NetMon Reviews

We have been using LogRhythm in our organization as a SaaS offering. We have outsourced it as part of the actual scope where they use LogRhythm to monitor these SOC events.

I have known NetMon for more than three years now.

We can implement SOAR wherever we can plan to have use cases. We can build use cases around it.

We are using NetMon's threat detection feature.

We are using NetMon's real-time traffic analysis regularly with a team of four members who effectively monitor all alerts and events, which has helped them identify whether there could be a severe incident.

It is difficult to integrate NetMon with other databases.

We can customize NetMon's monitoring views, but it is done by the team who handles it, as it is outsourced.

It completely depends upon when incidents happen. To find the root cause analysis, we need to first gather the logs from the team. It is quite a lengthy process that takes one or two days to obtain the logs before analysis can begin.

I would rate NetMon an eight out of ten.

LogRhythm NetMon can be useful if someone wants to look into something apart from network behavior analysis, like DPA or any network forensic services. For DPA or any network forensic services, users can rely on LogRhythm NetMon, where they have to deploy the agent in their environment, or if sensors need to be deployed in TAP and SPAN port, with the help of which you can see the traffic movement. LogRhythm NDR is something based on artificial intelligence, machine learning, and real-time analytics since a user needs to see real-time lateral movement in their environment or network on a real-time basis.

The valuable features of LogRhythm NetMon may vary from person to person since it depends and changes on a case-to-case basis and as per customers' requirements. Depending on customers' requirements, my company proposes to our customers either LogRhythm NetMon or LogRhythm NetMon NDR. NDR is a new technology launched by LogRhythm recently.

LogRhythm gives you a holistic view if you have a lot of components of LogRhythm in your organization since it also makes integration functions easy and possible.

I have not worked much on LogRhythm NetMon to be able to comment on what needs improvement in the product since there is another team in our company that is working on the solution presently. LogRhythm NetMon's pricing model is an area of concern that should be made a little bit cheaper in comparison to the other players in the market currently. With players like IBM QRadar that propose QNI or Darktrace in the market, LogRhythm NetMon needs to consider a reduction in its pricing model.

I have been using LogRhythm NetMon for three years.

It is a stable solution. The only challenge that I have faced to date is with the platform provided by LogRhythm NetMon.

It is a scalable solution. My company deals with five to six customers who use LogRhythm NetMon.

Apart from the response delay, the solution's technical support is good.

I have experience with QRadar.

You can't describe the initial setup phase of LogRhythm NetMon as a straightforward or complex one. The straightforwardness or complexities involved in the initial setup phase is something that stems from the people who are involved in the setup process. LogRhythm NetMon's initial setup phase lies somewhere between being complex and straightforward, but it is okay.

LogRhythm NetMon's deployment process is simple. To know more about the deployment process of LogRhythm NetMon, I will have to connect with the team concerned with the implementation process in my company.

LogRhythm's licensing part is something that depends on the license you want since they offer it on a perpetual and subscription basis.

Dynatrace and Darktrace are some of the competitors of LogRhythm. I don't have any inputs to provide if we speak about the comparison between Dynatrace, Darktrace, and LogRhythm.

My company mostly pushes or proposes LogRhythm NDR to our customers.

I recommend the solution to those who plan to use it. People can buy LogRhythm as a separate component if they have a separate LogRhythm-based setup in their environment.

I rate the overall tool an eight and a half out of ten.

We use this solution for fax-based purposes. We have twelve actual users actively using NetMon in our organization. Additionally, we serve at least seventy-five clients with NetMon analysis. NetMon is deployed primarily in a private cloud across one data centre as we are a cloud service provider.

LogRhythm NetMon's most impressive feature is that it's a bundled package, so you're not just relying on monthly data; you get a six-month view for more comprehensive indicators of compromise. This dual approach is precious. We implement LogRhythm NetMon in our cybersecurity strategy mainly for compliance and correlation of network, user, and decision activities, particularly for network firewalls and access control.

