LogRhythm SIEM Reviews

The use case for LogRhythm SIEM is to ensure log retention is the primary focus and meets project requirements. Every project and company has their own retention policy. In the US, when working with the government, there is a policy called FedRAMP. As per US government requirements, if they are your client, they require at least 18 months of logs for all incoming data. These policies vary with companies and countries. Whatever consumer or client data is coming in needs to be retained for about 18 months as per company policy.

The major function of LogRhythm SIEM is detection and monitoring. SIEM stands for Security Information and Event Management, and it monitors your environment in real-time. Every SIEM has similar functionality, but with LogRhythm specifically, I have seen in projects that you create numerous alerts based on anomaly detection use cases, such as when new malware or vulnerabilities emerge in the security world. Based on these scenarios, you create measures to ensure your data is safe and properly monitored.

LogRhythm SIEM is a good tool, though not necessarily the best in the market. There are many aspects they can improve upon, but there are also many good features already present.

One example is custom parsing. When you have a particular log source device sending logs to LogRhythm, sometimes the default parsing isn't available for the device or incoming logs. The regex language used to create parsing is really effective. Custom parsing is user-friendly - you don't have to be an expert for LogRhythm to work, and it gives you clear feedback on parser quality.

Another valuable feature is the ability to define alerting on each log source basis. If a log stops coming in after a specified time, LogRhythm has an inbuilt function that can display the log source status based on timing preferences. You can set color-coding alerts (yellow, red, green) based on when the last message was received. This helps SOC analysts significantly as they can monitor all log sources through a dashboard, quickly identifying which sources haven't reported within their specified timeframes.

One major area for improvement in LogRhythm SIEM is the lack of volume measurement capability in terms of storage. There is currently no way to determine how much data is being consumed in terms of gigabytes, terabytes, or petabytes from particular devices or environments. This information is crucial for planning future storage needs and scalability.

The system monitor (collector) agent has issues with resource consumption. Even when not actively collecting data, the agent continues to consume significant CPU and memory resources, which can be particularly problematic for small business environments with limited resources.

LogRhythm SIEM could improve by adding more default device support. While they have good default settings for devices such as Palo Alto firewalls, custom log sources often require extensive work. Increasing the number of supported devices with built-in policies and functionality would reduce the need for custom work. Competitive SIEM tools often provide more comprehensive coverage for various devices and vendors.

I have been working with LogRhythm SIEM for approximately five years across various companies and projects.

LogRhythm SIEM still needs improvement regarding stability, particularly in environments with heavy data consumption. For small setups, the stability is adequate, but in larger environments processing terabytes or petabytes of data daily, there are notable challenges. On a scale of 10, I would rate the stability at seven.

The scalability of LogRhythm SIEM is good enough, warranting an eight out of ten rating.

The main competitors for LogRhythm SIEM include Elastic, IBM QRadar, and Splunk. According to the Gartner graph, LogRhythm is not currently the leading solution. After the Exabeam merger with LogRhythm, there have been changes, though I'm not fully aware of all the differences. Cost is also a significant factor when comparing these tools, and other solutions may offer more competitive pricing.

LogRhythm SIEM's automated response capabilities help organizations mitigate threats through alerts based on specific use cases and monitoring requirements. The effectiveness depends on the environment and industry - telecom companies, software companies, and product companies each have different requirements and devices.

The network monitoring feature (NetMon) was satisfactory when last used, rating approximately three out of five. There is room for improvement in this area.

For threat detection capabilities, LogRhythm SIEM has numerous built-in features and has improved with cloud-based environments and AI integration through Exabeam. While they don't yet have MITRE framework mapping by default, they offer good IOC-based detection and threat intel feed integration. The knowledge base updates regularly with features such as Geo info of incoming data.

Overall rating: 7/10

Generally here in Sri Lanka, I recommend LogRhythm SIEM mainly to banks and large enterprise customers with multiple branches and multiple payment-related applications. In general, a large enterprise customer is who I would recommend LogRhythm SIEM towards.

