I was certified in QRadar. I was a third-line engineer. I have also used ArcSight.

I have experience with Splunk and Datadog. My company started to use USM Anywhere since it was one of the products that offered a good MSSP program and was easy to deploy.

From a security perspective, this was the first one, but before that, they had SolarWinds, which is not a security incident monitoring tool. It is just a network performance monitoring tool. After I joined the company, we had to get a SIEM solution, and we onboarded AlienVault at first. We used it for a few years, and after that, we also integrated Wazuh.

In my current company, we have Datadog. We are using ELK Stack, and we have built our own SIEM solution.

I did not use another solution prior to AT&T AlienVault USM.

I did use other solutions with different clients, and we do so now. We find AlienVault to have the best price to performance value. There are better solutions, but the price is reflected. 

Customization: Again, this is one point where AlienVault outshines the competition in capability of customization. We have seen several customers who are using AV USM with heavy customization to perform threat detection, Asset Discovery, Threat scoring, APT detection, etc. This flexibility is really desired by Security analysts and AV USM is making good on this promise.

We were using an open-source solution, then we upgraded to USM.

I have used different solutions at previous jobs. AlienVault was a new purchase and install. When asked for my opinion, I did recommend AlienVault as the solution since my comparison of all products came down to AlienVault being the best for our particular environment.

We did not work with a previous solution. We decided to bring it into our organization based on its value. It allows you to do a lot with a small price tag.

We used, tested, and tried several solutions prior to this solution. This solution answered too many questions under one reasonable cost, as opposed to piecemealing everything together for more money.

I previously worked with Nagios, SolarWinds, and Big Brother. Though, this was at a different company. 

These products did not match the requirements in AWS at the time that we were getting AlienVault.

I have used many solutions with different companies but always move to AlienVault. You get so many more features for the money. AlienVault always comes in way less in price than any other solution.

As a reseller, we've looked into other solutions, however, we find this product to be the best option for our customers time after time.

I'm not familiar with what was used prior to AlienVault nor the reason the switch was made.  I'm just very pleased.

This is the first solution of its kind for us.

We've used a lot of solutions. I've used, run, and supported a lot of different solutions over the years. There were two primary reasons for switching to AlienVault. One was price, and the other was the feature bundle that I was talking about earlier.

We chose this particular product for many other reasons. As a Professional Services provider, a service provider, MSSP, and a reseller, we're not using it the way most end-users would go out and shop around and look for something. A big part of our decision in selecting this product was the fact that we were able to establish that relationship with AlienVault as a company, as a business to business relationship, to be a reseller, to be an MSSP, to be all of those things.

We did not use a previous solution.

We did not use anything else prior. We tried the free version of AV then decided to go with the paid option and become an MSSP, since it fit our company needs for the right price.

No.

ManageEngine Event Log Analyzer

A direct competitor to AV is IBM QRadar, which is also used in the classroom environment.

We used Nexpose for vulnerability management and moving away from that was the primary reason we went with AlienVault.

We did not previously use a different solution.

Before AlienVault we had nothing. We learned about AlienVault through a company we contracted to do a full vulnerability assessment. They used AlienVault, so I felt like if it was good enough for them, then we should be using it.

We used hardware based as well as open source solutions before. We still use some of them, but AlienVault allowed us to consolidate a lot of services into one.

This was our first solution for this type of security appliance.

I used multiple products to try and get someway towards the level of visibility afforded by AlienVault. ManageEngine SIEM, Qualys, vulnerability management, and Norton for HIDS. Having this all in one interface made more sense which swayed the decision to go with Alienvault.

Our previous solution consisted of building a SIEM based on individual components/modules from the open-source space.

We did not have any sustainable solution, previously.

No, this is our first SIEM device.

This was our first solution for HIDS, NIDS, and log management.

We did not previously use a different solution.

We did not previously have many of the systems that AlienVault offers. We switched to get a robust single solution.

We chose this product because of:

• Pricing model
• Flexibility of the solution
• Multi-tier architecture/scalability

No.

We previously used Splunk for SIEM.

We use both the on-premises version and USM Anywhere. The latter is a SaaS solution.

We did not use a previous solution.

We didn't have anything like AlienVault previously.

We used an outsourced MSSP solution but we needed to get the solution in-house in order to better integrate with our datacenters and systems and comply with financial regulatory and PCI-DSS requirements.

I have used McAfee ESM. McAfee ESM has many good features, but it is not very integrated with cloud-based assets. AlienVault is already a cloud-based solution, and it is native to cloud assets, which gives AlienVault an advantage over McAfee ESM. On the other hand, McAfee ESM is much better than AlienVault in terms of search engine, data collection, and events. 

We did not use a previous solution.

Yes. We switched because this is a USM (SIEM, FIM, and VA tool in one product) and the price.

We did not use a previous solution.

No.

No, we started with OSSIM and then bought USM.

Another group in our company used QRadar before they were bought out. The buyout created a bad enough situation that the group refused to renew with QRadar, especially when they decided after 18 months that they did not want to support the hardware that their predecessors had sold. We also trialed LogRhythm which was a more mature product, but had its own quirks and annoyances. The largest issue I found the LogRhythm was the excessive amount of time to spend to deploy a single agent, much less repeating that process 390 times for our environment.   

No. This is the first security tool I am using.

Yes, McAfee ESM. Even after upgrading to Version 10, the interface was still hard to navigate through and did not work on every browser. Writing effective rules was difficult.

N/A.

We used different solutions. Pricing was an issue and support was limited.

We switched because our previous solution wasn't scalable.

This was the solution selected after evaluating several competing products; no SIEM prior to this deployment.

No.

This is the first solution like this that I have deployed.

We didn't have anything in place previously.

Yes, But AlienVault is the more appropriate solution, it's flexible, Linux based, and contains a large number of open source solutions.

We did not previously use a different solution.

I haven't used anything similar.

No.

I have not used any other solutions before.

We did not previously use a different solution.

This is the first time we've used a solution of this type.

We had nothing in place prior to this.

AlienVault was the first and only choice.

We had a MARs and it was EOF.