The most compelling feature of NetMon for threat detection is its ability to capture network anduser session activities in one place, which is more efficient than traditional packet capture tools. Deep packet analytics are crucial for resolving attacks because they provide detailed insights into packet contents, including IP and TCP packet rules. Our company also has AI-based security operations, using tools with behavioural analytics, monitoring, and predictive machine learning for threat management. LogRhythm NetMon fits well into our AI-based security operations, providing valuable information for threat correlation. For example, there was a security threat involving a fax service that AI helped us identify.

The main concern is that LogRhythm has not improved NetMon but instead introduced a separate product, which many customers, including us, would prefer to be integrated into a single platform for easier management.

I'd also like to see LogRhythm NetMon improve in terms of cost efficiency, especially regarding adding new products that may overlap in functionality. Specifically, I would appreciate enhanced detection and response capabilities directly integrated into NetMon to avoid needing additional rules or tools from LogRhythm.

Regarding integration capabilities, I think NetMon's current agent-based approach is limiting. Integrating with protocols like Gflow and Netflow would be better, allowing seamless integration with our existing network equipment. This would solve the problem of agent-based restrictions and improve overall integration.

I have been using LogRhythm NetMon for four years. 

LogRhythm NetMon has been stable without any performance or stability issues.

In terms of scalability, it's available to a certain extent based on its current features. Still, it lacks flexibility for adding advanced monitoring or expanding to handle more extensive networks.

We have engaged with LogRhythm for technical support under a new contract agreement since they are easily accessible and available to assist us anytime we need help, mainly since they are in Riyadh.

Positive

We have another solution, which acts as a redundant backup for NetMon. We use a link shadow of it. The main pros of NetMon compared to other competitors are its strong monitoring capabilities, while the cons include the lack of certain features like agent-based monitoring. The reason why we use both NetMon and Link Shadow together is that they complement each other.

However, managing two separate tools is cumbersome, and we prefer a single solution for ease of use and management.

The initial setup of LogRhythm NetMon was straightforward and smoothly integrated. We have a team of certified engineers involved in the deployment, usually around five people, depending on the project scope. The deployment process consists of setting up a distributed system with high availability and multi-tenancy, typically taking around fifteen minutes to cover everything once devices or logs are onboarded.

From an operational standpoint, I find NetMon cost-effective due to its bundled solution.

I don't have visibility into the pricing of LogRhythm NetMon as it's handled through our commercial partnerships.

I would recommend NetMon to others as we've already recommended it to some clients who are using it. My advice for those considering NetMon is to understand its purpose and use case to maximize its importance within the package. Link Shadow covers the missing three points, and consolidating features into one vendor would be ideal.

Overall, I'd rate NetMon as a seven out of ten.

Most of the SIEM OEMs are now coming up with XDR solutions. It is an Extended Detection and Response that includes NetMon capabilities. Unlike the traditional standalone SIEM solution, it primarily focuses on integrated SIEM capabilities. LogRhythm's SOAR capabilities are far behind those of QRadar. It has its limitations. Some of the automated tasks we can perform on QRadar cannot be performed on LogRhythm because the solution has limitations. It's not the case where the client has procured some licenses, and the license has limitations. He can always upgrade to the next level of capability, but the solution has certain limitations.

The correlation engine is much stronger. The log processing is much better when it comes to LogRhythm. 

It has a very strong artificial intelligence engine.

There are issues with integrated third-party tools.

I have been using LogRhythm NetMon for 1 year.

The product’s stability is fine. We see any performance degrade, or any outages with respect to the collectors. In the last one year, we haven't faced the console not being accessible.

The solution is scalable.

600-700 users are using this solution and can be scalable to 1500-2000 users immediately.

Customer support is quick enough. They were very static, but the response was good. The nature of the problem itself when we reach out to LogRhythm support. It had nothing to do with LogRhythm but more to do with the other integrated tools. 

