Securonix Next-Gen SIEM Reviews

We are using it for monitoring firewalls, Windows operating systems, some Linux operating systems, active directories, and some of the solutions in the cloud such as Office.

In terms of deployment, everything is in the cloud. Our licenses are on the cloud. We don't deploy anything on premises except the RIN.

We are a managed service provider, and we offer this service to third-party clients. Most of our clients are very happy with the solution. We can detect a lot of threats, which are not false positives, and we can describe the threats very well. A lot of information can be obtained from this SIEM, and we can provide very good incident reports to our clients.

We were using another solution previously. The other solution couldn't compete with the features and functionality that we were looking for as a managed service provider. Some clients ask for specific features, and we couldn't complete those needs with other products. They were more about calculations, such as events per second (EPS). With Securonix, it is easier to sell the product and make quotes for our clients. It has helped us a lot at the administration, commercial, and operation levels.

It provides actionable intelligence on threats related to our use cases. It can detect violations and reduce false positives. This actionable intelligence is one of the most important parts because we have suffered with some of the other solutions in terms of receiving a lot of events and alarms where most of them were false positives, which made it a bit difficult for us to investigate and generate incident reports. Securonix is handy for engineers and the security operations center.

Its analytics-driven approach is pretty good at finding sophisticated threats and reducing false positives. When it comes to monitoring network devices, such as firewalls, it can detect behaviors that would be difficult for other solutions to detect or for normal engineers to detect manually. It has a lot of violation policies, and it is very handy and helpful at this level.

It adds contextual information to security events, which is one of the most important points. We can fill a lot of information into our reports for our clients.

Everything is saved for us and indexed. We can review any event we need within three or six months. We can review even when the data is in the cold phase. We never faced any case where we lost any event data. When clients asked about some events in the past, we could find them very easily and without any issues by using the queries.

It improves analysts' efficiency to do more with less time. Spotter is one of the best tools for me for searching and visualizing various things such as policies. With the Spotter language, you can search for whatever you need. You can search for any endpoint, any IP, any hostname, or any violation name. Even though it is not very fast, it is fine for us. Splunk or Elasticsearch is faster than Securonix because this is their job. Even though Spotter is not as fast, it has been helpful for us.

The detection of threats and reduction of false positive alarms as compared to other solutions are valuable features. It has improved threat detection response and reduced a lot of noise from false positives as compared to our previous SIEM solutions. This was one of the reasons we decided to try or move to Securonix. Other products generated thousands of events, and a lot of them were false positives, which made it difficult for us to handle all the events. For example, we were monitoring a firewall internally, and that firewall generated about five million events per month. The previous product detected almost 1,000 to 1,500 events as positive events, whereas Securonix generates less than 200 events, and most of them are not false positives.

It can integrate with a lot of solutions. Being able to ingest all our log sources when investigating threats is one of the good points of Securonix. After we started to use Securonix, we could integrate a lot of solutions, which we couldn’t do previously. It works with many devices, platforms, and cloud solutions. It is pretty good in terms of integration.

The incident response area should be improved.

It is more difficult than other products, but overall, it is good. The platform has a lot of options and functionality. So, you need to check almost everything. For new engineers or people who don’t have much experience with this kind of platform, it is a bit difficult, but for experienced engineers, it is not that difficult.

When you have been doing a lot of work for about one or two hours, and you have a lot of tabs open, it slows down or gets stuck. There is a delay of 10 to 15 seconds in opening tabs or dashboards. I don't know why this happens, but for me, it is not a big issue. I just wait, and that's all.

I have been using this solution for one year.

It is stable, but it slows down or gets stuck when you have a lot of tabs open.

Overall, it is scalable, but when you are investigating a lot and you have a lot of tabs open and are involved in big work, it sometimes becomes slow or gets stuck.

In terms of its users, our SOC team has three engineers, and I am the fourth one. We have three clients for now for Securonix. We use it internally to monitor our company. Overall, there are five or six users using the interface, investigating, and reporting to the clients.

Most of the time, their support is very good, but sometimes, we had to escalate the issues. Sometimes, we opened a ticket, and we immediately received an answer for fixing the issue, but at other times, we got a response after one, two, three, or even seven days. I guess it is based on the impact or severity, but when we have an urgent issue or problem, Securonix solves it very fast. I would rate them an 8 out of 10.

