I have utilized Microsoft Sentinel, which includes a case management system. This system requires the creation of rule sets using KQL and is primarily pre-configured with AlienVault OSSIM. However, we have made some interesting customizations to enhance its functionality.

I have worked with LogRhythm in the past, since 2015, and I find that AlienVault is a better product. We are facing a technical issue with LogRhythm, as it is still used in other parts of our organization. I am looking to finalize and unify the solution.

We needed better detection to give us information from the IS about geography or abnormal behavior that is breaching our security. Most of our products are web applications and this is important to us. 

We did not previously use a different version of the solution. 

I have used Splunk. AlienVault OSSIM and Splunk differ mainly in price. In Splunk, we need to do the correlation ourselves. Alienvault OSSIM is more user friendly. I don't have to learn a particular SQL language to do a query. It provides a new way of creating a query for any security event or management. 

We didn't previously use another solution.

I've used and evaluated QRadar vs AlientVault very extensively - I was working with IBM. I used it for ten years. I used and have compared ArcSight vs AlienVault as well, at my previous organization. At that organization, I also deployed AlienVault because I am comfortable with AlienVault.

Those competitors to AlienVault are very user-friendly, their interfaces are very user-friendly. They have multiple options such as generating reports and getting immediate alerts.

If somebody changes the privileges in the system or some code changes the privileges in the system, AlienVault is lacking there. Machine-learning and artificial intelligence are things that AlienVault should explore. If those were added to it, no product could replace it.

The tool's installation is straightforward. 

I have used QRadar and ArcSight.

We were pretty limited to AlienVault with this particular client. They needed something on-premises and didn't want to look at cloud options. We've used QRadar and Sentinal in the past, however, for this customer, we decided AlienVault was best.

OSSIM was the first solution that I used in this area.

I started to work with its commercial brother, AlienVault USM. When I started to use that, I received some question from my customers about comparing USM and OSSIM. So at the time, I started to use OSSIM, to learn it and compare it with USM. I needed to answer the question, "Why do we need to pay AlienVault money to use their commercial product when they have open-source?" I needed to know the differences.

We also used IBM QRadar before, but we did not get proper support and that's why we switched to AlienVault. 

We've used ArcSight as well. We used it on a particular project recently. It's easier to integrate items in it as compared to AlienVault. Aside from that, they are very similar products. 

I previously used QRadar and Splunk.

I didn't previously use a different solution, at least not at my house.

We did not previously use a different solution.

Previously, we did not use another similar product.