Graylog vs. Trellix Enterprise Security Manager

If you already have a basic understanding of Elasticsearch and/or MongoDB, Graylog will be a great fit when it comes to log aggregation. It will be a decent option even if you don't have any experience but have the time and willingness to roll up your sleeves that learning those tools will require. Graylog supports plugins to extend functionality for things like SNMP traps, telemetry collection, and solar flares. As is the case with most software with plugins, if the core functionality for which you are looking (i.e. not logging) is based on a plugin, Graylog probably isn't for you. The majority of the plugins in the marketplace are developed by third-parties looking to solve their specific use case so bug fixes and new features are not a given.

Incentivized

McAfee is a good solution if you're in a medium/large company and if you're looking for a solution that can be customized and expanded. I also recommend if you have the most common log sources on your environment, since McAfee supports the major log sources (but lack a lot of small vendors). In my opinion, I wouldn't recommend McAfee for small companies, since it's not that easy to manage and maintain.

Incentivized

• The free edition is extraordinarily powerful.
• Log searching is quick.
• The web interface is sleek, and the install is relatively quick.

Incentivized

• McAfee Enterprise Security Manager has a large library of pre-made correlations that reduces the amount of work needed to make it functional.
• This is a core McAfee product that is still getting support.
• It has a substantial amount of compatibility and integration with other products.

Incentivized

• The graphs and visualizations are limited on the dashboard if there were more options it would be better for different kinds of data.

Incentivized

• If there is a requirement to integrate into other vendor products i.e. (log sharing) then this was very cumbersome.
• Integration of vulnerability scanning that is available in other vendor products would be a good addition.
• When integrating all of Intel's products a third party consultancy is usually required, where other vendor products can be configured without this additional cost.

Incentivized

From a product perspective, it's an 8.

I am still unhappy with the pricing model for the enterprise. Graylog competes against the likes of IBM and Splunk, but your still the new kid on the block. To price Graylog enterprise at 50k for 20GB ingest an unrealistic data. It would require multiple facets of Graylog to be stood up and only forward pruned logs to the paid version.

Incentivized

Dealing with the McAfee support is a lottery. Sometimes you reach them and it's a really experienced engineer, but sometimes it's a person with no clue on the tool. We had few cases where our internal engineers knew more about the tool than the McAfee support. However, sometimes we get hold of some really good engineers that know the tool from inside out

Incentivized

Azure Monitor is not exactly what I mean, but I couldn't find Azure Application Insights. Anyway, for a large organization, Azure makes more sense than using Graylog because a lot of logging will already be inside Azure. And you don't want to have two "central" logging locations. But Azure is chaos and highly "not intuitive." So for small and mid-size organizations, Graylog is still the better option.

Incentivized

McAfee Enterprise Security Manager is a better option than other security software because it's both inexpensive and extremely effective. Norton and other security software boast a high price tag but don't always back it up when it comes to performance. With McAfee Enterprise Security Manager, I know I'm getting a quality product for a fair price.

Incentivized

• Able to offer monitoring services to new and existing clients to increase revenue
• Staff have increased billing percentage
• Potential to expand security services

Incentivized

• It effectively blocks potential attacks from outside.
• It aids us in doing more effective root-cause analysis whenever an incident occurs, since it gives us enough details to understand what went wrong.

Incentivized