We performed a comparison between LogicMonitor and Sumo Logic Security based on real PeerSpot user reviews.
Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The automation rules and playbooks are the most useful that I've seen. A number of other places segregate the automation and playbook as separate tools, whereas Microsoft is a SIEM and SOAR tool in one."
"Sentinel is a Microsoft product, so they provide very robust use cases and analytic groups, which are very beneficial for the security team. I also like the ability to integrate data sources into the software for on-premise and cloud-based solutions."
"There are some very powerful features to Sentinel, such as the integration of various connectors. We have a lot of departments that use both IaaS and SaaS services, including M365 as well as Azure services. The ability to leverage connectors into these environments allows for large-scale data injection."
"The log query feature has been the most valuable because it's very good. You can put your data on the cloud and run queues from Sentinel. It will do it all very fast. I love that I don't have to upload it to an Excel file and then manually look for a piece of information. Sentinel is much faster and is good for big databases."
"Sentinel improved how we investigate incidents. We can create watchlists and update them to align with the latest threat intelligence. The information Microsoft provides enables us to understand thoroughly and improve as we go along. It allows us to provide monthly reports to our clients on their security posture."
"The dashboard that allows me to view all the incidents is the most valuable feature."
"It has basic out-of-the-box integrations with multiple log sources."
"Sentinel has an intuitive, user-friendly way to visualize the data properly. It gives me a solid overview of all the logs. We get a more detailed view that I can't get from the other SIEM tools. It has some IP and URL-specific allow listing"
"We have very fine-tuned alerting that lets us know when there are issues by identifying where exactly that issue is, so we can troubleshoot and resolve them quickly. This is hopefully before the customer even notices. Then, it gives us some insight into potential issues coming down the road through our environmental health dashboards."
"It is easy to set up and monitor an entire facility. This is crucial because we have around 80 facilities that require monitoring. LifePoint is a hub-and-spoke environment, so it is essential to understand all of the WAN interfaces."
"Having a full team at LogicMonitor for support is super helpful as they are available all the time to answer any questions you may have."
"The most valuable feature of LogicMonitor is the infrastructure monitoring capability."
"It has improved our organization with its capacity planning. We have a performance environment that we use to benchmark our applications. We use it to say, "Okay, at a certain level of concurrency, we know where our application will fall over." Therefore, we are using LogicMonitor dashboards to tell us that we're good. Our platform can handle X number of clients concurrently hitting us at a time."
"The dashboarding is very useful. Being able to create custom data sources is one of its biggest features which allows quick time to market with new features. If one of our vendors changes their data format or metrics that we should be monitoring, then we can quickly adjust to any changes in the environment in order to get a great user experience for our customers."
"It's the depth of data that it gathers that I find really useful because there's nothing worse, when you're trying to find information about something or dig deeper into something, than hitting the bottom of the information really quickly and not having enough information to work with. With LogicMonitor, there is a load of information to dig through. It's a really good solution for that."
"One thing that's very valuable for us is the technical knowledge of the people who work with LogicMonitor. We looked at several products before we decided to use LogicMonitor, and one of the key decision-making points was the knowledge of the things that they put in the product. It provides real intelligence regarding the numbers that you see on the product, which makes it easy for us technical people to troubleshoot. Other products don't provide you with such information. You see a value going up, but you don't know what it means. LogicMonitor provides such information. For instance, if a value goes up, it says that it is probably because your disk area was too low."
"We can integrate threat intelligence solutions into the product."
"For many of our services, we use Sumo Logic to track errors and send notifications to our Slack channel, if there are issues. Then, we have our support people monitoring this, and they can react quickly."
"It helps a lot because we can troubleshoot issues pretty easily."
"We use it to ingest Windows domain controller logs. We use this to monitor if anyone is placed in particular administration groups that potentially shouldn't be. It helps us keep track of people."
"Support has been excellent. Sumo Logic's support staff is really good, both their account management staff and direct support."
"It gives us a bird's eye view of what's happening from our connection's point of view."
"Sumo Logic is an easy solution to use. You can set it up very quickly, and it includes a lot of training videos."
