We just raised a $30M Series A: Read our story
2018-12-05T11:40:00Z

What advice do you have for others considering AlienVault OSSIM?

8

If you were talking to someone whose organization is considering AlienVault OSSIM, what would you say?

How would you rate it and why? Any other tips or advice?

ITCS user
Guest
1616 Answers

author avatar
Top 5LeaderboardReal User

Because we are using the community version, we were unable to explore features such as behavior analytics. I would rate this solution a five out of ten.

2020-10-30T14:48:36Z
author avatar
Top 5Reseller

It is a very good solution. It is already more than adequate. It is a perfectly nice and free tool for compliance testing, assessment, and some basic vulnerability. I would advise upgrading to its paid version, USM, to get more features. It's well worth the money because of the provided threat intelligence, support, and training. When you upgrade to the paid version, you enjoy all these features. OSSIM doesn't have all these features because it is a freeware. AlienVault OSSIM is backed up by AT&T Cybersecurity, which is a Fortune Top 20 company. When you upgrade to the paid version, you also get support from AT&T, which is good. I would rate AlienVault OSSIM a nine out of ten. I'm very happy with this solution. It is a great product.

2020-09-13T07:02:20Z
author avatar
Top 10Real User

My advice to anybody who is considering AlienVault is to implement a proof of concept to ensure that it meets their requirements. A PoC should be done before settling on any product. I would rate this solution a nine out of ten.

2020-08-05T06:59:29Z
author avatar
Top 5Real User

We're just customers. We don't have a business relationship with the product. We're using the enterprise edition of the solution, the MSSP edition, however, I'm unsure which version it is we're currently on. Typically, we get requests for QRadar, AlienVault, or Sentinal. QRadar and AlienVault are the top choices for the most part, and we work with both. We try to accommodate our client's preferences. I'd rate the solution overall at eight out of ten.

2020-07-28T06:50:19Z
author avatar
Top 5Real User

Most of the SOC or SIEM enterprise class products are very expensive, whereas with OSSIM you can start out with a smaller setup and then expand as you wish. It's great because you get a pre-integrated, ready to run platform, which you can deploy. You don't have to bother about the integrations too much. This platform provides an adequate level of experience for that kind of an integrated intelligence gathering in any IT setup at a reasonable cost. It makes the entry easier for somebody who's not so well versed in these technologies and so on. I think that's the principal use case for AlienVault's product line. Make sure to choose the right partner to do the implementation. It's important that they know and understand the technology. They should have a very good understanding of the tool as well as an understanding of the security and operations space so that they are able to deliver on what you want to achieve as an outcome. I would rate this solution an eight out of 10.

2020-07-16T06:21:09Z
author avatar
Top 5Real User

Those who are looking for a solution like this one should first conduct a survey. There are other solutions which are quite capable of doing similar things, even open source solutions. If a company can afford a commercial solution, they should go for that rather than for an open source solution. It requires an expert to assess the situation. A small mistake can lead to a big problem; opensource is there for those who know what they're doing. If you're looking to add another feature, you need to have strong coding because tweaking them is not simple. I'm in a technical team so that's my perspective. I would rate this solution a six out of 10.

2020-06-17T10:56:01Z
author avatar
Top 5Real User

I would advise others to not implement it for any enterprise-level organization. However, it would definitely be a good solution for a small business environment. I would rate the solution five out of ten. It's free, so there isn't support, first of all. Second of all, it doesn't have all the integrations that I would hope for. And thirdly, because since AT&T bought them, I worry AT&T will ultimately destroy the product. I don't like AT&T.

2020-02-23T06:17:04Z
author avatar
Top 5LeaderboardReseller

I used this product for about a year. It was on-premise. My advice is to just read the manual. OSSIM is very simple. If you know why you need to use it, you will be happy. The biggest lesson is that the logs are "power." In these logs, with a good normalization engine, you can find so much very useful information about your infrastructure, sometimes about your employees, and about your business-critical processes. I would rate the solution at ten out of ten. It's really the best open-source CM on the market. It's simple, it has OTX integration. OTX, the Open Threat Exchange, is also a great product from AlienVault. It's like Facebook for indicators of compromises.

2019-09-12T09:09:00Z
author avatar
Top 20Consultant

There is a cloud version of this solution available, called AlienVault USM Anywhere, which defends data that is outside of the premises. The OSSIM version is an open-source product, unlike AlienVault USM, or the cloud version, AlienVault USM Anywhere. You have to rely on the community for support. If you are a business or a bank or a financial institution then it would be better to go with the licensed version. You get support 24/7, while with the community you cannot find this support. On the other hand, an individual who is using it and can handle the issues should go with OSSIM because it's almost free. As long as you can handle problems, such as when it stops working, that you can fix over a couple of days or during the weekend, then it is fine. I would rate this solution a ten out of ten.

2019-09-10T09:04:00Z
author avatar
Consultant

We use the cloud deployment model. I have a server that I subscribe people to. I would advise others to consider, if they get more customers, to do the commercial version the OSSIM from AlienVault. It's now part of AT&T, so there's a lot of support. I would rate the solution seven out of ten.

2019-09-03T08:57:00Z
author avatar
Real User

We use the on-premises deployment model. I would rate the solution nine out of ten.

2019-08-28T09:52:00Z
author avatar
Real User

The installation is easy, but it's not very compatible with some of our other solutions. Still, it's okay, it's very good. It integrates well with ELK. I would rate the solution six out of ten.

2019-08-19T05:47:00Z
author avatar
Reseller

If anybody asked me if am I happy with AlienVault, I would say that it is a very good product. Frankly speaking, if anybody asked me about QRadar or ArcSight I will say the same, but it requires lots of training and you need to have a source for the product and for the pricing, otherwise, you will end up paying an enormous amount of money. With AlienVault you get everything in one box. I will rate this product an eight out of ten.

2019-08-13T10:42:00Z
author avatar
Top 20Reseller

We use the on-premises deployment model. We have a small setup. It's an environment that supports only about 20 users, so, it's not really a complex setup. I would give the solution a rating of seven out of ten. I believe if I paid for the support I'd get a higher quality of software and other additional functionalities.

2019-08-13T06:03:00Z
author avatar
Real User

I've used this for a small environment, and it was amazing. I'm currently converting to QRadar now because I am expanding. I am handling more than 30,000 events per second. I can't use Alien Vault, as it's too high a threshold. I do recommend the solution, however, for those with small environments that don't handle as many events. It works great for anything under 1,000 events per second. I would rate the solution eight out of ten.

2019-08-13T06:03:00Z
author avatar
Real User

If your network is flat, if it is not that complicated, then you should go for it. I'm using it free of cost, so I'm very happy with AlienVault. I'm the only one who's controlling it. I have a team of five. They are my soft team. They monitor all the alerts 24/7. It takes a team of five to maintain it. I lead the security section and among the other five, two are network specialists and three are system administrators.

2018-12-05T11:40:00Z
Learn what your peers think about AlienVault OSSIM. Get advice and tips from experienced pros sharing their opinions. Updated: October 2021.
541,708 professionals have used our research since 2012.