Once I have LogRhythm SIEM environment set up, I trigger attacks based on the MITRE ATT&CK framework to evaluate threat detection capabilities. I observe how well LogRhythm SIEM can detect those based on the setup I have, how much information it can collect, and how much it can correlate from these events.

In comparison to others, LogRhythm SIEM has certain features that other solutions are lacking; for example, user analytics and user behavior monitoring are features that some of the other SIEMs lack. LogRhythm SIEM also has a well-known, well-reputed background, and that is something that our customers consider before they purchase a solution. In addition, their support is incredibly good, with very active support throughout the day and 24/7 availability.

LogRhythm SIEM is quite complex, but that complexity allows us to specifically tailor a solution to the customer while some others are not as flexible. Those are some of the main reasons that we move towards LogRhythm SIEM.

LogRhythm SIEM could learn from Wazuh, as Wazuh has a built-in mechanism that allows you to write custom scripting and scripts through languages that Wazuh can then trigger, which is somewhat better and more matured in Wazuh compared to LogRhythm SIEM. Additionally, the parsers that I write for LogRhythm SIEM tend to get quite complex for log parsing, while with Wazuh, I can achieve a similar parser with much less complexity. Those are some of the pain points that some of our customers have been expressing.

If LogRhythm SIEM could make a lightweight version of their solution, that would be quite competitive because some of my customers have a very large need but refuse to go with LogRhythm SIEM due to its complexity and high resource intensity. Therefore, they have been moved to Wazuh, which I am deploying for them. Even though LogRhythm SIEM has extremely good capabilities, their resource utilization is too heavy for certain customers, so if they could make a separate, lightweight version, that would be quite beneficial.

I have been dealing with LogRhythm SIEM for about two years.

The automated response capabilities of LogRhythm SIEM are quite good, but in comparison to something like Wazuh, where we can use an external automated response platform, we are restricted to their own platform.

LogRhythm SIEM's resource consumption is higher than its competitors.

LogRhythm SIEM is quite complex, but that complexity allows us to specifically tailor a solution to the customer while some others are not as flexible. The automated responses and detections of LogRhythm SIEM are much better and faster compared to others.

We have worked with LogRhythm SIEM and Fortinet before.

The initial setup of LogRhythm SIEM is very good. The automated responses and detections are much better and faster compared to others.

We are thinking about a second product, as some of our customers are moving towards Forti SIEM as well as LogRhythm SIEM, but we have not made a final decision on that; this is still pending.

For both LogRhythm SIEM and Wazuh, their effectiveness in network monitoring features for identifying abnormal activities is very good; however, LogRhythm SIEM tends to identify abnormalities faster because they have their own machine learning algorithm, resulting in much less human involvement in that detection.

Reporting and log ingestion in LogRhythm SIEM are quite good. LogRhythm SIEM has their own reporting format where I can build custom reports. Their log management is also incredibly good, although their drill-down capability and hunting capability can take some time when a new log source has been onboarded.

I am not a user; I am more of a consultant and reseller.

I do not recommend LogRhythm SIEM for smaller companies mainly because of the cost, as LogRhythm SIEM is quite a heavy and large solution; so smaller customers tend not to move towards those types of SIEMs. I would rate this review a 7 out of 10.

I am not directly a partner with LogRhythm SIEM, but I work for a company that offers all kinds of solutions, including implementation, engineering, and analysis. I am currently involved in the engineering and analysis parts. Implementation is very rare; you only get a chance to implement the SIEM solution when a project is on pilot mode or is very new. Else, I am majorly into engineering, which involves adjusting data from different types of firewalls, routers, switches, handling day-to-day tasks, and analysis when I get alerts regarding any security or internal threats.

My role involves detection, and I am part of detection engineering, so my core concentration is on detection engineering.

The most beneficial features of LogRhythm SIEM are its customization; the tool is very customizable. It is based on Windows operating systems, making it a bit easier compared to Linux, which requires a lot of internal knowledge for troubleshooting. With a basic idea and certifications like MCSA, one can easily handle LogRhythm SIEM. Compared to QRadar, LogRhythm SIEM is easier to access, but the tool can be very unstable, encountering daily issues such as components down, services down, or high memory utilization.

