AlienVault OSSIM (discontinued) vs. FortiSIEM

The most obvious scenario in which OSSIM is well suited is in a single office/home office (SOHO) or small business, in which budget is reduced but asset discovery and vulnerability management are greatly needed and appreciated. OSSIM is lightweight and free, so the real challenge to face is to hire or assign an administrator to manage and operate it, instead of any investment on an expensive appliance. Also, as resellers, promoting usage of OSSIM to customers charging for professional services for installation, administration, and maintenance (remember that OSSIM doesn't have official support from AlienVault) is a great asset for the organization.

Incentivized

If budget is an issue then Fortisiem fits well, as it's more than a typical SIEM solution. It can integrate with environmental monitoring systems, UPS HVAC etc. It can be used as the CMDB solution etc. If fine-tuned and looked after it can actually bring a lot of value for less.

Incentivized

• Threat analysis. It can correlate different events happening to detect a pattern or an attack.
• Dashboard provides a clean, single location to see what is going on in our environment.
• Up to date open threat exchange means everything new popping up out there is included and watched for in our environment.

Incentivized

• Log aggregation and analytics
• CMDB
• Device inventory and remote management .
• It can be used by Managed Security Providers who have multiple customers as it offers multi organization support .

Incentivized

• Creating custom rules is a bit complicated
• Reporting could be improved
• Agent has caused conflicts with a couple of our other applications

Incentivized

• Non-intuitive/unattractive user interface
• Too many features that will usually remain unused
• Very crowded (too many icons) portal
• The reporting feature is confusing, e.g. you have to click on the "refresh" button to get the result of your inquiry. The report generation process can be much easier, as the user interaction is not pleasant.

Incentivized

AlienVault OSSIM is far easy to use and manage - provided you know what you're doing. As any SIEM application, there is some background knowledge required in order to take advantage of the product's functionalities, such as the log correlation and analysis. Other than that, the application is quite usable and robust.

Incentivized

Everything is done through MSSP and installation pro services. Once those hours are burned up, then you're on your own without a lot of help. Typically the pro services hours aren't enough to get past 60 days and MSSP are hit and miss. We had a miss for installation helpers.

Incentivized

AlienVault OSSIM as the first experience with a SIEM is very fine, especially if your company is an SMB. Every SIEM shares some features in common with other products, features such as log retrieval and normalization. So if you stick with principles, you can learn other SIEM products as well. If your environment is not of a minimum size, LogRhythm might be overkill for your network, same with McAfee Enterprise Security Manager.

Incentivized

• OSSIM and the installers didn't really help us optimize at installation. OSSIM went without optimization for almost two years before that fact was noticed. I think this decreased ROI.
• Finding and researching incidents is much faster with all data available. Sometimes too much data, though.

Incentivized

• Other SIEM solutions were cost prohibitive at the time of purchase (2016).
• Just like any other SIEM, it helped draw a better picture of our current security posture.

Incentivized