We performed a comparison between Fortinet FortiSIEM and SCOM based on real PeerSpot user reviews.
Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
"Log aggregation and data connectors are the most valuable features."
"We can use Sentinel's playbook to block threats. It covers all of the environment, giving us great visibility."
"It has basic out-of-the-box integrations with multiple log sources."
"The UI of Sentinel is very good and easy to use, even for beginners."
"The data connectors that Microsoft Sentinel provides are easy to integrate when we work with a Microsoft agent."
"Microsoft Sentinel provides the capability to integrate different log sources. On top of having several data connectors in place, you can also do integration with a threat intelligence platform to enhance and enrich the data that's available. You can collect as many logs and build all the use cases."
"I like the KQL query. It simplifies getting data from the table and seeing the logs. All you need to know are the table names. It's quite easy to build use cases by using KQL."
"We are able to deploy within half an hour and we only require one person to complete the implementation."
"Fortinet FortiSIEM has its own validated and authentic IP database that marks malicious IP attacks against the firewall and generates an alert for the same."
"It's a very nice solution to work with."
"FortiSIEM provides a single PIN to monitor SOC and NOC. It's a nice tool for integration and monitoring. It provides multiple categories for monitoring based on security designations like low, medium, and high."
"It gives us the opportunity to generate notifications based upon rules that get triggered, and the rules could be specific to PCI, HIPAA, GIBA, NIST, and so forth."
"Fortinet FortiSIEM is less costly than other products and is available 24/7."
"I like the various options, including the option for CMDB and the easier access to create rules, playbooks, or use cases. It's also easier to use for creating dashboards and reports."
"It works well with medium to large-scale enterprises."
"The solution is very stable. It's run for years without the need to do anything except, add new patches when they are available, which are always a good idea to install."
"I like the historical reporting of observer metrics."
"We are able to do problem determination on runaway processes."
"The most valuable feature is the extensibility, as there are really no limits as to what you can do with it."
"They have great integration with the active directory."
"SCOM has improved our organization by simplifying the monitoring process. The system tells you what the bi-weekly or monthly usage was and that enables us to report this information to the manager. It shows if there was a connectivity issue that needs to be fixed and it's easier to concentrate on what needs to get fixed. System errors, therefore, get fixed faster."
"It's easy to use."
"The advantages of SCOM are that it is definitely user friendly and a more appropriate solution for what we need."
"The most valuable features in SCOM are Azure monitoring and integration with Azure Monitor for monitoring Azure-hosted servers from SCOM on-premises."
"Documentation is the main thing that could be improved. In terms of product usage, the documentation is pretty good, but I'd like a lot more documentation on Kusto Query Language."
"We have been working with multiple customers, and every time we onboard a customer, we are missing an essential feature that surprisingly doesn't exist in Sentinel. We searched the forums and knowledge bases but couldn't find a solution. When you onboard new customers, you need to enable the data connectors. That part is easy, but you must create rules from scratch for every associated connector. You click "next," "next," "next," and it requires five clicks for each analytical rule. Imagine we have a customer with 150 rules."
"I think the number one area of improvement for Sentinel would be the cost."
"I would like to see more AI used in processes."
"They could use some kind of workbook. There is some limitation doing the editing and creating the workbook."
"The learning curve could be improved. I am still learning it. We were able to implement the basic features to get them up and running, but there are still so many things that I don't know about all its features. They have a lot of features that we have not been able to use or apply. If they could work on reducing the solution's learning curve, that would be good. While there is a training course held by Microsoft to learn more about this solution, there is a cost associated with it."
"The on-prem log sources still require a lot of development."
"The performance could be improved. If I create 15 to 20 lines for a single-use case in KQL, sometimes it takes more time to execute. If I create use cases within a certain timeline, the result will show in .01 seconds. A complex query takes more time to get results."
"FortiSIEM needs to expand its integration with third-party vendors. I don't know if Forcepoint has been added, but there were limited resources for integrating Forcepoint solutions when we implemented FortiSIEM. It integrates well with other Fortinet products and solutions from established cybersecurity companies like Palo Alto but doesn't integrate with some of the newer vendors."
"They could work on their documentation. If there's anything about the solution that needs improvement, it's that. For example, documentation already is on a very high level but specifically on the CLI there are tons of features which can be fine-tuned and thousands of commands are very difficult to document. If they could make this easier, it would improve the overall solution."
"Fortinet FortiSIEM could improve by having better integration and extensions. This would benefit by allowing us to give more rules."
"The UI could improve in Fortinet FortiSIEM. Humans view the UI frequently for data and if it was more visually pleasing it would be beneficial."
"Fortinet FortiSIEM could improve to extend to several locations or sites."
"Fortinet FortiSIEM is a little out of sight and needs more marketing efforts to be popular in the market."
"Areas for improvement would be the ease of use and the integration with Fortinet's own products."
"We need to see incident reports about the event log, without events from the administrator or through human interaction."
"All of the areas of reporting are very bad and need to be improved."
"It would be a much better product if Microsoft provided management packs with the product."
"There are some negative points about this product. Sometimes, the capabilities of the software don't appear, and you can't directly see the results. You have to wait for a long period to refresh the policy to push it to the software or other patches."
"The management of the servers could be better."
"The solution should be more user-friendly and offer a better user interface."
"I would like more customized reports. People should have some customization option on the dashboards for whenever they put multiple lists into it. Beyond customizing the content, there should be the ability to customize the colors so that they can engage some priority and mark challenges separately."
"Third-party tools have had to be created to make SCOM management pack creation more efficient and effective. However, this weighs down the application as it just adds a resource requirement, which is ballooning the size of the necessary storage and all that for essentially substandard components."
"I would like to see better support for monitoring Unix-based systems."
Fortinet FortiSIEM is ranked 8th in Security Information and Event Management (SIEM) with 63 reviews while SCOM is ranked 3rd in Event Monitoring with 77 reviews. Fortinet FortiSIEM is rated 7.6, while SCOM is rated 7.8. The top reviewer of Fortinet FortiSIEM writes "It's cheaper than other solutions with the same features but lacks integration with many third-party vendors". On the other hand, the top reviewer of SCOM writes "Has a good reporting engine, but its monitoring of the cloud-based environment could be improved". Fortinet FortiSIEM is most compared with IBM Security QRadar, Splunk Enterprise Security, LogRhythm SIEM, Wazuh and AlienVault OSSIM, whereas SCOM is most compared with Zabbix, Dynatrace, Datadog, Nagios XI and AppDynamics. See our Fortinet FortiSIEM vs. SCOM report.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
