a clear understanding of all connected devices. It also performed real-time scanning of assets. Furthermore, Alert Logic was up to date with new vulnerabilities, quickly adding them to the database.

One major missing feature was the ability to see if vulnerabilities were exploitable, which required extra effort for us. Alert Logic did not adhere fully to the CVSS standards, offering only high, medium, and low categories rather than the detailed CVSS scale. Additionally, the reports were very basic and required considerable work to finalize.

I did not use many products from last year, July to now.

I did not face any issues during the four-month duration that I used Alert Logic. It was stable without server or client errors.

Although I have no specific details, the solution was scalable and we did not face any lagging issues.

We knew that we had an option to raise tickets if we faced any issues with the product, but during the four-month duration, we did not face any such issues.

The client had taken care of the deployment and product choice. We were service providers only.

I would definitely recommend Alert Logic because it is a good product that constantly adds new features and changes interfaces. If you spend time to understand the product, it can be put to good use. The licensing was managed by our client, and while I cannot recall how it was structured, we did not have any lagging issues. Based on my short experience with only one module, I would give Alert Logic a rating of seven.

Positive

We use Cybereason Managed Detection & Response for general security and monitoring of our environment. This includes threat detection and response to ensure we are aware of threats that are in our environment.

The pricing is valuable because we do not need to have our own data center and software licensing for monitoring. The response from the service provider is quick and responsive. They inform us of threats even before we are aware, through reports. Automated information on zero-day threats is provided without us needing to ask. Another feature we like is that they can detect threats and alert us even when we are not at work.

The interface, particularly the dashboard we use for looking at alerts, could be improved. The ease of use of the dashboard and accessing security reports needs enhancement.

I have been using Cybereason Managed Detection & Response for a year, which is approximately 12 months.

There has been no downtime with Cybereason Managed Detection & Response.

The tech support is relatively helpful. They respond to our queries on time and are always available when we have concerns and questions.

Neutral

We previously used an on-premises SIM solution. Moving to Cybereason was easier to deploy and less costly compared to more extensive SIM solutions.

The setup required ensuring all devices were standardized and ready for monitoring by the MDR solution, which took some time.

We have experienced fewer successful incidents, leading to a more stable environment with the MDR solution.

The valuable aspect of pricing is that we do not need our own data center and software licensing, which reduces costs.

We evaluated several options, including larger SIM solutions. We decided on a SIM Lite solution like XDR and eventually chose a managed service that was easier to deploy and less costly.

I recommend considering the cost of maintaining your own data center versus using a service like Cybereason MDR, which leverages expert resources and AI-powered solutions for threat detection. On a scale of one to 10, I rate the solution as a seven because they meet many of our requirements but could improve services to match higher-cost providers.

My company uses Cybereason Managed Detection & Response for incident response, and whenever there is a breach, we support some clients. In short, we also manage it for our company's clients.

The most valuable feature of the solution is endpoint management. Though I can't remember what it is exactly called, it is the isolation feature that allows you to isolate malware as soon as the tool detects it, especially when it doesn't respond to quarantine. The investigation feature allows you to search and see what has happened in the logs.

My company's issue with the solution stems from the fact that for every client, we have to spin up a new Cybereason instance, so there is not a single Cybereason instance where you can manage all your clients. For every new client or every new case, my company has to spin up a new instance, because of which there is a new URL. My company has to invest in enrolling people again and add all your new IOCs back into each instance. There is no centralized way to manage multiple instances of Cybereason, which is probably the biggest issue that wouldn't allow onboarding someone new, causing a lot of effort in the initial setup, maybe through a whole different web interface at times.

I have been using Cybereason Managed Detection & Response for two and a half years. My company has a partnership with Cybereason, and we also help others implement part of the solutions from Cybereason.

I cannot say that we have encountered any stability issues related to the solution in our company, but there have been some integration or interoperability issues, especially in cases where there is an antivirus or any other security tool. The tool itself is pretty stable. There are just more interoperability issues when there are other tools in the environment.

I rate the stability of the solution an eight out of ten.

My company has not encountered problems with the solution running in large environments. My company shows that multiple detection servers are linked in larger environments.

My company caters to small and medium-sized businesses, but we're also partnered with two international telecoms to whom we provide IR services, and they use it. Individually, the international telecom companies have around 25,000 to 50,000 employees.

The solution's support team is quite good at giving us feedback if there is an issue.

I rate the overall support an eight out of ten.

Positive

The initial setup of Cybereason Managed Detection & Response was easy since it provides good documentation for each use case or where there are problems.