The selling point for LogRhythm is the SIEM solution, SOAR, and competitive pricing against QRadar, Sentinal, Splunk, or any other tool in the market.

We started using LogRhythm started back in 2013. When I joined, we only had six or seven clients, but then, in a span of two and a half years, we increased our client base from seven to 33. We're always happy with the services and the product.

There were no issues. We've integrated LogRhythm with EDR, email security solutions, and DLP. We've not found any specific issues with that.

Overall, I rate the solution an 8 out of 10.

Our client has given us IP addresses that must be assigned to a few devices at their end, such as networks, network devices, and firewalls, that we monitor using NetMon. We see whether those packets have been captured properly and what kind of traffic has been enabled like HTTPS, HTTP, and DNS servers. We also monitor how the traffic is flowing and how much data has been downloaded through one IP.

LogRhythm NetMon has helped us create a more robust environment. We have more effective monitoring.

The protocols with which you see the traffic for a particular website that a client has in their environment, for example, are valuable. We can monitor whether the traffic is up to the mark or whether they need to add more bandwidth. Also, we can see if we're able to get real-time environment data as well. 

The customization dashboard is really good. LogRhythm NetMon has its own in-built dashboards which are helpful in guiding customization.

There is an issue with tunneling in relation to how the connectivity is established between the end devices and where NetMon is installed. On the console, I often observe that there's a difference of a few seconds or maybe a minute, and this lag time should not be there.

The console can be improved in terms of access. It takes time to load the whole tool, though it might not all be related to NetMon. It could be related to the server. If there are a lot of VPN hops in between, then there will be the possibility of lag time.

I've been using this solution for about a year.

It's a stable solution.

It's a scalable solution. We have nine companies who use the solution, and we have one more client who is getting ready to use it as well.

NetMon's technical support is good, and I would give them a rating of ten out of ten.

Positive

The initial setup is straightforward. I was able to install the whole OS on the hardware and integrate it with my SIEM environment.

If you have had exposure to infrastructure and know how to establish or set up a server, you will be able to deploy NetMon yourself. If not, you may need one more person.

I deployed it myself with some initial help from the infrastructure team.

Check your requirements and the infrastructure so that you know the type of license you need to obtain. It's a good, user-friendly tool. If you have a bit of background in security, you'll be able to understand NetMon easily. On a scale from one to ten, I would rate NetMon at eight.

I mainly use NetMon for traffic analysis and flow and to determine if anyone is using a previous password.

NetMon's best feature is traffic analysis.

Sometimes it's hard to find the network devices' self-audit logs.

I've been using NetMon for four years.

NetMon is stable.

LogRhythm's support team isn't responsive enough - it's common to wait a day or two for someone to deal with a case.

Neutral

The initial setup was quite easy and very transparent, and the deployment took four hours.

We used a professional service.

NetMon's licensing costs about $85k per year, with some extra costs for support.

I recommend NetMon to other users and would rate it eight out of ten.

We use this product for network monitoring, to assist with our network security and performance.

The most valuable feature is the log, which can be analyzed by our SIEM solution.

The reporting capability is good.

The training for this product is not very good and needs to be improved. For example, the instructor came with a specific outline and does not like to go outside of the box.

There should be documentation the describes more use cases and how to implement them.

We began working with LogRhythm NetMon less than a year ago. Our second phase of implementation was completed about three months ago.

This is a scalable solution. 

We have consulted with the technical support team on a couple of things. I would say that they are ok.

The initial setup for us was complex because we did not have much knowledge about this type of product.  

The price of this solution is too high, so it should be made more practical and more valuable for the customer.

In general, this is a good product. It is easy to configure and use.

I would rate this solution a seven out of ten.

