Alert Logic MDR Reviews

Alert Logic MDR is a cloud-managed service that removed the need for an on-premise dedicated person to constantly review logs and determine if an issue existed. The main users have found it to be an excellent tool, saving both cost and time.

The features are very lightweight, with small installations that leave almost no footprint on systems. System resource utilization is minimal.

Alert Logic MDR has positively impacted my organization through its decentralized pricing approach, which has protected against several viruses. Any virus stopped represents money saved. There is low impact on users, so they do not experience slowness on their computers when scanning.

Alert Logic MDR has improved security in my organization from 50 to 65%.

When creating an external ID, there are occasional delays.

I switched to Alert Logic MDR mainly because of the features and because it is very cost-effective.

The override system for false positives is very simple and easy to use. If a program triggers a flag, it is straightforward to tell Alert Logic MDR to leave it alone network-wide, which is helpful for updates.

Alert Logic MDR has positively impacted response times and team workflow by sparing additional tasks and providing more time to focus on other productive areas.

When beginning to learn Alert Logic MDR, the software appears complicated and sophisticated. However, after initial use, it becomes clear that it is not as difficult as it initially seems. The software requires focused attention to understand its functionality. At some point, certain vulnerabilities cannot be solved, which may create concern about system activity. In reality, nothing problematic may be occurring in such cases.

I rate this product 9 out of 10.

Our client selected Alert Logic for the Voluntary Management model. We used it for return parameter management three sixty. Our team, consisting of around four to five members, along with two or three members from the client, used the TVM Model or the preprocessing management model. The client also set up a physical appliance in their environment, although I am not certain whether maintaining it was the responsibility of Alert Logic team or our client.

The standout features of Alert Logic included the topology feature, which was helpful for mapping assets on the network, giving a clear understanding of all connected devices. It also performed real-time scanning of assets. Furthermore, Alert Logic was up to date with new vulnerabilities, quickly adding them to the database.

One major missing feature was the ability to see if vulnerabilities were exploitable, which required extra effort for us. Alert Logic did not adhere fully to the CVSS standards, offering only high, medium, and low categories rather than the detailed CVSS scale. Additionally, the reports were very basic and required considerable work to finalize.

I did not use many products from last year, July to now.

I did not face any issues during the four-month duration that I used Alert Logic. It was stable without server or client errors.

Although I have no specific details, the solution was scalable and we did not face any lagging issues.

We knew that we had an option to raise tickets if we faced any issues with the product, but during the four-month duration, we did not face any such issues.

The client had taken care of the deployment and product choice. We were service providers only.

I would definitely recommend Alert Logic because it is a good product that constantly adds new features and changes interfaces. If you spend time to understand the product, it can be put to good use. The licensing was managed by our client, and while I cannot recall how it was structured, we did not have any lagging issues. Based on my short experience with only one module, I would give Alert Logic a rating of seven.

My main use case for Alert Logic MDR was investigating all cloud assets and generating alerts when issues or attacks were detected, whether DDoS attacks or other kinds of security attacks. Alert Logic MDR was detecting and identifying where attacks were originating.

I recall a previous instance when there were numerous attacks coming from one particular country using different IPs. Those were Chinese IPs, and when checked on VirusTotal and other sites, they were blacklisted. We put a firewall rule and placed all of them in blacklist mode for those IPs.

The best features Alert Logic MDR offers include not only detecting incidents but also providing details about where any incident is coming from. You can integrate those with your ticketing tools, such as ITSM or ServiceNow, which is a good feature.

The integration with ticketing tools such as ServiceNow helped my workflow by automatically creating a ticket and sharing it with the required team as soon as a critical alert is generated. Alert Logic MDR has a feature for critical and high-level incidents where a ticket is automatically created and shared with the required team for investigation. This helped in achieving a faster response before any major incident happened.

Alert Logic MDR has positively impacted my organization as it has helped in detection of incidents and responding through our security team, who work around the clock. Alert Logic MDR has reduced security response time for us and helped in detection. When we need to deep dive for any incident, Alert Logic also provides many helpful areas which assist in deep-dive investigation. That is beneficial.

I think Alert Logic MDR could be improved. If Alert Logic MDR not only detected incidents but also allowed us to block those incidents or isolate any affected asset, that would be beneficial.

I have used Alert Logic MDR in my previous organization for around two years.