My solution is deployed on-prem because there are restrictions from government facilities; the data cannot be sent to the cloud due to security reasons and concerns about potential espionage. We have enough budget for cloud deployment, but we choose to keep it on-prem to ensure data privacy; cyberattacks are a concern, but data privacy is the foremost priority due to sensitive government information.

I cannot think of any specific features that LogRhythm SIEM can improve upon since it supports a wide variety of major vendors. However, they need to improve their parsing techniques; the tool should understand various devices and present data in a human-readable format. For example, if a personal Android mobile needs to be integrated, LogRhythm SIEM should be able to parse that data effectively.

They also need to improve their database of supported devices to cover smaller vendors alongside the major players, allowing for better global reach and usability. I have noticed some problems with parsing errors, event mismatches, and data mismatching, so ensuring accurate parsing and continuous improvement according to device updates are my basic expectations as a detection engineer.

I have been using LogRhythm SIEM since 2015, so now it has been almost over 10 years.

The deployment of LogRhythm SIEM is not very challenging as long as one has a mid-level understanding of server operations, installations, and configuration changes on a Windows server.

The main problem I have with LogRhythm SIEM is its stability; the solution is not stable.

LogRhythm SIEM is scalable; it can handle about 200 or 500 devices without much difference, aside from slight cost differences related to licensing.

The technical support is good; we have a separate portal for partners, and since we are paying for the service, they provide a response timeframe based on severity—critical issues are addressed within four hours, medium issues within one day, and non-urgent issues may take a couple of days.

I would give the support a rating of nine out of ten; while they mostly provide good responses, there are times when the responses are not exactly accurate, but I can say nine out of ten questions will be answered for sure.

Positive

I would estimate that it saves more than 30% of resources.

I find LogRhythm SIEM affordable, as it is a bit less costly than QRadar, although I have not been involved in negotiation charges; however, from the manager's approval, I see it as affordable.

I did not come across Trellix; I heard about it but never worked on it. I majorly work with QRadar and am currently working with LogRhythm SIEM, and I also have some experience with Splunk. Nowadays, everybody is mostly accepting all the log formats from on-premise to cloud, and we are planning to move back to the cloud. Currently, we are also running with Azure Sentinel, but still, we are learning, so our next step is that one.

I see LogRhythm SIEM as value for money; I would rate it eight out of ten.

I have not seen any AI integration related to LogRhythm SIEM; as it stands, there is nothing designed to provide those kinds of recommendations.

I believe AI features are required; for example, with Sentinel, it can suggest actions based on detection. It would be helpful if LogRhythm SIEM could provide similar capabilities to assist analysts in responding to cyberattacks effectively, such as giving recommendations for alerts at the touch of a button.

Daily maintenance is required for LogRhythm SIEM; we need to monitor memory, storage space, and backups, and keep an eye on running processes. Regular health checks every month or couple of months are necessary to ensure smooth operations.

I am overall happy with the integration capabilities of LogRhythm SIEM as it functions similarly to other vendors.

Overall, I rate LogRhythm SIEM seven out of ten.

My primary use case for LogRhythm SIEM is mainly within the financial sectors, like financial services institutions and banks. I utilize it broadly within the banking industry for various use cases.

LogRhythm SIEM has strong machine-learning capabilities with behavioral rules and analysis. The seamless integration for case management, along with a user-friendly dashboard user interface, makes tasks like threat hunting more efficient. 

Analytics and behavioral analysis help me save time with rule creation. Its scalability allows me to add components as needed. Overall, LogRhythm SIEM offers end-to-end visibility with a reasonable price.

The SOAR capabilities need improvements as they currently require programming knowledge. A more user-friendly user interface with drag-and-drop features, similar to key competitors like Splunk, would be beneficial.

I have used LogRhythm SIEM since 2021.

I face stability issues every quarter that necessitate corrective maintenance. The platform needs regular updates to fix problems encountered with each quarterly patch and version release.

