AlienVault OSSIM vs ArcSight Intelligence comparison

Cancel
You must select at least 2 products to compare!
Microsoft Logo
32,763 views|18,195 comparisons
92% willing to recommend
AT&T Logo
7,457 views|4,008 comparisons
76% willing to recommend
OpenText Logo
602 views|416 comparisons
100% willing to recommend
Comparison Buyer's Guide
Executive Summary

We performed a comparison between AlienVault OSSIM and ArcSight Intelligence based on real PeerSpot user reviews.

Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed AlienVault OSSIM vs. ArcSight Intelligence Report (Updated: March 2024).
767,995 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"The dashboard that allows me to view all the incidents is the most valuable feature.""Investigations are something really remarkable. We can drill down right to the raw logs by running different queries and getting those on the console itself.""Sentinel enables us to ingest data from our entire ecosystem. In addition to integrating our Cisco ASA Firewall logs, we get our Palo Alto proxy logs and some on-premises data coming from our hardware devices... That is very important and is one way Sentinel is playing a wider role in our environment.""Microsoft Sentinel provides the capability to integrate different log sources. On top of having several data connectors in place, you can also do integration with a threat intelligence platform to enhance and enrich the data that's available. You can collect as many logs and build all the use cases.""The features that stand out are the detection engine and its integration with multiple data sources.""Azure Application Gateway makes things a lot easier. You can create dashboards, alert rules, hunting and custom queries, and functions with it.""The analytic rule is the most valuable feature.""Free ingestion for Azure logs (with E5 licence)"

More Microsoft Sentinel Pros →

"Its user-friendliness is the most valuable. It is very easy to use and explore. The dashboard is very well packaged and integrated. You don't have to spend a lot of time in configuring it and checking out the RPM etc. It is also free and very powerful.""There are a lot of people you will find using OSSIM since they are also offering OTX as a service""The threat alerts it gives me from time to time on harmful code within the network, or if they are generating any network traffic, are very useful.""OSSIM is the only solution that includes the large number of modules that we need: a vulnerability scanner, a network IDS system, a host IDS system.""The most valuable feature is the logging capability.""The threat policies of the solution are always very advanced and the best in the market. They are very persistent in terms of keeping up with security protocols.""AlienVault OSSIM's GUI is very user-friendly.""With AlienVault you get everything in one box."

More AlienVault OSSIM Pros →

"The product has a valuable interface.""The most valuable feature of ArcSight Intelligence is a single console where the entire dashboard gives all the connected details in a single place.""We found the correlation engine to be very good. It takes logs from different types of devices and does the correlation in a good way.""The ability to tailor an environment to suit our specific use cases is a major advantage of ArcSight compared to other logging servers such as Splunk.""The platform helps us improve threat detection capabilities."

More ArcSight Intelligence Pros →

Cons
"The solution could be more user-friendly; some query languages are required to operate it.""Everyone has their favorites. There is always room for improvement, and everybody will say, "I wish you could do this for me or that for me." It is a personal thing based on how you use the tool. I do not necessarily have those thoughts, and they are probably not really valuable because they are unique to the context of the user, but broadly, where it can continue to improve is by adding more connectors to more systems.""If you're looking to use canned queries, the interface could be a little more straightforward. It's not immediately intuitive regarding how you use it. You have to take a canned query and paste it into an operational box and then you hit a button... They could improve the ease of deploying these queries.""Improvement-wise, I would like to see more integration with third-party solutions or old-school antivirus products that have some kind of logging capability. I wouldn't mind having that exposed within Sentinel. We do have situations where certain companies have bought licensing or have made an investment in a product, and that product will be there for the next two or three years. To be able to view information from those legacy products would be great. We can then better leverage the Sentinel solution and its capabilities.""The on-prem log sources still require a lot of development.""The product can be improved by reducing the cost to use AI machine learning.""The solution should allow for a streamlined CI/CD procedure.""The KQL query does not function effectively with Windows 11 machines, and in the majority of machine-based investigations, KQL queries are essential for organizing the data during investigations."

