LogRhythm UEBA [EOL] Reviews

We are a solution provider and this is one of the products that we implement for our clients.

Customers in Sri Lanka generally purchase this product for network monitoring. 

Implementing this provides greater visibility into the network, as well as client activities.

This solution is really easy to configure.

The most valuable features are file activity monitoring and registry activity monitoring. Users like to have insight as to what is being modified while certain processes are running.

There is a large number of supported devices.

It would be helpful if there were more guidance provided for integrating with unsupported devices.

I have been working with this solution from LogRhythm for about three years.

We have had no bugs, glitches, or other problems with stability.

Scalability has not been an issue for us.

I have been in contact with technical support and they are really good. They have guided us when we've had problems with misconfiguration.

It took us about a month and a half to deploy this solution. The first month involved the setup and then there were two weeks of fine-tuning. In total, after six weeks we were able to bring up the system without any issues.

The deployment for our customers is usually on-premises, although there is a cloud version as well.

The pricing is nice when compared to other products in the industry.

Overall, this is a really good product and I recommend it.

I would rate this solution an eight out of ten.

Our primary use case is to identify the identities and anomalous user behavior and to enhance visibility. 

It should have better mitigation with other solutions and be tightly integrated with other solutions. It has to be improved. 

I have been using LogRhythm Enterprise UEBA for five years. 

The scalability is quite good. We don't have any issues with it. The only problem is that the agents consume too much memory and system resources. The memory and resource consumption is high. 

We have contacted technical support. On a scale from one to ten, I would rate them a six. They respond but it's time-consuming to contact support. We repeatedly call them and they don't respond. They're not as good as other support in the industry. 

It's straightforward. It takes a few days to find anomalies and abnormal behavior. In general, it's of medium level complexity. 

Licensing is on a yearly basis. It's not expensive compared to its competitors. 

We also evaluated CrowdStrike. 

I would rate it a seven out of ten. 

I would recommend this solution so long that LogRhythm does something about the memory and resource consumption. It has a lot of features. It has file integration monitoring but when it's applied it consumes too many resources. It's a big problem with the agents. 

They should improve the interface to make it a better rating. 

The solution's most valuable features are the graphical user interface and the reporting.

The search feature needs to be improved. 

The solution needs better filtering in the next versions.

The stability isn't very good, but it's okay.

The solution is scalable.

Technical support is okay. It's not great. The problem is being able to reach the right people at the right time. This is what needs to be improved.

The initial setup is very complex.

The solution is very expensive. There are also costs beyond the standard licensing fee.

We use the private cloud deployment model.

I would rate the solution six out of ten.

Like they say, you don't know what you don't know. So, with CloudAI, it's just watching everything to see what you don't know, and it gives you a second opinion.

An ever-changing landscape, in medical, we deal with a lot of doctors in all sorts of places. So, they're always changing, moving, and using Macs. So, it makes it interesting. I definitely think that it's good at finding things automatically, versus trying to define it.

Not yet, but it's still working on it, it's still maturing. Right now, we were having some issues with some things, but as it continues, it will definitely.

Better dashboarding. At the moment, the dashboard only has an hour. It will give you one period of time, versus being an active dashboard like the rest of the dashboards. It doesn't give you an active tally of what's going on. It just gives you a snapshot.

Also, better automation and response.

So far, so good. We haven't needed to scale yet.

We've been working with their Beta team, not really technical support. I would say their Beta team is good, a seven on a scale of one to 10.

No. We've been using the AI rules within LogRhythm for UABE. This is just on top of it.

Users are always the hard part. They're the biggest vulnerability in any environment. For us, we needed to go through and find something that would help us keep better track. And this does that.

Straightforward. We had to do a couple of changes in a couple of places that were very specific, but the applications were already precompiled and we just had to run it in the various locations. So it was pretty straightforward.

We looked into LightCyber, which is a Palo Alto product. At the moment, LightCyber requires an on-premises box, and we didn't want to go with that.

We're at about 2000 logs per second. We have about 42 locations and around 4000 users.

In terms of important criteria when selecting a vendor, whichever one works the best, whether it be the newest or whatever. Whichever one has the best feature set would probably be the winner.

If I were advising someone looking at this solution or something similar, I would say there are a lot of log collectors out there, but LogRhythm's the only one that incorporates intelligence into the solution, versus just being something that collects.