LogRhythm SIEM is highly scalable as it has modular components allowing me to expand storage, indexing, or other resources as needed.

Customer support is very helpful and effectively solves my problems.

Neutral

The initial setup is simple and easy. I would give it a rating of eight point five out of ten.

My customers have expressed satisfaction with LogRhythm SIEM as it provides a secure environment to rely on with a powerful toolset.

LogRhythm SIEM is reasonably priced and affordable. The license cost is around $10 per MPS.

I recommend paying attention to the solution's performance, which includes built-in SIEM capabilities and no additional costs for UEBA, SOAR, and network monitoring.

Overall, my rating for LogRhythm SIEM is nine out of ten.

Mostly in Indonesia, LogRhythm SIEM is used by government agencies that must use the on-prem solution because of the significant requirements for SIEM solutions. It sells products as a one-time solution rather than a subscription model. Many customers sometimes forget to renew their subscription. If someone doesn’t renew the subscription, the only options that could still operate are LockSystem and Elastic. If you don’t renew the subscription, it becomes basic and loses most functions, but you can still operate the system with limited functionality. It allows full access until the last bill is paid.

Secondly, LogRhythm offers more than SIEM; it has an EDR, MDR, and XDR. Compared to its competitors, it is the most complete solution. The downside of LogRhythm is that it is slow.

LogRhythm SIEM works well, but the biggest pain point is retrieving logs using multiple filters. Even though they use Logstash from the ELK stack, it becomes very slow. LogRhythm's system uses Logstash, and while it's very fast in Elastic, it's not as quick in LogRhythm.

I have been using LogRhythm SIEM since 2022, and I worked with this solution from 2012 to 2014.

LogRhythm is very stable. The big four for SIEM—LogRhythm, Splunk, and Elastic—are all very stable. They don't have many critical incidents while performing their tasks, and almost no test incidents exist. LogRhythm’s query processing is slow.

They will provide the results, but sometimes the data takes 15 to 20 minutes, or even an hour, to display. 

Scalability depends on the two types of products. One uses virtual software, and the other is an appliance system. The virtual server is very easy to scale. We can add processing power, memory, and storage, allowing it to scale up easily since it is virtual. It’s not as scalable for the appliance because they sell appliances designed for a certain number of users and capacity. LogRhythm uses EPS, which limits the scalability of the appliance systems.

LogRhythm measures throughput in Messages Per Second, not gigabytes per second. Scaling is determined by the number of messages processed per second. While storage capacity can be increased, the appliance's performance is optimized for a specific MPS range, making it challenging to scale beyond its designed capacity. 

It is for mid-sized organizations because they don't need to scale significantly. For example, if they only need 10,000 MPS or 5,000 MPS, the appliance is sufficient for their requirements without further scaling.

I rate the solution an eight out of ten.

LogRhythm had a strong presence in Indonesia between 2012 and 2014, with excellent support. From 2022 until now, their regional office has been in Singapore. If support is needed, it typically goes through a distributor. For more complex issues, we must contact Singapore for assistance. Getting LogRhythm personnel to come to Indonesia can be challenging, and arranging an on-site visit usually requires significant effort.

Positive

The initial setup is easy because LogRhythm has the most out-of-the-box integrations with Penitin. If I have a firewall, they have an out-of-the-box connection with it. If I have a switch, router, or another system, they also have out-of-the-box connections with those. It's very easy to use LogRhythm's system.

IBM QRadar is the most expensive SIEM solution, followed by LogRhythm and Splunk, which are also on the higher end in pricing. LogRhythm and Elastic are more affordable options. Elastic is open-source, making it a cost-effective choice.

LogRhythm stands out because it offers a perpetual license, meaning renewing it annually is unnecessary. Over a long period, such as five years, this makes it a cheaper option since the license does not need renewal.

LogRhythm's AI engine assist is good enough. Everyone talking about threat hunting mostly mentions continuous virtual assessment or vulnerability management. The guard will allow some people in and stop others based on their knowledge. If the SIEM determines that a person is eligible to enter, they will allow it; if not, they will stop them. 