I do not have anything else to add about my use case with Alert Logic MDR. I do not want to add anything about the features. I do not want to add more about needed improvements or any challenges I faced.

Regarding Alert Logic MDR's AI capabilities, I have not used that AI capability. At that time, AI capabilities were not evolved yet. If there is anything specific about it or any documentation related to that, I will definitely go through with it.

Regarding Alert Logic MDR's AI capabilities, I think the accuracy and reliability of output is the same because when I used Alert Logic MDR, there was no AI feature at that time. It has just launched now. I need to go through with it, and I have not used it, so I cannot say anything about it.

I do not think there are any improvements needed for Alert Logic MDR that I have not mentioned. I would rate this solution a 9 out of 10.

Alert Logic is a highly mature managed detection and response XDR service that has been under development for more than 22 years. It's a comprehensive solution with all the essential XDR elements and the latest technologies, such as artificial intelligence and machine learning. I recommend deploying Alert Logic for all kinds of customers in the public and private sectors, including utility companies, financial services, government, etc.

Alert Logic offers total visibility into the client's IT ecosystem. The solution's intrusion detection system inspects 100 percent of the network packets and installs universal agents on all physical and virtual servers for log collection. Alert Logic also aggregates logs of the client's various 3rd Party security tools into a single pane of glass. 

All of the analytics from those data feeds got to a 24/7 SOC with sophisticated resources. Alert Logic has massive threat intelligence resources to provide additional context to the incident response declarations. They do all the heavy lifting for clients who lack the technology and resources to operate their own SOC. 

The client is solely responsible for the incident response component. The macro analytics resides on Alert Logic's cloud. You have the ECM response and business application team on the client side.

Everything works in tandem, which is the only way you can deal with the advanced threats we face today, especially the ransomware families. If you don't respond in minutes, you're in trouble.

The most valuable aspect of Alert Logic is its optimized technology platform. They have SOCs in the US and Europe, giving them global visibility of the threat landscape. They detect and respond to threats in an average of 6 minutes. Their biggest value is human expertise. You're being attacked by a human, and you cannot respond to it unless you have a human on the other side. They have the human and technological resources to respond.

Alert Logic should also develop an EDR that is natively integrated into their XDR solution eliminating the costly 3rd Party EDRs. Currently, a client must buy another EDR solution like SentinelOne, CrowdStrike, or Sophos. I think Alert Logic is developing this. A built-in email with AI security could also be developed and integrated into their holistic MDR platform.

I have been an Alert Logic reseller for 3 years.

I rate Alert Logic 10 out of 10 for stability.

I rate Alert Logic 10 out of 10 for scalability.

I rate Alert Logic customer service 10 out of 10.

Positive

Yes SecureWorks. Swithched for increase depth/visility, integration of multiple services in one console and compliance reporting as added value.

The implementation is pretty straightforward. You immediately gain visibility as soon as you install the IDS appliance, deploy the agents on the servers, and start collecting syslogs. However, you need to take some additional time to fine-tune and optimize the platform and all the devices. It takes about four to six weeks to get results and around three months to optimize the platform monitoring service.

Implemente via Alert Logic's PM, Security Engineers and Securty Architects. Very smooth. Important to note they have a post implemetation process that includes Engineers from UK and a Pen Test. Very Important to validate your security posture...

Alert Logic offers a very high ROI, over 500%

Alert Logic's license is one of the most competitive. They deliver a high-quality service for a competitive price. 

I evaluated Deepwatch and SecureWorks Alert Logic is more mature, with 20-plus years of development. While Deepwatch is a very advanced MDR, it is only about five or six years in the CMMI process. Alert Logic also has advantages in online compliance and security reporting. It covers several regulatory mandates, such as PCI, HIPAA, SOC2, etc. with automated compliance features, which is somewhat unique in the industry.  

I rate Alert Logic 10 out of 10. 

The use case for Alert Logic was to identify configuration issues related to security and cloud infrastructure.

Alert Logic provided value by offering a single dashboard that amalgamated various sources for performing specific activities.

As a corporation, your responsibility is to address the reported issues, and Alert Logic did its job in this regard. A product such as Alert Logic provides you with the necessary information, and the effort behind it is to have a process in place that allows you to fix the reported issues. Although the solution does not have many features, it shows you what is wrong in various categories, and it is up to you to go and fix it. You can then mark it as complete or incomplete or leave a comment. No additional features are required for the solution to serve its intended purpose. As a user involved with the user interface, I believe there is a need to continue improving it based on feedback from our customers.