Our primary use case is trying to monitor irregular network traffic - identifying the type of traffic within our network, its origin, and destination IP. It could be HTTP, HTTPS, FTP, or OBDC. Once we recognize the traffic, we then correlate it, determining whether it's normal or abnormal. The data is also send via Syslog to LogRhythm SIEM to further correlate with logs from other devices to look at threats from a holistic view

We simply enabled the out of the box DPA rules within network monitor to look for Ransomware via SMB traffic and other types of attacks such as DNS hijacking where external DNS is being used instead of internal, and it was happening in our network environment

I think visibility is the most valuable feature - the ability to see what's going on with the network traffic even if it is not passing the firewall. It provides the lateral traffic visibility, which most can't see it in firewall and networking switch/routers with limited logs. In an internal environment, we have a customer with several database servers, and they want to know who is connecting to these critical servers, this solution enables that. In terms of attacks or any abnormal traffic, we can quickly detect it. Visibility to network lateral movement is significant.

Our customers would always like to see additional features. Ideally, they want one solution to do everything, particularly with networking products. Often customer request features that are related to their day-to-day operation such as traffic congestion and network usage at a specific endpoint. Adding operational flavor into the existing network threat detection product would allow more customers to use a single platform to satisfy all their networking visibility needs. I'd like to see more of these types of visualization or dashboard geared toward this kind of usage is built out of the box and ready to use.

Also, having network topology visuals from a specific endpoint can be a great feature that would help correlate and investigate faster.

I've been using this product for four years. 

It's an excellent & stable solution, it's based on ELK and is a proprietary solution. It provides you with an ISO file that you can install in minutes.

The technical support is excellent. You can find many pre-built rules, visualization dashboards, or the Kibana dashboard within the community portal. 90% of users can just use it right out of the box and use the many built-in deep packet analytics rules and dashboard or download from the community. If you like to build your own rules, it will require some learning on the rule syntax. Any more advanced integration with an external system can request to Logrhythm support. They will be willing to answer any questions you have.

The initial setup is very straightforward and simple. It takes about half a day to get it all done. 

Compared to many other products in the market, I think LogRhythm has the highest cost to performance ratio in terms of its value. Many customers compared us to a lot of other network tools that focused more on traffic flow and data flow, which often lack threat detections, visibility, and Deep packet analytics. However, LogRhythm NetworkNDR provides excellent visibility and threat detections because it identifies 3000 plus applications, built-in Deep packet rules, and provide SOAR capability at the same time.

LogRhythm provides a freemium version of Netmon, so I would first advise anyone to download it and play with it first.  All features are the same as a full version, and it is the best way for anyone to understand the product capability and how it works. If it works well then consider buying the product

I would rate this product a 9 out of 10.

The analytics feature is the most valuable feature. 

I would like to see better integration with multiple products. Integration is not something that is readily available for most of the products. 

I would also like to see some more customization with the analytics that LogRhythm offers because there are competitive solutions on the market that get much more analytics, unlike LogRhythm. We have second-hand features when we look at the analytics portion of it. Otherwise, the solution is good but I'm expecting a little more in analytics.

The stability is good. I would rate it a three out of five. 

Scalability depends on the sizing. If you have lower sizing then you will not be able to scale the system. 

The security team of around five people are the main users. They do analytics for an organization of 3,000 plus employees.

Their technical support isn't so great. 

We were previously using ArcSight. We switched because ArcSight didn't have a roadmap for their company. We didn't get a clear roadmap for their technology innovation guidelines.

The initial setup was a little complex. We have to manage a lot of devices, the dashboard needs to be set up. 

The entire deployment took a little over a month. We required five to six staff members for the deployment. The staff compromises of security and forensic analysts.

We implemented in-house. 

Pricing is okay. There were some competitors that were extremely expensive and there were some which were really inexpensive but LogRhythm stayed in the middle of them.

I would advise someone considering this solution to do the assessments properly before you deploy the solution because it also depends on what kind of products you have to integrate with LogRhythm. Most products do have an integration out-of-the-box. You need to study the product first before you make the decision to go ahead with LogRhythm.