Overall, I rate the solution a seven out of ten.

Our organisations have data centres which are in need of multiple server security devices, network devices and various other solutions. We utilise this solution to integrate Oracle security logs and use another solution to collaborate between these logs and receive alerts based on configured use cases. 

My work is currently in the government sector and my aim is to enhance the organisation's threat detection and response capabilities. I try to utilise the solution in order to provide comprehensive reports with minimum false positives.

The major feature of this solution is its easy configuration which helps different team members to work on it effectively. This kind of feature is not available in other solutions that need a special team dedicated to configure and extract reports.

Another feature that I really admire is the significant improvement in the compliance in the auditing process by the solution. Our organisation-specific complaints require where the data needs to be forwarded, stored and searchable for a certain time period. This solution categorizes different types of data: cold, warm, and hot data. These features allow faster and easier extraction of any data even if the event was occurring several years ago. I also like other features, especially user behaviour analysis and automation. It studies the user behavior and if there is unusual traffic is recorded from a user, the solution flags it very effectively. 

I would like to suggest that they should improve their usage of third party tools for making dashboards and reports. If they would create their own tools for dashboard and report, it would be much better in terms of security purposes.

I have been working with LogRhythm SIEM for the past two years.

I would rate it 10 out of 10.

Setting up different clusters and adding nodes when needed is super easy. Same goes for DLP. It's all about using collectors to gather logs, so you can deploy a connector wherever you need it, even at remote sites or networks. I'd rate scalability at nine out of ten.

Splunk is a great product, but it's complex and requires a highly educated and professional team to manage it. Plus, the change in licensing subscriptions from perpetual to subscription-based resulted in a significant price increase compared to what we had with LogRhythm.

The setting up of the solution was very quick and easy but since we operate on different devices it took longer to onboard them completely. The security and network devices that quickly on boarded but the one switch required custom filters took more time. Overall I did not have much problems in terms of forwarding the locks but I cannot remember the exact time it took across all the departments. Since it was a big project we had to split it up into faces but in total in order to onboard over 800 devices it took about 3 months. 

I would rate the initial setup 8 out of 10. 

Yes, I've seen a return on investment with LogRhythm Centimeters, and I noticed the difference immediately after finishing the implementation compared to our previous product.

The pricing is very reasonable and accessible compared to other products in the market but I am not very sure about the exact licensing cost per year for our company.

People using the solution should make sure that they have all their processes prepared in advance and there is proper planning before starting the implementation. I would rated 8 out of 10.

LogRhythm SIEM is used for monitoring events. Analysts can click on events, drill down, analyze source IP, destination IP, time, country, and other details.

LogRhythm decreases breaches and monitors all activities inside the organization. It allows for monitoring 100 assets integrated with LogRhythm, enabling efficient security operations.

The first valuable feature is the dashboard. LogRhythm's dashboard is very good compared to other SIEM solutions since it shows many details. The operation is also very smooth, allowing easy drill-down into events and effective analysis.

The integration is slightly difficult with other assets, like EDR technologies or firewalls. Also, the back end is not as user-friendly as other solutions like IBM QRadar. The technical support is also not as good compared to some other products.

LogRhythm is a new technology. I have been using the IBM SIEM solution for almost ten years, and LogRhythm for almost three years.

LogRhythm is stable once integrated. It requires very little maintenance post-deployment, needing just monitoring.

LogRhythm is scalable and covers many endpoints, possibly more than 100.

Technical support for LogRhythm is not strong, rated five out of ten.

Neutral

IBM QRadar was used previously. LogRhythm's dashboard and ease of analysis are seen as benefits compared to QRadar, though QRadar offers better integration.

Setting up LogRhythm is complex, especially for integration. The setup itself, without integration, could take one or two days.

I was part of the deployment team and faced some complexities.

Pricing depends on the number of modules you want to purchase.

Other solutions considered include IBM QRadar.

If there is no competitor, LogRhythm would be rated one hundred as there is no choice then.

I'd rate the solution eight out of ten.

