AlienVault OSSIM (discontinued) vs. Blumira

The most obvious scenario in which OSSIM is well suited is in a single office/home office (SOHO) or small business, in which budget is reduced but asset discovery and vulnerability management are greatly needed and appreciated. OSSIM is lightweight and free, so the real challenge to face is to hire or assign an administrator to manage and operate it, instead of any investment on an expensive appliance. Also, as resellers, promoting usage of OSSIM to customers charging for professional services for installation, administration, and maintenance (remember that OSSIM doesn't have official support from AlienVault) is a great asset for the organization.

Incentivized

Blumira is great for a small IT team in a small to medium sized environment. It gives you unlimited logging (no limit on the number of logs sent) and doesn't require advanced knowledge or expertise in SIEMs to get the system up and running.

Incentivized

• Threat analysis. It can correlate different events happening to detect a pattern or an attack.
• Dashboard provides a clean, single location to see what is going on in our environment.
• Up to date open threat exchange means everything new popping up out there is included and watched for in our environment.

Incentivized

• The user interface (for managing, reporting) is intuitive and is easy to use
• The setup / onboarding process was very easy
• Support has been wonderful (and personal)

Incentivized

• Creating custom rules is a bit complicated
• Reporting could be improved
• Agent has caused conflicts with a couple of our other applications

Incentivized

• We've had a few suggestions for improving some of the built-in "workflows" -- steps that we are instructed to take by Blumira for specific "findings"
• There are a few improvements about reporting I'd like to see

Incentivized

AlienVault OSSIM is far easy to use and manage - provided you know what you're doing. As any SIEM application, there is some background knowledge required in order to take advantage of the product's functionalities, such as the log correlation and analysis. Other than that, the application is quite usable and robust.

Incentivized

Everything is done through MSSP and installation pro services. Once those hours are burned up, then you're on your own without a lot of help. Typically the pro services hours aren't enough to get past 60 days and MSSP are hit and miss. We had a miss for installation helpers.

Incentivized

AlienVault OSSIM as the first experience with a SIEM is very fine, especially if your company is an SMB. Every SIEM shares some features in common with other products, features such as log retrieval and normalization. So if you stick with principles, you can learn other SIEM products as well. If your environment is not of a minimum size, LogRhythm might be overkill for your network, same with McAfee Enterprise Security Manager.

Incentivized

Blumira is "right-sized" for my small organization. It is not a strain on our resources (people, system, or monetary). It gives us exactly what we needed

Incentivized

• OSSIM and the installers didn't really help us optimize at installation. OSSIM went without optimization for almost two years before that fact was noticed. I think this decreased ROI.
• Finding and researching incidents is much faster with all data available. Sometimes too much data, though.

Incentivized

• Now when we have a security audit or need to completed a cybersecurity insurance application, we answer "Yes" to the "Do you have a SIEM?" question.
• It has provided awareness and visibility of events and situations on our system that we were completely blind to before.

Incentivized