We are currently looking into implementing a PoC for either ManageEngine or FortiSIEM.

We did evaluate another solution.

I have evaluated ELK Stack and Security Onion.

I didn't look at other options. OSSIM is the only solution that includes the large number of modules that we need: a vulnerability scanner, a network IDS system, a host IDS system. The solution also provides us with a correlation engine for our logs. This is the best option on the market and I didn't see any similar solutions.

We looked at ArcSight as an option at the beginning, but the pricing was not what we were looking for. And we don't have the proper channel to sell ArcSight in Egypt. That's why we decided to go to AlienVault.

I didn't evaluate any other options. I already knew enough about them, and this was the only free solution, which is why I chose it.

We didn't evaluate other options before choosing this solution.

We have decided to implement a fully-featured SIEM solution that has all of the features, including UBA.