"The tool has key features like operability. It will alert the admins whenever a device is onboarded."
"We've seen delays in getting the logs from third-party solutions and sometimes Microsoft products as well. It would be helpful if Microsoft created a list of the delays. That would make things more transparent for customers."
"Sentinel still has some anomalies. For example, sometimes when we write a query for log analysis with KQL, it doesn't give us the data in a proper way... Also, the fields or columns could be improved. Sometimes, it is not giving the desired results and there is a blank field."
"Currently, the watchlist feature is being utilized, and although there have been improvements, it is still not fully optimized."
"Improvement-wise, I would like to see more integration with third-party solutions or old-school antivirus products that have some kind of logging capability. I wouldn't mind having that exposed within Sentinel. We do have situations where certain companies have bought licensing or have made an investment in a product, and that product will be there for the next two or three years. To be able to view information from those legacy products would be great. We can then better leverage the Sentinel solution and its capabilities."
"We'd like to see more connectors."
"The playbook is a bit difficult and could be improved."
"If Sentinel had a graphical user interface, it would be easier to use. I would also like it to be more customizable."
"If you're looking to use canned queries, the interface could be a little more straightforward. It's not immediately intuitive regarding how you use it. You have to take a canned query and paste it into an operational box and then you hit a button... They could improve the ease of deploying these queries."
"The process of upgrading some of the collectors has been a little bit confusing. I need to understand that better."
"Dashboarding capabilities could be enhanced. It is cumbersome, you must do it all at once, and then you must repeat the process every now and then."
"I'd like to see more automation in the tool, especially around remediation."
"The ease of use with data source tuning could be improved. That can get hairy quickly. When I reach out for help, it's usually around a data source or event source configuration. That can get challenging."
"LogicMonitor should improve its logging features. It can become expensive and should be cost-effective. It would be great to see prebuilt templates for alerting methods in LogicMonitor that are similar to the prebuilt dashboards. Currently, users have to build their alerting configurations."
"One drawback of LogicMonitor is its licensing model, which requires an additional license for each module. For example, if you need to use Azure monitoring, you'll need an additional license on top of the base license."
"LogicMonitor can easily easy to pull data from one item at a time. I have yet to find a good way to get LogicMonitor to show me all the WAN devices and how they're doing in terms of capacity."
"Role-based permissions could be better and updating modules could be smoother."
"Sumo Logic Security is expensive, and its pricing could be improved."
"The dashboard has room for improvement, because sometimes it is a difficult to create a specific dashboard or query. This would be a nice place to correct problems."
"If you want to up your subscription through the AWS Marketplace, it can be difficult. You can't just go back to the AWS Marketplace, and say, "I want a bigger one now." You have to contact the sales team, then they do it on the back-end. This could definitely be improved."
"The integration with multiple sources could be better."
"It took a bit of trial and error to get it set up correctly based on everything we had to do. In the end, we had to send everything over HTTP, which was sort of a stop-gap."
"We would like to have some type of predefined setup for the logs, making the setup easier by default."
"We would like the ability to drill down into a dashboard and get into deeper levels."
"The solution should improve its UI."
LogicMonitor is ranked 17th in Network Monitoring Software with 25 reviews while Sumo Logic Security is ranked 20th in Security Information and Event Management (SIEM) with 18 reviews. LogicMonitor is rated 9.0, while Sumo Logic Security is rated 8.6. The top reviewer of LogicMonitor writes "We went from nothing to full visibility across our internal and external estates of equipment". On the other hand, the top reviewer of Sumo Logic Security writes "Used to store and monitor application logs and VPC flow logs". LogicMonitor is most compared with SolarWinds NPM, ScienceLogic, Zabbix, SCOM and OpsRamp, whereas Sumo Logic Security is most compared with Wazuh, Rapid7 InsightIDR, Splunk Enterprise Security, VMware Aria Operations for Logs and IBM Security QRadar. See our LogicMonitor vs. Sumo Logic Security report.
See our list of best Security Information and Event Management (SIEM) vendors.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