Though not currently utilized within my company, I have recently used the solution as a user responsible for its maintenance. Additionally, my company was a customer of this solution.

The solution was consistently available, and I cannot recall any instances where it was down.

Since it solely manages logs, the solution can scale efficiently.

I never had the opportunity to communicate with technical support or order support, so I am not familiar with their services.

I was not involved in the setup process.

I am unaware of its cost.

The solution was user-friendly, and I would rate it an eight out of ten. Our company needed one or two individuals to maintain the solution, which was not difficult and required minimal maintenance. Overall, I would rate the product a seven and a half to eight out of ten.

It could help us report all the logs and everything and serve as the main SIEM tool we use before escalating tickets.

Like any other tool that can process large amounts of data, Alert Logic allows me to feed it with a lot of data. What sets Alert Logic apart is its cloud-based and GUI-focused approach. While I still have on-premises appliances, I can remotely monitor everything from the cloud, and Alert Logic's ease-of-access features have helped me streamline my workflow and reduce implementation time.

When I was using it, I think the valuable feature was the ability to monitor the Ada environment and detect heuristic threats such as brute-force attacks. It could differentiate between legitimate user behavior, such as a user forgetting their password and repeatedly trying to log in.

My main issue with them was the constant need for meetings to discuss developing the API model we needed. It felt like we were always in and out of meetings trying to figure it out. It would be great if they could create a more user-friendly experience, like a drag-and-drop interface or a website builder, where clients could build their own API without needing access to the back end.

Let me choose the specific tools I want to use and be able to set a price for each of them. Maybe I don't need the entire package in my environment, but I really just want the IDS/IPS. I don't like Splunk or one of the other providers, like Rapid7, who don't work well for me in my environment. So, I suggest having packages for small to medium-sized businesses, even if the primary focus is on larger companies.

I have used Alert Logic in a couple of environments as our IDS/IPS system, attempting to model it for anything that could come through the environment. That way, it provides us with all logs and everything we need. I am a customer of the solution.

The stability of Alert Logic has been pretty good. Our company has continued to use it even after the initial deployment, and there have been attempts to use other setups as well. Additionally, I have had other teams use Alert Logic since then, and overall, it has been a reliable choice.

Once the setup was complete, scaling was very easy. It was a simple process, and the scalability was impressive. If we had been setting up new systems instead of retrofitting old ones, deploying the product with scalability in mind would have been even easier. Over 9,000 users in my company are using the solution.

We were in constant communication with Alert Logic's technical support team, depending on whether we needed to add extra calls or if there was something else we needed help with. It wasn't too difficult to work with them. I rate the technical support a ten out of ten.

Positive

Previously, we used Splunk, Rapid7, and a few other solutions. Alert Logic was cheaper at the time, and it had better customer support. It seemed like they were really focused on gaining customers during that period.

I have experience with setting up Alert Logic's appliances and feeding them the right data, modeling the system, and ensuring that the rest of the team can use it once it's up and running.

The setup process was complex. We needed assistance from the Alert Logic team because the IT environment was spread out, and there were multiple teams involved. We had to work with a liaison between those teams to ensure that we could install everything correctly. We had to bring in the network teams, system administration teams, and other relevant teams to ensure that everything was properly set up, which made the process complex.

The deployment process lasted for about two months. It took that long because we wanted to ensure that we tested the product fully in a developer environment before going forward with the actual deployment. In the deployment process, we had about fifteen to twenty people internally from our team, and the Alert Logic team was maybe about three to five.

The setup process was somewhat lengthy and took longer than I would have preferred, so I would rate it a seven on a scale of one to ten, where ten is the best. However, I believe that the delay was caused more by our internal site issues than any shortcomings on the part of Alert Logic.

Price of the solution was very reasonable considering the size of our organization at the time, and so it worked out perfectly.

I recommend setting up Alert Logic and being ready for a complete migration rather than trying to retrofit it. If you plan to incorporate Alert Logic into your environment, it would be best to do so during a refresh cycle when everything is pre-done, and you don't have to go back and install appliances and allow rules. Doing it during a refresh cycle would likely be easier, saving you time and resources.

The site seemed to be the main issue during the deployment process. Despite that, I found Alert Logic to be great with everything they had to offer. There were just a few minor critiques, but they were related to the site. Overall, I rate the tool an eight out of ten.

