AlienVault OSSIM (discontinued) vs. Trellix Helix

The most obvious scenario in which OSSIM is well suited is in a single office/home office (SOHO) or small business, in which budget is reduced but asset discovery and vulnerability management are greatly needed and appreciated. OSSIM is lightweight and free, so the real challenge to face is to hire or assign an administrator to manage and operate it, instead of any investment on an expensive appliance. Also, as resellers, promoting usage of OSSIM to customers charging for professional services for installation, administration, and maintenance (remember that OSSIM doesn't have official support from AlienVault) is a great asset for the organization.

Incentivized

Overall, we've had a great experience with FireEye Helix and would recommend it to organizations looking to improve their operational security. We've found Helix to be a great way to collect and analyze revenant security events and take action. Having a single pane of glass makes this process much more efficient. Prior to moving to FireEye Helix, we had different teams sending data to different applications, which resulted in confusion and critical data being missed.

Incentivized

• Threat analysis. It can correlate different events happening to detect a pattern or an attack.
• Dashboard provides a clean, single location to see what is going on in our environment.
• Up to date open threat exchange means everything new popping up out there is included and watched for in our environment.

Incentivized

• Detection of advanced threats.
• Easy integration with cloud resources and our existing security tools thus enhancing performance.
• Easy deployment with great threats intelligence capabilities.

• Creating custom rules is a bit complicated
• Reporting could be improved
• Agent has caused conflicts with a couple of our other applications

Incentivized

• Overly complex platform
• Multiple logins needed for various tools--leads to confusion
• Costs can add up

Incentivized

AlienVault OSSIM is far easy to use and manage - provided you know what you're doing. As any SIEM application, there is some background knowledge required in order to take advantage of the product's functionalities, such as the log correlation and analysis. Other than that, the application is quite usable and robust.

Incentivized

Everything is done through MSSP and installation pro services. Once those hours are burned up, then you're on your own without a lot of help. Typically the pro services hours aren't enough to get past 60 days and MSSP are hit and miss. We had a miss for installation helpers.

Incentivized

We've been fairly happy with FireEye Helix support overall. Most issues are resolved the same day the case is opened.

Incentivized

AlienVault OSSIM as the first experience with a SIEM is very fine, especially if your company is an SMB. Every SIEM shares some features in common with other products, features such as log retrieval and normalization. So if you stick with principles, you can learn other SIEM products as well. If your environment is not of a minimum size, LogRhythm might be overkill for your network, same with McAfee Enterprise Security Manager.

Incentivized

It offers extensive visibility thus easy detection of threats and easy mitigation practices. Utilization of its threats intelligence capabilities thus early detection of incidents and maximization of security investments. Offers great integration of cloud resources with existing security tools thus ensuring seamless performance and all-time security for the organizational resources.

• OSSIM and the installers didn't really help us optimize at installation. OSSIM went without optimization for almost two years before that fact was noticed. I think this decreased ROI.
• Finding and researching incidents is much faster with all data available. Sometimes too much data, though.

Incentivized

• Helix has had a significant impact on CSOC visibility efforts across the organization.
• Helix fills the logging and alerting gaps that are missing across the infrastructure side.
• Having a single pane of glass allows teams to more efficiently run incidents. Additionally, Helix is integrated with ServiceNow providing enhanced and efficient case management for all Helix alerts.

Incentivized