We compared Amazon CloudWatch and LogRhythm SIEM based on our users' reviews in five categories. We reviewed all of the data and you can find the conclusion below.
Features: Amazon CloudWatch users liked the solution’s simplicity, intuitive interface, and ability to handle large workloads. Users also praised CloudWatch’s comprehensive monitoring and alerts. Users praised LogRhythm SIEM for its user-friendly centralized dashboard, strong integration capabilities, and event-filtering capabilities. Some reviews mentioned that Amazon CloudWatch could improve performance and dashboard visualization through. Others noted that the solution lacked compatibility with some databases. LogRhythm SIEM has the potential to improve its SOAR and NDR features, platform stability, and MDI integration. LogRhythm users requested expanded log storage, better load balancing, and streamlined search capabilities.
Service and Support: Customers generally have positive opinions about Amazon's customer service. They commended the support team for its availability and timely issue resolution. LogRhythm SIEM was generally praised for its helpful and knowledgeable support, although there have been occasional delays and knowledge problems.
Ease of Deployment: Amazon CloudWatch is generally described as easy to set up. LogRhythm SIEM's setup is considered to be straightforward. However, it is more time-consuming and complex for enterprise deployments involving multiple components or vendors, and users often require assistance from professional services or LogRhythm-certified engineers.
Pricing: Amazon CloudWatch offers a flexible pricing structure based on usage and processing, without any separate licensing cost. Some users said that scaling up can be costly due to the need for additional storage space. LogRhythm SIEM’s license typically includes all elements. However, enterprise customers may encounter complexities related to additional features and add-ons.
ROI: Amazon CloudWatch offers a return on investment by minimizing the need for manual monitoring. LogRhythm SIEM has proven to be highly valuable, delivering a significant ROI by reducing the mean time to detect and respond.
"Our team finds it overall quite useful."
"The tool's UI is good. One can scroll through the logs very easily."
"CloudWatch immediately hooks up and connects to the KPIs and all the metrics."
"It is a robust analytical tool and it goes beyond mere functionality and extends into the realm of providing comprehensive insights."
"The most valuable feature of Amazon CloudWatch is reliability."
"The solution effectively monitors golden signals like CPU, page requests, and queues."
"It's a very simple logging system."
"I can put it in a simple term, its simplicity is always there."
"LogRhythm does a very good job of helping SOCs manage their workflows."
"It supports most standard log sources."
"Alarms are the most valuable feature. We also like the dashboard and how things are at your fingertips. The fact that we can now edit the report templates is going to be a great thing."
"In terms of security, LogRhythm NextGen SIEM is great."
"The security operation center is excellent."
"The major feature of this solution is its easy configuration which helps different team members to work on it effectively. This kind of feature is not available in other solutions because of a request for specialised schemes for configuration report extraction and searching. Another feature that I really admire is the significant improvement in the compliance in the auditing process by the solution. Our organisation-specific complaints require where the mailbox data needs to be forwarded, stored and searchable for a certain time period. This solution categorises data based on different types, which include cold, warm and hot data. These features allow faster and easier extraction of any data even if the event was occurring several years ago. I also like other features, especially user behaviour analysis and automation. If suddenly someone accesses your side or an unusual traffic is recorded from a user the solution flags it very effectively."
"As a SIEM, probably the best feature is that it can be tuned effectively. There are very few SIEMs out there that can be effectively tuned to provide you with meaningful information and not be overwhelmed."
"The most useful feature that I've found so far is the search function. I like all the different ways you're able to search through metadata and the different ways you're able to correlate or search through logs to find out what's going on."
"Improvement of SSSD logs would be beneficial."
"The solution could benefit from a price decrease."
"I found several areas for improvement in Amazon CloudWatch. First is that it's tough to track issues and find out where it's going wrong. The process takes longer. For example, if I get an exception error, I read the logs, search, go to AWS Cloud, then to the groups to find the keyword to determine what's wrong. Another area for improvement in Amazon CloudWatch is that it's slow in terms of log streaming. It requires an entire twenty-four hours for scanning, rather than just one hour. This issue can be solved with Elasticsearch streaming with Kibana, but it requires a lot of development effort and integration with Kibana or Splunk, and this also means I need a separate developer and software technical stack to do the indexing and streaming to Kibana. It's a manual effort that you need to do properly, so log streaming should be improved in Amazon CloudWatch. The AWS support person should also have a better understanding of the logs in Amazon CloudWatch. What I'd like added to the solution is a more advanced search function, particularly one that can tell you more information or special information. Right now, the search function is difficult to use because it only gives you limited data. For example, I got an error message saying that the policy wasn't created. I only know the amount the customer paid for the policy, the mobile number, and the customer name, but if I use those details, the information won't show up on the logs. I need to enter more details, so that's the type of fuzzy matching Amazon CloudWatch won't provide. If this type of search functionality is provided, it will be very helpful for businesses and companies that provide professional services to customers, like ours."
"For monitoring applications or for APM, CloudWatch has some limitations. You cannot monitor application performance from CloudWatch, and you have to go for a third-party tool."
"The solution's auto-scaling could be improved."
"Right now, in relation to monitoring services, there are too many services and too many metrics per service."
"The product should provide more features."
"The dashboard of Amazon CloudWatch is not very customizable right now."
"I would like it to do a lot of the automation (which I still need to learn more about), because I am essentially a one man shop doing all the jobs. I'd like for it to be able to do more for me."
"The initial setup is not so easy because it is quite a process."
"Parsing is totally controlled by LogRhythm and they do not allow any partner or any third-party to handle this part and this is a key challenge on my end."
"The security playbook could be pre-defined and available to other analysts with similar security issues."
"I would like to see APIs well-documented and public facing, so we can get to them all."
"Their ticketing system for managing cases can be improved. They can either do that or adopt some of the open-source ticket systems into theirs. The current system works and gets the job done, but it is very bare-bones and basic. There are some things that could be improved there. They should also bring in more threat intelligence into the product and also probably start to look into the integration of more cloud or SAS products for ingesting logs. They're doing the work, but with the explosion of COVID, a lot of businesses have started to move towards more cloud applications or SAS applications. There is a whole diverse suite of SAS products out there, which is a challenge for them and I get it. They seem to be focusing on the big ones, but it'll be nice to be able to, for example, pull in Microsoft logs from Office 365. They are working towards a better way of doing that, and they have a product in the pipeline to pull logs in from other SAS applications. The biggest thing for them is going to be moving away from a Windows Server infrastructure into a straight-up Linux, which is more stable in my eyes. For the backend, they can maybe move into more of an up-to-date Elastic search engine and use less of Microsoft products."
"I would like to see more integration with more products that are out there within the same security field."
"The installation was a bit complex because we are running a virtual infrastructure."
Amazon CloudWatch is ranked 12th in Log Management with 40 reviews while LogRhythm SIEM is ranked 7th in Log Management with 166 reviews. Amazon CloudWatch is rated 8.0, while LogRhythm SIEM is rated 8.4. The top reviewer of Amazon CloudWatch writes "Instantaneous response when monitoring logs and KPIs". On the other hand, the top reviewer of LogRhythm SIEM writes "The solution reduced our investigation time from days to hours and assists in managing our workflows". Amazon CloudWatch is most compared with Zabbix, Datadog, Google Cloud's operations suite (formerly Stackdriver), Dynatrace and SolarWinds NPM, whereas LogRhythm SIEM is most compared with IBM Security QRadar, Splunk Enterprise Security, Wazuh, Microsoft Sentinel and LogRhythm Axon. See our Amazon CloudWatch vs. LogRhythm SIEM report.
See our list of best Log Management vendors.
We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