We use this solution for lag management and to protect our network. We are customers of Alert Logic. 

The value of Alert Logic is that everything is in one dashboard; I'm notified when there's an incident, kept up to date and advised on what steps to take. The solution has good intrusion detection. 

It would be great to see more of an endpoint protector. I'd also like to be able to send commands to firewalls which is something the old UI had but the new one does not. For example, if I wanted to block an attack I used to be able to send a command to the firewall but that is no longer possible. 

This solution is very reliable. 

I've scaled this product and haven't had any issues. 

Technical support is great. They are very responsive and they know their product.

The initial setup was straightforward. We sent them what needed to be done, and the environment was already up. To get the implementation sorted took about a month. Documentation is readily available and helpful. 

Licensing is on an annual basis. The price could be better and I know that Alert Logic is more expensive than other solutions on the market.

It's important to know the product and make sure the right rules are in place. The configurations and alerts are really important.

I rate this product an eight out of 10. 

We are primarily using the solution for an e-commerce company.

The application is deployed in multiple countries, and therefore the servers are very huge servers. Sometimes, at the same time, there will be 40 to 50 or 100 nodes also. For our application log, for example, if any request goes to any particular node, and we don't know which we can look at the node's logs in Alert Logic. We will just simply mention our order ID or whatever text we are searching for, and it will tell you which node it is. If it is an XML format, you will get a complete XML in a short time, instead of going to the PuTTY, connecting to the node and getting the XML, fetching everything, and wasting your time. 

We have used other solutions, such as Splunk, and in comparison, this solution is very user-friendly and there is less confusion when you are using the app. It's faster. You can configure more than 100 nodes and you'll get all the speed and accuracy you need.

The searching aspects of the solution are very valuable for our organization.

The reporting on the solution is quite useful for us.

The log messages and session logic are excellent. As an engineer, it's very useful to get the logs immediately if any production issues arise. We have everything we need to troubleshoot at our fingertips.

The initial setup is pretty straightforward.

One pain point we have, for example, is if the search keyword is related inside an XML, we will get an XML. If it is a normal log, however, you will get a null pointer exception or something, and we don't get the complete trace. We will just get a few lines only. It would be ideal if we could get a complete trace. There just needs to be more transparency around error tracing. 

We'd like to have triggered alerts sent to us so we see errors quicker.

I've been using the solution for three years at this point.

The stability is great. There are no bugs or glitches. It doesn't crash or freeze. It's excellent overall.

The solution is extremely scalable. If a company needs to expand it, it can do so easily.

We have about nine or ten people using the solution currently. They are mostly engineers, including support engineers and senior support, system reliability engineers, production support engineers, and technical engineers.

Although I'm unsure of the company's long-term plans, we could easily increase usage in the future.

Technical support has been amazing. They are very supportive and helpful. We are quite satisfied with the level of support on offer. If we have issues we just reach out. We have dedicated support, however, we rarely have any issues with Alert Logic. Whenever we migrate to Microsoft Azure Cloud or something, we may have to get assistance, however, apart from that, we really rarely need them. Of course, if we do, we know their response is immediate and quick.

We did not previously use a different solution.

The initial setup isn't too difficult. It's pretty straightforward. An organization shouldn't have too much trouble with the setup.

The deployment is very fast. It doesn't take too much time at all. It's likely less than five minutes. Honestly, it's almost instantaneous.

There is no mapping. Once you're done with the customization you can use it. It's not time-consuming. The customization part is based on whatever keywords and attributes you are adding, and that's less than a minute of time to handle. There is no time consumed. You just need to add to a filter.

You don't really need to worry about having too much maintenance. It's not required really. Maybe once the log is full, you may require a maintenance checkup of six months on. We have a server team that manages that aspect.

We pay for licensing on a yearly basis. However, I don't handle the payments. I'm not in charge of billing. I can't speak to the exact costs of the solution.

We are using the latest version of the solution at the moment. I do not have the version number on-hand, however.

I would recommend the solution to other organizations. It's been a positive experience for us overall.

I would caution that, in the beginning, people who are first-time users, will find it a bit complicated. They will easily learn quickly once they started using that. It's a very easy process to get habituated to. 

I've been a production support engineer for the past 10 years. In only the last three years I've been using Alert Logic. Previously, I have faced a lot of problems finding the logs. This solution helps me a lot. There are so many times it's helped to identify the root cause - and quickly.