I would rate it a seven out of ten.

It's the ease of use, right off the bat. You can type in certain applications to bring up, it brings up graphs and it's meaningful information off the bat with a very low level of entry. Then, as you get more comfortable, you can get more advanced, more granular. But it's probably the ease of entry into it that is one of the key features so far.

With other solutions it's a lot of care and feeding to keep it going, making sure that your alarms and use cases are built out. With the Network Monitor it's pulling packets right off the network and doing that deep packet analytics. You're able to look right off the wire and get a true picture of what's going on. "Did this person send out an email? Did this person go to this website? Is this application running on our network in these certain areas?" You can get a very granular look.

It provides data in a user-friendly interface that I can pull off and get to management.

It does packet captures as well, so if I really wanted to dig into it I could pull those down. I could run those through other tools as well.

You can really really dig into it with some other packet-analysis tools we have. But just having it there, it's incredibly smart, incredibly easy to use, and the breadth of information we get off it is really good for investigations for us.

It's just finding the knowledge and figuring out how to apply it. The platform itself is good, but the breadth of capabilities that it has is difficult, and not always super-well communicated between LogRhythm and us.

We were using it for certain things and, as time went on, we brought in different tools to meet certain capabilities. Then after researching, "Oh, LogRhythm does this too."

It's that communication between LogRhythm and us, just letting us know - maybe it's a little bit on us as well - what the capabilities are and how we can leverage it and make the most of our investment.

Things like this LogRhythm User Conference are really great, to know where they're going, and what we actually have.

I've only been in the department about two years. I think we have had it for about four or five years at this point.

No issues since we upgraded. Previously, it was typically every Monday that I was coming in - it would die over the weekend - and I would spend a day cleaning up databases. That was LogRhythm 6.3.

Now we're on v7.25. Since that upgrade, searches are a lot quicker. The stability, the way they split it up now with the data processors and the data indexers with the new platform, it's been fantastic.

The Network Monitor itself, I haven't had any problems with it. We're capturing rolling PCAPs, and we have about a month and a half of PCAPs from our different environments right now. Stability is quite good.

Regarding scalability, I think it's more just getting time to spend in LogRhythm. We're not a huge security shop, so it's getting the time to dig into it and really figure out how we're going to build it out and learning the functionalities that exist, that we can leverage.

A lot of the time you end up getting a product, standing it up for one use case, and that's what it gets pidgeon-holed as, when really there are 100 other capabilities you can use there.

We've never had any problems. We have a few different platforms we run, for vulnerability management and the like. LogRhythm's support is always, compared to the other vendors that we use, it's always same-day, next-day. Whereas other vendors, after a week, two weeks, you have to follow up.

LogRhythm support has really been "Johnny on the spot." I write to the other guys who manage the other systems and I'll say, "I put the ticket in today and it was solved the next day," and he's been waiting two weeks and following up with them and really hounding them. I've never had to do that.

Very good support.

We're upgrading from the old version to the new version. Then I did some research on the Network Monitor box and saw some potential there for use cases. I sold it to my management and showed them what we could do with the Freemium version first.

From there, once I showed the use case and the value there, we were able to move forward and purchase the nice nice big appliance.

Because we're government, if it's existing we can do the upgrade process, but if we wanted to switch vendors it's more of a RFP process, very arduous and long. We knew we wanted to stick with LogRhythm, but there was an opportunity for us to look at new use cases and new capabilities that we spin up.

We're Palo Alto for a lot of our Edge stuff. We run Cisco. Palo Alto on endpoints for their traps, McAfee on some others. It's fairly distributed as well. We run all the casinos in British Columbia, they distribute all around the province, and we run all of those and they're all reporting back to us. We also run the lottery point-of-sales systems as well. You go into gas station, there's a lottery terminal there you can buy your ticket off of. We manage all those as well. Those are all wireless. A ton of stuff. Very, very large.