LogRhythm works within the core of our SOC. It's where our analysts work every day and where we do all of our investigatory work for security incidents.

It created our security posture. It is the central component of all of our security tools and it is the heartbeat of our SOC and our daily operations. It sets the tone for everything that we do.

This solution improves our organization daily. It saves us countless hours doing correlation work and reduces our investigatory process from days to hours. It routinely brings issues to the forefront using the AI engine and the use cases that we've built that need investigating. We constantly find new sources of logs to bring into the system to continue to make it better. 

LogRhythm does a very good job of helping SOCs manage their workflows. Our SOC is very young and we're not leveraging that feature yet. I've seen other companies' SOCs and watched them use the workflow features and it's incredibly well done. We're not mature enough yet to use it. 

For cybersecurity exposures, the one downside from LogRhythm's perspective is that it can only tell me about use cases that I've already defined. It cannot identify unknown cases at this time. However, we have just recently purchased the NDR solution and that does have this capability.

This solution is our principal mechanism for doing all investigatory work. When we get alerts from LogRhythm, we'd go back to the logs and trace those events back to their source. This is is how we shut down attacks. 

One of the features that we use the most and find the most valuable includes the Web Console. My analysts really like the interface and the ability to build queries using point-and-click without having to write Query languages. My favorite feature is the actual Admin Console and the ability to monitor all aspects of the SIEM's health and the ability to build new use cases for my analysts to work with.

We also use the Machine Data Intelligence feature for classifying and contextualizing logs. It does struggle with unknown log sources and we've had some challenges over the years getting new log sources incorporated into the MDI Fabric.

The ability to authenticate successes and failures using MDI is incredibly easy. For the log sources that we bring into the SIEM, that work is pretty much done for us by the MDI. We don't have to do any additional work.

One of the challenges of the SIEM for the LogRhythm 7 platform is the amount of time it takes to bring new log sources into the MDI. We've waited a couple of years on some sources before they were incorporated. Writing our own custom MDIs is very challenging because it requires expert-level regex in order to write those rules and to make them efficient. Bringing in sources that aren't natively understood is where we've struggled the most.

We have been using LogRhythm SIEM Solution for six years.

The stability of the solution, if it's deployed properly with the right resources, is rock solid. We have not experienced any performance issues. When we first bought the SIEM, we undersized it, and the performance was compromised. 

This is a scalable solution. I've load-tested the SIEM at its current resource allocations up to four or five times as much as my daily ingest and the system handled it just fine.

Their technical support is second to none and is one of the reasons why we continue to invest in and consider LogRhythm as a strategic partner. Their support team are really good at their jobs and they always come through when we need them. I would rate their support a ten out of ten. 

Positive

LogRhythm is the first SIEM I have used and the only SIEM I have a lot of experience with. I've demoed other SIEMs and we've gone to market twice to look at whether LogRhythm was still the right decision. Both times we concluded that it was.

The setup of the SIEM is complex in its own right. LogRhythm typically recommends professional services assistance to deploy the SIEM properly. My company did not purchase those professional services so I had to figure it out for myself. Their support structure was so good and they helped me so much that we were able to get it working without professional help. 

LogRhythm is an out-of-box solution and this was why we bought it. I had no experience with SIEM when we bought it six years ago. I needed something that I could plug into the network, get up and running and get value out of immediately.

We get a vast amount of ROI from this solution. We get way more out of it than we put into it. One of the metrics that I track pretty closely in our SOC is the mean time to detect. Prior to the SIEM, the mean time to detect was measured in weeks and it's now measured in minutes.

LogRhythm's pricing and licensing are extremely competitive and it's one of the top three reasons we continue to invest in the platform. 

We looked at Securonix, Azure Sentinel, IBM's QRoC, and QRadar on Cloud. What really won us over with LogRhythm was the ease of use of the interface and the simplicity of the underlying architecture. It really lends itself to being a low-cost solution to own over time.

The nice thing about LogRhythm is that they continue to innovate and come up with new capabilities like their NDR solution that we recently invested in. They continue to stay relevant. 