Overall, I would rate the solution at a nine out of ten.

In the most recent instance, I have used Alert Logic to monitor the architecture for an IT software company. I am an IT consultant by trade, and I was contracted to design and support the infrastructure for a SaaS company.

The lead database administrator felt that there was a need to have a particular port open for the application to communicate and gather data effectively. That particular DBA and I were not in agreement over the potential risk of this open port. With the use of Alert Logic, I was able to prove factually that having that port open was a great risk. Because of it, we eventually closed the port and changed the design of the app.

Notifications and the detail of notifications are most valuable. It is a user-friendly solution.

Its menu is not very intuitive. I would like to see the user menu expanded a bit. The user menu is very layered, and because of the layers, you have to go down a path that is not very intuitive.

It is extremely reliable. I have also used it in other environments and situations.

It is extremely easy to scale. I've expanded it in the latest use case and previous use cases.

Only two people are using it. One is the owner of the company to confirm the security of the environment. I monitor the environment and make certain that we're secure. This product is being used in 100% of the environment, so there are no plans to increase its usage because we can't.

I have called them up, and their team is very responsive and very thorough.

I have used other solutions. Alert Logic is very linear. It is very easy to follow the way it works. The other product was more complex and more confusing.

It was very straightforward. The installation took us maybe two hours.

We deployed it to all of our servers. We needed to build a virtual appliance, and that was actually the only pain point. The communication around that virtual appliance was not very clear, so I went down the wrong path only to discover that I had wasted some time, and it wasn't required.

I did it myself with the assistance of an Alert Logic representative.

It does require maintenance but not in the traditional sense. The actual upkeep of the product and the upkeep of the agents fall to Alert Logic, but from time to time, the agent will send out an alert of failure. These failures need to be investigated. Ten times out of ten, they were false failures. They raised an alert of a failure of the product, and the investigation proved that it hadn't failed at all.

The return on the investment was not exactly tangible. It was in the redesign of the application and the ultimate security of that application. It was an intangible return on investment in that it took away the debate between people's opinions and gave a fact. Based on this fact, we could then redesign the application.

Its pricing is very reasonable considering what you get for what you pay. There is quite a good value there.

Its licensing is also very logical. They've got the licensing price points at a reasonable level. It is on a monthly license but a yearly contract. There are no additional costs to the standard licensing fees.

My advice would be to go ahead with the product because it really is a very good tool that adds a lot of value. I would also recommend that the person implementing the product should have a very good working knowledge of IT infrastructure. I would say that IT infrastructure is more of a requirement than a background in IT security, and it certainly makes the process a lot more straightforward.

The biggest lesson that I have learned from using Alert Logic is that for the amount of money invested in the product, the sense of security and the tightness that it gives to the environment is a real selling point for clients.

I would rate Alert Logic a nine out of ten.

We use it to be able to review logs and the overall system help and learn on anything that we need to handle.

Our organization's issue is that we implemented it and kicked the tires, but we never put an administrator behind it to own it and do a whole lot for it. There were a couple of select cases that we found and acted on those alerts. However, for the most part, it's just a climbing number of alerts with nobody touching them.

We needed a better plan for implantation. If we put something out there, we have to have people lined up to look at it and admin it, then reap the benefits of everything it's telling us to act on it. If you're not doing this, you have good intentions, but you fell short.

We receive infrastructure security warnings from it. So, we know what is going on and what needs to be addressed, e.g., things that we didn't have somebody looking for. It shows us these automatically, using things like automated scanning.

This product needs to mature more. While it is a good product, there are some areas where it needs work. If this is a cloud service, I shouldn't have to tell them how to develop analytics to tell me this is what is going on. They should be able to do it. Over time, their own system should be able to identify, "This is something that is a continuous thing with a particular user or company." Or, I should be able to click on it being able to "ignore" it, dropping it completely. It should be smarter than what it is, and it is not.

It implemented pretty quickly. 

We have everything you need. It would typically take a lot other solutions weeks to set up. This set up within fifteen minutes, which is pretty slick, and it has a lot of different interfaces.

The installation and configuration were slick. After installing in 20 to 30 minutes, you can start provisioning access, so people can take a look.

I was not involved in the pricing and licensing.

Other solutions that we evaluated were Datadog and LogRhythm, but it is not an apples to apples comparison.

Alert Logic was not my choice. I implemented it, and said, "Here you go guys. Kick the tires."

We only use the AWS version.