Securonix Next-Gen SIEM and Microsoft Defender for Identity compete in the security information and event management (SIEM) category. Securonix appears to have the upper hand due to its advanced user and entity behavior analytics (UEBA) capabilities, which significantly reduce false positives through threat chaining, compared to Defender's noticeable need for improvement in false positive handling.
Features: Securonix Next-Gen SIEM is renowned for its powerful UEBA capabilities, threat chaining, and seamless integration with cloud applications. It provides accurate threat models and risk scoring that assist analysts effectively. Microsoft Defender for Identity excels in real-time threat analytics and offers seamless integration within the Microsoft ecosystem, enhancing its ability to provide comprehensive identity protection and threat detection.
Room for Improvement: Securonix's deployment is complex, and its feature set can be overwhelming for some users. Additionally, the integration with third-party services like ServiceNow requires improvement. Microsoft Defender for Identity needs to enhance its handling of false positives and provide more detailed alert data. Its high costs and complex licensing also deter smaller organizations from adopting it.
Ease of Deployment and Customer Service: Securonix is flexible in deployment options across cloud and on-premises, supported by a robust customer service team, although consistency varies. Microsoft Defender for Identity, as part of the Microsoft 365 suite, benefits from seamless integration with Microsoft's ecosystem, and its support is generally effective but has room for improvement, particularly with non-Microsoft systems.
Pricing and ROI: Securonix offers predictable pricing based on employee numbers, rather than data volume, providing value for large enterprises, though it may be costly for smaller ones. It significantly improves security operations efficiency, thus yielding a good ROI. Microsoft Defender for Identity, included in multiple Microsoft 365 plans, can be expensive without specific licensing like E5, but it offers strong ROI by improving security posture. The ROI timelines vary based on organization size and deployment needs.
The solution is time-saving, particularly in the long run after it is deployed, enabling us to get value promptly.
Generally, the support is more effective than other providers like Oracle.
The quality of support is very good, but troubleshooting can take time due to complex setups and the need to provide many logs.
The people I normally use for support are very knowledgeable, especially when they help remote in and get to where I need to go and show me much faster and help me understand what I should be doing.
There is no UK-based support, which leads to delays in waiting for US support.
If I raise a ticket, it initially goes to the L1 team, but the next level of escalation is really effective.
They excel in response times and quick reactions when there's an actual threat.
In a Microsoft-centric organization, especially with Azure infrastructure and Office 365, Microsoft Defender for Identity is scalable.
I can rate it around eight to nine, and it is very scalable and capable of handling tasks, especially for the on-premises product.
We have not had any customers come back to say they cannot scale at the speed of their business growth.
The solution is scalable as it is cloud-based and cloud-native.
Microsoft Defender for Identity is quite robust and built on Azure hyperscale infrastructure, with a 99% availability.
We do not see any issues with the stability of Microsoft Defender for Identity.
Having recently started using it, reliability is affirmed, but manual investigation is often performed to verify if alerts identified by auto-remediation are accurate.
The stability of Securonix Next-Gen SIEM is based on the events we are processing.
If Microsoft could develop a feature that indicates when impossible travel is caused by VPN connections, it would prevent unnecessary password resets and session disruptions, especially for VIP users in organizations.
One improvement I would recommend is the integration of an admin application within Teams, allowing easy access to attack information on a mobile platform.
Reducing false positives is something we've been working on with Microsoft.
At the admin level, we have many challenges where log parsing is causing issues and compatibility is not present.
The passing and setup are quite complex at the beginning, making onboarding not smooth.
SIEM could have better integration with other technologies.
If they can reduce the costs, organizations will be happy, and it will compensate for using the Azure environment, which is more expensive on the infrastructure as a service side.
Ensuring a fair price according to market standards.
From an organization perspective, using E5 licenses is value for money, especially if Azure and Office 365 are already in use.
Licensing is based on events per second (EPS), costing between $50 to $60 per EPS.
The solution is definitely not expensive.
The pricing has similar ingestion charges compared to other solutions, such as Splunk.
We receive an advance report of risky users, allowing us to take preemptive action before an attack causes damage to organization details.
The most valuable feature is its hybrid artificial intelligence, which gathers forensic data to track and counteract security threats, much like the CSI series in effect.
The advanced threat protection is one of the strengths of Microsoft Defender for Identity, as it utilizes user and entity analytics and can detect indicative attacks.
The software includes user behavior interactions, dashboards, and training capabilities.
Now, the process is automatic, reducing our workload.
The other SIEM solutions lack an option for big data analysis, whereas in the Securonix Next-Gen SIEM, we have this option.
| Product | Market Share (%) |
|---|---|
| Microsoft Defender for Identity | 11.1% |
| Securonix Next-Gen SIEM | 1.9% |
| Other | 87.0% |
| Company Size | Count |
|---|---|
| Small Business | 8 |
| Midsize Enterprise | 4 |
| Large Enterprise | 14 |
| Company Size | Count |
|---|---|
| Small Business | 10 |
| Midsize Enterprise | 5 |
| Large Enterprise | 19 |
Microsoft Defender for Identity offers real-time threat detection and protection for hybrid Active Directory environments. It integrates with Microsoft 365 components for seamless security and monitors advanced behaviors, enhancing identity protection across cloud and on-premises environments.
Microsoft Defender for Identity provides detailed threat insights and user behavior analytics to detect unauthorized access and notify anomalies. It allows setting custom detection rules, enhancing threat response automation. While it needs improvements in cloud security, SIEM integration, and access controls, users leverage its ability to mitigate identity threats like suspicious logins and ransomware. Enhanced integration with Microsoft security products ensures a coordinated threat response for identity control and privilege management.
What are the key features of Microsoft Defender for Identity?In specific industries, organizations implement Microsoft Defender for Identity to secure on-premises and hybrid Active Directory environments through user and entity behavior analytics, malicious activity detection, and integration with Microsoft security tools. This approach enhances security posture assessment and helps mitigate identity threats like identity harvesting and unauthorized access.
Securonix Next-Gen SIEM is a security information and event management solution designed to provide advanced threat detection, response, and compliance capabilities. It leverages machine learning and big data analytics to offer a comprehensive security platform for modern enterprises.
Securonix Next-Gen SIEM utilizes advanced analytics and machine learning to detect complex threats that traditional SIEM solutions might miss. Its architecture is built on Hadoop, enabling scalability and the processing of large volumes of data in real-time. This allows organizations to gain deep insights into security incidents, prioritize threats, and automate response actions. The solution also includes behavior analytics to detect insider threats and unknown attacks, integrating seamlessly with existing IT infrastructure.
What are the critical features of Securonix Next-Gen SIEM?
What is the ROI expectations?
Securonix Next-Gen SIEM is implemented across various industries, including finance, healthcare, and retail. Its flexibility and advanced analytics capabilities make it suitable for environments with complex security needs. In finance, it helps detect fraud, while in healthcare, it ensures patient data security. In retail, it protects against data breaches and payment fraud.
In summary, Securonix Next-Gen SIEM offers advanced threat detection, scalability, and integration capabilities, making it a robust solution for modern enterprises.
We monitor all Identity Threat Detection and Response (ITDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