I would rate LogRhythm a nine out of ten. The on-prem version of the solution is fantastic and is the core of my SOC. It's our daily tool for all of our investigations. 

We have a lot of use cases. Originally, it started out pulling in a bunch of the logs so we could get some ideas on network traffic. More recently, we have proceeded with pulling in logs from some of our other vendors. This really helped out a lot with our AV, which didn't always notify us as quickly as we wanted it to. LogRhythm made it possible for us to get notifications faster so that we can remediate things faster. We've been expanding it more and more as we've gone through the years to include more traffic, giving us more insight into our network.

LogRhythm really gave us a better understanding of what our overall risk is within our network and has opened our eyes to include other products that helped address different types of issues. Whether it's getting into vulnerability scanners or different pieces of other software, it's opened the door to what's out there. It helped us to turn on different features or other products along the way and helped us to identify what we need to improve on and present it to our executive team.

One of the main features that I like about LogRhythm SIEM is that there are a lot of pre-built pieces. Like with our AV, we didn't have to tell it how to read the logs; they already had it pre-made. So, we essentially just had to follow their guide to get the logs imported in and set up some rules for it. We've only had to manually create the parsing rules for a few of our vendors so that we could interpret the logs correctly. Most of them had already been pre-created for us.

We use the Event Log Filtering feature a lot. We use it for simple troubleshooting tasks like when a user is logged out, to more important tasks like trying to investigate a threat. As far as its effect on productivity, we can go and search instead of trying to troubleshoot and guess what is causing an error. We can identify what the program is or where the hiccup is.

LogRhythm helped us to identify a lot of blind spots. Originally, we didn't have a SIEM tool. We had auditors say that this is something that we should be doing. My management team asked me to go and find a product, and I researched a bunch of them and found LogRhythm. It really opened our eyes to see how much traffic we have, whether it's other IP addresses that are scanning us or external users trying to hit certain ports that could then get closed. It helped us tighten down some of those firewall rules that may have been left open unintentionally through other changes. It helped us a lot early on to identify who was trying to communicate with us or, essentially, who was trying to attack us.

As far as our overall security posture, our SIEM tool was the initial push that really got us going into identifying where all of our threats were. We expanded over the seven years that we've had it, and I implemented at least eight other products that are all security related because the SIEM tool indicated the need to identify other risks. It really helped us as an organization to identify risks and move forward to a more secure environment.

When we originally got LogRhythm, their tech support was fantastic, and I loved them. Now, we don't quite get as quick of a response. I've been disappointed in the more recent tech support. When you call in, they'll say that they will get you somebody, and you'll finally get someone who will contact you back a day or so later. Whereas before, I would get help right away.

We've had LogRhythm for almost seven years now.

It's very stable. We've been on the same system for the seven years that we've had the product. We've had no issues and haven't even had to upgrade any of the systems or increase anything hardware-wise up to this point.

I haven't really had much of a chance to do any scalability because we haven't had to scale anything up. Ours is a virtual instance, and if we needed to scale up, we could just shut the server down, add some more resources, spin it back up, and it would be good to go.

Initially, tech support was a solid ten out of ten when we first started. Over the last couple of years, they have changed how they handle tech support requests, and the response time decreased from what it used to be. You call in, they'll take your information, and then they'll call you back later. That can take 24 hours or more. When you actually do get somebody on the phone, they're very good and know exactly what they're doing. They'll take care of you.

In terms of response time, I'd give tech support a six out of ten, but in terms of how good they are as tech support, I'd give them a seven or eight.

Neutral

We didn't have a designated security person on staff, and our auditors came in and said that we should be doing this. As a help desk person, I looked for something specific that was going to give me the flexibility I need but also allow me to spin up and run while doing the rest of my duties, and LogRhythm was the best one that I found that could do that.

It's pretty complex to set up, in a way. However, now that I've done it and have done an upgrade as well, it doesn't seem as bad.

I did something wrong on one of the initial upgrades, and it threw an error. I called in support, and they immediately jumped in and started working on a lot of the backend pieces that I don't normally touch. It's pretty complicated if you have to get into that, and that's where the tech support comes in.