The solution is deployed on the cloud. Though the solution is deployed on-premises, it is mostly deployed on the cloud. For most of our company's clients, we deploy the solution on AWS Cloud, and for our clients in South Africa, we deploy the solution on Azure Cloud.

My company completes the initial deployment, especially if it's a Cybereason IR, within 48 hours at the key affected areas. If it is a managed server that my company deploys, then the deployment may take up to weeks. With Cybereason IR, the deployment process is rapid since you need to be quickly deployed.

I had compared the pricing of Cybereason Managed Detection & Response with the other products we deal with in our company. Cybereason's pricing depends on the way it is hosted and how it is hosted in an IT environment. In South Africa, the local telecoms host the tool on Azure as a part of a larger managed service, making it less expensive. If some smaller companies have Azure to host the solution separately, then I get a bit expensive. There are other idiot providers in the market providing both the cloud and the endpoint costing together. Price-wise, Cybereason Managed Detection & Response is effective for larger companies, but if you have a small company with less than 1,000 employees, then it gets expensive.

I rate the overall tool an eight out of ten.

Alert Logic is a highly mature managed detection and response XDR service that has been under development for more than 22 years. It's a comprehensive solution with all the essential XDR elements and the latest technologies, such as artificial intelligence and machine learning. I recommend deploying Alert Logic for all kinds of customers in the public and private sectors, including utility companies, financial services, government, etc.

Alert Logic offers total visibility into the client's IT ecosystem. The solution's intrusion detection system inspects 100 percent of the network packets and installs universal agents on all physical and virtual servers for log collection. Alert Logic also aggregates logs of the client's various 3rd Party security tools into a single pane of glass. 

All of the analytics from those data feeds got to a 24/7 SOC with sophisticated resources. Alert Logic has massive threat intelligence resources to provide additional context to the incident response declarations. They do all the heavy lifting for clients who lack the technology and resources to operate their own SOC. 

The client is solely responsible for the incident response component. The macro analytics resides on Alert Logic's cloud. You have the ECM response and business application team on the client side.

Everything works in tandem, which is the only way you can deal with the advanced threats we face today, especially the ransomware families. If you don't respond in minutes, you're in trouble.

The most valuable aspect of Alert Logic is its optimized technology platform. They have SOCs in the US and Europe, giving them global visibility of the threat landscape. They detect and respond to threats in an average of 6 minutes. Their biggest value is human expertise. You're being attacked by a human, and you cannot respond to it unless you have a human on the other side. They have the human and technological resources to respond.

Alert Logic should also develop an EDR that is natively integrated into their XDR solution eliminating the costly 3rd Party EDRs. Currently, a client must buy another EDR solution like SentinelOne, CrowdStrike, or Sophos. I think Alert Logic is developing this. A built-in email with AI security could also be developed and integrated into their holistic MDR platform.

I have been an Alert Logic reseller for 3 years.

I rate Alert Logic 10 out of 10 for stability.

I rate Alert Logic 10 out of 10 for scalability.

I rate Alert Logic customer service 10 out of 10.

Positive

Yes SecureWorks. Swithched for increase depth/visility, integration of multiple services in one console and compliance reporting as added value.

The implementation is pretty straightforward. You immediately gain visibility as soon as you install the IDS appliance, deploy the agents on the servers, and start collecting syslogs. However, you need to take some additional time to fine-tune and optimize the platform and all the devices. It takes about four to six weeks to get results and around three months to optimize the platform monitoring service.

Implemente via Alert Logic's PM, Security Engineers and Securty Architects. Very smooth. Important to note they have a post implemetation process that includes Engineers from UK and a Pen Test. Very Important to validate your security posture...

Alert Logic offers a very high ROI, over 500%

Alert Logic's license is one of the most competitive. They deliver a high-quality service for a competitive price. 

I evaluated Deepwatch and SecureWorks Alert Logic is more mature, with 20-plus years of development. While Deepwatch is a very advanced MDR, it is only about five or six years in the CMMI process. Alert Logic also has advantages in online compliance and security reporting. It covers several regulatory mandates, such as PCI, HIPAA, SOC2, etc. with automated compliance features, which is somewhat unique in the industry.  

I rate Alert Logic 10 out of 10. 

The use case for Alert Logic was to identify configuration issues related to security and cloud infrastructure.

Alert Logic provided value by offering a single dashboard that amalgamated various sources for performing specific activities.