More Microsoft Sentinel Cons →

"AlienVault OSSIM on-premise version is more difficult to implement than the cloud version. Additionally, they should add integration between several different environments at once and improve their online knowledge base.""The user interface needs to be friendlier across the board.""AlienVault OSSIM gives unwanted notifications.""AlienVault OSSIM could improve by having better integration with some of the newer tools.""AlienVault OSSIM should improve the deployment and make it unified like the USM.""It's so hard to configure and explore something new on it.""We need more dashboards and we need more customization for dashboards.""The user interface could be improved."

More AlienVault OSSIM Cons →

"We haven't found the product fully scalable.""ArcSight Intelligence is a bit slower, and its speed should be improved.""The frequency of the updates that we are getting can be improved because the number and types of incidents that are happening at the global level are far more than what we are receiving. The frequency of updates feeds related to our rules should be increased. There should be more frequent information about the new rules that are coming and the global threats that are happening. There should be better options for dashboard creation. At present, the dashboards are good, but there is scope to make them better.""The dashboard is not user-friendly and is in black and white.""ArcSight Intelligence's pricing needs improvement."

More ArcSight Intelligence Cons →

Pricing and Cost Advice
  • "It comes with a Microsoft subscription which the customer has, so they don't have to invest somewhere else."
  • "It is a consumption-based license model. bands at 100, 200, 400 GB per day etc. Azure Sentinel Pricing | Microsoft Azure"
  • "Good monthly operational cost model for the detection and response outcomes delivered, M365 logs don't count toward the limits which is a good benefit."
  • "I have had mixed feedback. At one point, I heard a client say that it sometimes seems more expensive. Most of the clients are on Office 365 or M365, and they are forced to take Azure SIEM because of the integration."
  • "It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."
  • "I am just paying for the log space with Azure Sentinel. It costs us about $2,000 a month. Most of the logs are free. We are only paying money for Azure Firewall logs because email logs or Azure AD logs are free to use for us."
  • "Sentinel is a bit expensive. If you can figure a way of configuring it to meet your needs, then you can find a way around the cost."
  • "Azure Sentinel is very costly, or at least it appears to be very costly. The costs vary based on your ingestion and your retention charges."
  • More Microsoft Sentinel Pricing and Cost Advice →

  • "AlienVault pricing is the best. Whatever cost you are paying, you are getting a return on every penny... It's not like your IBM, your QRadar, or Splunk, where the cost is too high."
  • "The solution is open source, so it's free to use."
  • "OSSIM is free."
  • "The licensing fees for the non-community edition are paid on an annual basis, and there are no costs in addition to this."
  • "AlienVault OSSIM is free."
  • "We are using the community version, which can be used for free."
  • "We are using a free version of the solution. If you purchase a license there are more features available but the price is a little high. The solution should be cheaper to allow more customers to be able to afford it."
  • "The price of AlienVault OSSIM is too high sometimes for us to present to our customers. The price should be lower. We are on a three-year license to use the solution. We had to pay extra for the support."
  • More AlienVault OSSIM Pricing and Cost Advice →

  • "Its price is average and not very high. Splunk might be a bit cheaper than this. Its licensing is on a monthly basis."
  • "The solution is expensive and only suitable for enterprise environments."
  • "ArcSight Intelligence is an expensive solution."
  • "It is an expensive platform."
  • "They offer perpetual licenses for the product."
  • More ArcSight Intelligence Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
    767,995 professionals have used our research since 2012.
    Comparison Review
    Anonymous User
    Questions from the Community
    Top Answer:Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and… more »
    Top Answer:It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for… more »
    Top Answer:We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is… more »
    Top Answer:The tool's security detection is good. It helps us with login tracking and generating reports. We aim to identify… more »
    Top Answer:AlienVault OSSIM is expensive compared to its competitors.
    Top Answer:AlienVault OSSIM gives unwanted notifications.
    Top Answer:It is an expensive platform. We purchase its monthly licenses.
    Top Answer:ArcSight Intelligence's pricing needs improvement.
    Comparisons
    Also Known As
    Azure Sentinel
    OSSIM
    ArcSight Interset / Intelligence, FileTrek, Interset UEBA, Micro Focus Interset UEBA, Micro Focus Interset, ArcSight Interset
    Learn More
    Overview

    Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

    - Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

    - Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

    - Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

    - Respond to incidents rapidly with built-in orchestration and automation of common tasks

    To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

    AlienVault OSSIM, Open Source Security Information and Event Management (SIEM), provides you with a feature-rich open source SIEM complete with event collection, normalization and correlation. Launched by security engineers because of the lack of available open source products, AlienVault OSSIM was created specifically to address the reality many security professionals face: A SIEM, whether it is open source or commercial, is virtually useless without the basic security controls necessary for security visibility.

    Empower your threat hunting team to pre-empt elusive attacks with anomaly detection powered by security AI to find insider threats, zero-day attacks, and APTs.

    Sample Customers
    Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
    Council Rock School District
    Accuvant, Splunk Inc., NuTech, Box, rSolutions, Voodoo Technology Limited
    Top Industries
    REVIEWERS
    Financial Services Firm22%
    Computer Software Company11%
    Manufacturing Company8%
    Comms Service Provider8%
    VISITORS READING REVIEWS
    Computer Software Company16%
    Financial Services Firm10%
    Government9%
    Manufacturing Company7%
    REVIEWERS
    Insurance Company14%
    Computer Software Company14%
    Recruiting/Hr Firm7%
    Transportation Company7%
    VISITORS READING REVIEWS
    Computer Software Company17%
    Comms Service Provider9%
    Government8%
    Financial Services Firm7%
    VISITORS READING REVIEWS
    Financial Services Firm14%
    Computer Software Company14%
    Government12%
    Manufacturing Company9%
    Company Size
    REVIEWERS
    Small Business33%
    Midsize Enterprise21%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business25%
    Midsize Enterprise16%
    Large Enterprise59%
    REVIEWERS
    Small Business52%
    Midsize Enterprise29%
    Large Enterprise19%
    VISITORS READING REVIEWS
    Small Business30%
    Midsize Enterprise18%
    Large Enterprise52%
    VISITORS READING REVIEWS
    Small Business23%
    Midsize Enterprise9%
    Large Enterprise68%
    Buyer's Guide
    AlienVault OSSIM vs. ArcSight Intelligence
    March 2024
    Find out what your peers are saying about AlienVault OSSIM vs. ArcSight Intelligence and other solutions. Updated: March 2024.
    767,995 professionals have used our research since 2012.

    AlienVault OSSIM is ranked 14th in Security Information and Event Management (SIEM) with 26 reviews while ArcSight Intelligence is ranked 31st in Security Information and Event Management (SIEM) with 5 reviews. AlienVault OSSIM is rated 7.4, while ArcSight Intelligence is rated 8.0. The top reviewer of AlienVault OSSIM writes "An easy-to-scale open-source solution used for monitoring events on devices ". On the other hand, the top reviewer of ArcSight Intelligence writes "A user-friendly solution that can be used to integrate the logs properly with different connectors". AlienVault OSSIM is most compared with Wazuh, Elastic Security, USM Anywhere, Splunk Enterprise Security and Fortinet FortiSIEM, whereas ArcSight Intelligence is most compared with ArcSight Enterprise Security Manager (ESM), Exabeam Fusion SIEM and Splunk User Behavior Analytics. See our AlienVault OSSIM vs. ArcSight Intelligence report.

    See our list of best Security Information and Event Management (SIEM) vendors.

    We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.