With this last upgrade, I did not run into any errors, and it went through just fine. I thought that I was going to be doing this for six hours throughout the day, and I got it done within two or three hours.

I set it up and upgraded it twice, once with help from LogRhythm and once all by myself.

We're on a perpetual license, but they're trying to move us to a subscription-based license. We've been with them for so long, and we'd like to keep it the way it is rather than switch to a subscription-based license.

We looked at four products including QRadar and Rapid7 InsightIDR. We did POCs for all four solutions, and LogRhythm was the best solution for our needs.

One of LogRhythm's distinguishing features was its AI engine which analyzed the tools and allowed it to alert for specific events, instead of me having to dig down and create all these rules. It came with pre-created rules.

Another piece that was really important was the implementation. They had a lot of pieces for third-party vendors as well. We could pull in the logs. All we had to do is just create a rule that says, "alert." It came pre-programmed with a lot of alarms that would automatically correlate with our AV, along with our firewall. We didn't have to create them because they just came in pre-made, and that was a big feature that we looked for. Just implementing it or adding to it didn't take up too much time.

If you are one who thinks that SIEM is an outdated security tool, I would be very curious to know what other solution would be better than a SIEM to accomplish the same goals. A SIEM tool gives you such an open perspective into what is going on in your network and gives you the ability to dig in if you really need to. Whereas if you have a completely managed solution or one that uses AI and does everything for you but doesn't provide you the logs, you might know what's wrong but won't know what else is going on out there. With a SIEM tool, you can dig in as far as you want to, and specifically with LogRhythm, you can be as hands-free as you want to be. It'll tell you what's wrong, and you can address those problems. You have a lot more flexibility with LogRhythm SIEM.

Overall, I'd rate LogRhythm SIEM a nine out of ten. I really enjoyed the solution. If you have to program anything yourself, there is a little bit of a learning curve. They've got lots of guides that you can use, and depending on your skill set, you may be able to figure it out sooner rather than later. The resources are all there, and the community is there to help you, which makes the product really great and easy to use.

I work with LogRhythm SIEM in a variety of ways, including monitoring security and compliance, conducting behavioral monitoring, and handling security information and event management (SIEM) tasks. The solution is used for security monitoring, user behavior analytics, NDR, and consolidating events from workstations to servers.

LogRhythm SIEM helps maintain security through continuous monitoring and provides a platform for behavioral monitoring, which can be deployed using the AI engine.

LogRhythm SIEM has some valuable features, including its ability to maintain backups of events and manage alerts separately through an engine that handles content and administration tasks.

LogRhythm SIEM needs improvement in data grouping and manipulation capabilities. The dashboard configuration capabilities are also very limited. Improvements are needed in the areas of query-based searches and pivoting table creation.

I have been working with LogRhythm SIEM just about two and a half years in my current organization.

I did not work on the stability aspect of LogRhythm, but I faced some issues with similar SIEM tools in terms of handling event per second rates.

LogRhythm SIEM comes with scalability challenges, especially related to licensing. Increasing the scale requires additional licenses, unlike Microsoft Azure's pay-as-you-go model.

I have not personally escalated any questions to LogRhythm technical support.

I have experience working with various tools like Azure Sentinel, QRadar, and Splunk. These tools often have modern capabilities that are more comfortable to use compared to LogRhythm SIEM.

I was not part of the initial setup as it is usually handled by a specialized deployment team.

In our organization, the deployment team is responsible for LogRhythm's implementation.

LogRhythm SIEM is considered cost-effective, especially for medium-sized or smaller organizations, as it offers a decent SIEM solution.

I am not aware of the specific pricing and licensing costs, but it is definitely less expensive than other tools like Splunk and Azure Sentinel.

I've evaluated Azure Sentinel and Splunk, which have distinct modern SIEM capabilities.

For smaller and medium-sized organizations, LogRhythm can be a suitable option due to its cost-effectiveness. However, for larger organizations, solutions like Splunk might be more appropriate due to their advanced capabilities.

I'd rate the solution seven out of ten.