As a corporation, your responsibility is to address the reported issues, and Alert Logic did its job in this regard. A product such as Alert Logic provides you with the necessary information, and the effort behind it is to have a process in place that allows you to fix the reported issues. Although the solution does not have many features, it shows you what is wrong in various categories, and it is up to you to go and fix it. You can then mark it as complete or incomplete or leave a comment. No additional features are required for the solution to serve its intended purpose. As a user involved with the user interface, I believe there is a need to continue improving it based on feedback from our customers.

Though not currently utilized within my company, I have recently used the solution as a user responsible for its maintenance. Additionally, my company was a customer of this solution.

The solution was consistently available, and I cannot recall any instances where it was down.

Since it solely manages logs, the solution can scale efficiently.

I never had the opportunity to communicate with technical support or order support, so I am not familiar with their services.

I was not involved in the setup process.

I am unaware of its cost.

The solution was user-friendly, and I would rate it an eight out of ten. Our company needed one or two individuals to maintain the solution, which was not difficult and required minimal maintenance. Overall, I would rate the product a seven and a half to eight out of ten.

It could help us report all the logs and everything and serve as the main SIEM tool we use before escalating tickets.

Like any other tool that can process large amounts of data, Alert Logic allows me to feed it with a lot of data. What sets Alert Logic apart is its cloud-based and GUI-focused approach. While I still have on-premises appliances, I can remotely monitor everything from the cloud, and Alert Logic's ease-of-access features have helped me streamline my workflow and reduce implementation time.

When I was using it, I think the valuable feature was the ability to monitor the Ada environment and detect heuristic threats such as brute-force attacks. It could differentiate between legitimate user behavior, such as a user forgetting their password and repeatedly trying to log in.

My main issue with them was the constant need for meetings to discuss developing the API model we needed. It felt like we were always in and out of meetings trying to figure it out. It would be great if they could create a more user-friendly experience, like a drag-and-drop interface or a website builder, where clients could build their own API without needing access to the back end.

Let me choose the specific tools I want to use and be able to set a price for each of them. Maybe I don't need the entire package in my environment, but I really just want the IDS/IPS. I don't like Splunk or one of the other providers, like Rapid7, who don't work well for me in my environment. So, I suggest having packages for small to medium-sized businesses, even if the primary focus is on larger companies.

I have used Alert Logic in a couple of environments as our IDS/IPS system, attempting to model it for anything that could come through the environment. That way, it provides us with all logs and everything we need. I am a customer of the solution.

The stability of Alert Logic has been pretty good. Our company has continued to use it even after the initial deployment, and there have been attempts to use other setups as well. Additionally, I have had other teams use Alert Logic since then, and overall, it has been a reliable choice.

Once the setup was complete, scaling was very easy. It was a simple process, and the scalability was impressive. If we had been setting up new systems instead of retrofitting old ones, deploying the product with scalability in mind would have been even easier. Over 9,000 users in my company are using the solution.

We were in constant communication with Alert Logic's technical support team, depending on whether we needed to add extra calls or if there was something else we needed help with. It wasn't too difficult to work with them. I rate the technical support a ten out of ten.

Positive

Previously, we used Splunk, Rapid7, and a few other solutions. Alert Logic was cheaper at the time, and it had better customer support. It seemed like they were really focused on gaining customers during that period.

I have experience with setting up Alert Logic's appliances and feeding them the right data, modeling the system, and ensuring that the rest of the team can use it once it's up and running.

The setup process was complex. We needed assistance from the Alert Logic team because the IT environment was spread out, and there were multiple teams involved. We had to work with a liaison between those teams to ensure that we could install everything correctly. We had to bring in the network teams, system administration teams, and other relevant teams to ensure that everything was properly set up, which made the process complex.

The deployment process lasted for about two months. It took that long because we wanted to ensure that we tested the product fully in a developer environment before going forward with the actual deployment. In the deployment process, we had about fifteen to twenty people internally from our team, and the Alert Logic team was maybe about three to five.

The setup process was somewhat lengthy and took longer than I would have preferred, so I would rate it a seven on a scale of one to ten, where ten is the best. However, I believe that the delay was caused more by our internal site issues than any shortcomings on the part of Alert Logic.

Price of the solution was very reasonable considering the size of our organization at the time, and so it worked out perfectly.

I recommend setting up Alert Logic and being ready for a complete migration rather than trying to retrofit it. If you plan to incorporate Alert Logic into your environment, it would be best to do so during a refresh cycle when everything is pre-done, and you don't have to go back and install appliances and allow rules. Doing it during a refresh cycle would likely be easier, saving you time and resources.

The site seemed to be the main issue during the deployment process. Despite that, I found Alert Logic to be great with everything they had to offer. There were just a few minor critiques, but they were related to the site. Overall, I rate the tool an eight out of ten.