Most Helpful Review
Use Exabeam? Share your opinion.
Find out what your peers are saying about Exabeam vs. RSA NetWitness Logs and Packets (RSA SIEM) and other solutions. Updated: September 2020.
441,672 professionals have used our research since 2012.
We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
"Being able to build and modify dashboards on the fly with Activeboards streamlines my analyst time because my analysts aren't doing it across spreadsheets or five different tools to try to build a timeline out themselves. They can just ingest it all, build a timeline out across all the logging, and all the different information sources in one dashboard. So, it's a huge time saver. It also has the accuracy of being able to look at all those data sources in one view. The log analysis, which would take 40 hours, we can probably get through it in about five to eight hours using Devo."
"The user interface is really modern. As an end-user, there are a lot of possibilities to tailor the platform to your needs, and that can be done without needing much support from Devo. It's really flexible and modular. The UI is very clean."
"One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful."
"Even if it's a relatively technical tool or platform, it's very intuitive and graphical. It's very appealing in terms of the user interface. The UI has a graphically interface with the raw data in a table. The table can be as big as you want it, depending on your use case. You can easily get a report combining your data, along with calculations and graphical dashboards. You don't need a lot of training, because the UI is relatively very intuitive."
"The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events."
"The advanced analytics has a really great overview of user behavior."
"Timeline based analysis; good platform support"
"The user interface and the timelines they use are the most valuable features. The price model is very simple so that one can understand it easily and there are no surprises within it."
"I have customers that like the EUBA functionality of it. The solution has the ability to build a session, basically. It pulls a lot of information together, for example, everything a user does in a specific timeframe. It's quite helpful."
"It gives the ability to investigate into network traffic in the Net and the organization what we couldn't do before."
"The most valuable feature is the correlation. It can report in real-time and monitor the management."
"Their technical support responds quickly and are knowledgable."
"The most valuable features are its ingestion of logs and raising of alerts based on those logs."
"The most valuable feature is the ability to write rules and triggers for network communication, and then being able to investigate based on that."
"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."
"The most valuable features are the packet decoder, log decoder, and concentrator."
"The most valuable feature is that we can create our own connectors for any application, and NetWitness provides the training and tools to do it."
"Their documentation could be better. They are growing quickly and need to have someone focused on tech writing to ensure that all the different updates, how to use them, and all the new features and functionality are properly documented."
"The Activeboards feature is not as mature regarding the look and feel. Its functionality is mature, but the look and feel is not there. For example, if you have some data sets and are trying to get some graphics, you cannot change anything. There's just one format for the graphics. You cannot change the size of the font, the font itself, etc."
"There's always room to reduce the learning curve over how to deal with events and machine data. They could make the machine data simpler."
"There is room for improvement in the ability to parse different log types. The breadth of overall log parsers that exists right now is an area that they could improve. Natively, there's more that could be done by Devo then what it can and can't understand from a parsing perspective."
"I believe if it were more flexible it would be a better product."
"The organzation is rigid and not flexible in the way they operate"
"We had a large volume right from the beginning and they weren't quite prepared for that. That's something that they should think about when it comes to customers that have a large volume to start off with."
"They need to focus on more of the MITRE ATT&CK Framework and coverage. They claim they cover about 70 to 80%. I'm not sure if it's really quite that much, however."
"We have encountered issues with unresolved crashes."
"The implementation needs assistance."
"The initial setup was complex because it takes a lot of time to complete the implementation."
"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."
"The system looks like it is a mix of a bunch of different systems, and nothing looked like it was quite together."
"They should implement algorithms to digest that data and produce additional, more advanced reporting, alerting and support of internal security teams."
"Log aggregation is an issue with this solution because there are a huge number of alerts in a single instance."
"The initial setup is very complex and should be simplified."
Pricing and Cost Advice
"It's a per gigabyte cost for ingestion of data. For every gigabyte that you ingest, it's whatever you negotiated your price for. Compared to other contracts that we've had for cloud providers, it's significantly less."
"I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."
"We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."
"We have seen ROI. We have seen cost savings in maintenance, upkeep, and support."
Information Not Available
"It is cheap."
"The licenses are good but the cost is very expensive."
"This is a pricey solution; it's not cheap."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"Our license is for one year."
Answers from the Community
Questions from the Community
Question: What do you like most about Devo?
Top Answer: Even if it's a relatively technical tool or platform, it's very intuitive and graphical. It's very appealing in terms of… more »
Top Answer: We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the… more »
Top Answer: It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendlier… more »
Question: What do you like most about Exabeam?
Top Answer: The user interface and the timelines they use are the most valuable features. The price model is very simple so that one… more »
Top Answer: The pricing is reasonable
Top Answer: Performance and reporting are very good.
Question: What is your experience regarding pricing and costs for RSA NetWitness Logs and Packets (RSA SIEM)?
Top Answer: Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends… more »
Top Answer: The user interface is a little bit difficult for new users and it needs to be improved. It takes a lot of time to… more »
Compared 55% of the time.
Compared 18% of the time.
Compared 9% of the time.
Compared 5% of the time.
Compared 2% of the time.
Compared 22% of the time.
Compared 11% of the time.
Compared 10% of the time.
Compared 9% of the time.
Compared 2% of the time.
Compared 21% of the time.
Compared 19% of the time.
Compared 10% of the time.
Compared 7% of the time.
Compared 2% of the time.
Also Known As
|Logtrust||RSA Security Analytics|
Devo unlocks the full value of machine data for the world’s most instrumented enterprises by putting more data to work now. With Devo, IT executives finally realize the transformational promise of machine data to drive breakthrough projects that move the entire business forward.
The Exabeam Security Intelligence Platform provides organizations of all sizes with comprehensive, end-to-end detection, analytics, and response capabilities from a single security management and operations platform. Exabeam provides elastic scalability through the use of a modern big data and machine learning architecture that ingests and analyzes data at any scale; all at a predictable cost. This means organizations no longer need to choose between adhering to security budgets and adding additional data sources that would minimize their security blind spots.
Exabeam represents the first security management platform to fully deliver on the initial “promise of SIEM”: complete visibility into modern threats with automated and intelligent response. Exabeam delivers what SIEM products do not.
If you’re relying on log data to detect and prevent cyber threats, you’re in trouble. Attackers increasingly evade detection of log-centric security and network monitoring tools. But logs combined with full packet, endpoint NetFlow data are proven to provide the essential details for early threat detection. Here’s a closer look at our solution.
See Devo in Action
See how Devo allows you to free yourself from data management, and make machine data and insights accessible.
Learn more about Exabeam
Learn more about RSA NetWitness Logs and Packets (RSA SIEM)
|United States Air Force, Rubrik, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, Public Library of Science, OpenText||Hulu, ADP, Safeway, BBCN Bank||Los Angeles World Airports, Reply|
Computer Software Company34%
Comms Service Provider18%
Computer Software Company32%
Comms Service Provider12%
Financial Services Firm7%
K 12 Educational Company Or School7%
Comms Service Provider38%
Financial Services Firm25%
Computer Software Company25%
Computer Software Company42%
Comms Service Provider19%
See our list of best Security Information and Event Management (SIEM) vendors.