Positive

We were previously using Splunk, and we wanted to continue, but when we did the evaluation, we found Splunk to be more difficult to implement than others. It is fine to operate it, but its implementation is more difficult. It also had fewer features than Securonix. Securonix is dedicated to security information event management, but this is not the main functionality of Splunk. Even though Splunk is very strong in security, and we have been using it, when it comes to, for example, machine learning, Securonix has pre-configured policies. So, we don't have to spend that much time, whereas when it comes to Splunk, we have to configure everything. We have to install the applications and configure the dashboards. Considering the functionalities, features, and pricing, we felt that Securonix would be the best option.

It is better than previous solutions in terms of threat investigations and onboarding. That's because most of the other solutions are based on rules. Sometimes, there is no intelligence when it comes to detection, whereas Securonix has policies that are a collection of rules. Securonix doesn't only extract the log and tells us that it is a low-impact event or informative event. It also tries to correlate most of the events according to the policies and takes us to the main point. This is how Securonix has helped us to reduce a lot of false positives. Other solutions only worked with rules, and they only sent us events. We had to review most of those events, which is not the case with Securonix. It has a lot of policies for all types of detections. There are almost 1,000 policies, and Securonix can correlate various types of behaviors and pieces of evidence to detect advanced threats. It is good at this level.

We have the cloud license of Securonix. Everything is on the cloud. We only implement RIN on-premises, which is straightforward. You just download the executable, give it permission, and execute it. You provide the information it asks. There are a few packages that you need to install previously, but overall, it is very handy and straightforward.

I implemented it on my own. 

Its price is fine. We found it to be cheaper than LogRhythm, Exabeam, Splunk, as well as Elastic Security. A few months ago, when we were comparing Securonix with Elastic Security, we found Securonix to be cheaper than Elasticsearch. We were pretty surprised that Elastic Security is more expensive than Securonix because Elasticsearch is just starting, and it cannot compete with Securonix at this time. So, the pricing of Securonix is pretty good for now.

We tried to evaluate some of the other products, but we decided to go with Securonix for the business part. It was easier for us to meet the needs of our clients related to calculations.

We evaluated LogRhythm. The first problem that we faced with LogRhythm was that it would have been pretty difficult for engineers to handle in terms of the user interface. As compared to Securonix, it was also very expensive. Securonix had most of the features or functionalities that we were looking for. We also evaluated Exabeam, and we had the same problem with the price and features.

It has somewhat reduced the amount of time we require for investigation. It hasn't probably helped in detecting advanced threats faster along with lower response times because there is this gap between the RIN receiving the information and then sending this information to the cloud. This gap makes it a little bit late as compared to other solutions. Other than that, it is good.

I would rate it a 9 out of 10.

We mostly use it for user-behavior analytics. It is used for all the behaviors related to users. In terms of the environment, there are multiple connections at different sites and locations, and there is also integration with other platforms. For some endpoint use cases, I have to do integrations with different customers who already have the platform.

Its deployment is hybrid. The cloud providers are Amazon and Google Cloud Platform.

When we have an endpoint threat, we have to move very quickly. We detect it through another tool that is associated with Securonix, and automatically the endpoint is isolated from the network. We also get some information for investigation and forensics allowing us to understand the type of threat. We get to know whether it is related to the endpoint or user behavior. We can get information on web-application firewalls and other solutions connected to Securonix, which allows us to understand the depth of the threat for a specific use case.

It provides actionable intelligence on threats related to our use case. After the alerts, we can isolate the endpoints and make some modifications. We can also do some searches about the related IP on the internet and intelligence platforms. That's very nice.

This actionable intelligence is pretty important. When we integrate different platforms, Securonix provides a lot of visibility and allows us to see the whole environment, not just a part. I have been working mostly on the endpoint side, but other people who are working on wider use cases can see all the dashboards and improve the security posture with Securonix.

Its analytics-driven approach to finding sophisticated threats and reducing false positives is very important. With other similar tools, we have to work a lot to reduce or manage false positives. We have to improve the rules and integrations because there are a lot of false positives. With Securonix, we have fewer false positives, and there is also automatic recognition for false positives allowing us to move very quickly.

It adds contextual information related to the use cases. My use case is very specific, but my partners and other teams get a lot of contextual information related to the whole company. It provides a lot of analytics related to a threat in terms of user behavior, environment, and target applications, such as databases, which is very important.

It has saved a lot of investigation time. As compared to other solutions, it has saved more than 50% time.

It has improved the threat detection response and reduced noise from false positives as compared to our previous SIEM solutions. The improvement in the response time is dependent on the scenario, but generally, it is about 40% more effective. When it comes to false positives, it is about 60% more effective.

It has been helpful in detecting advanced threats faster and lowering response times, but I don't have the metrics. 

Its console is very easy to use and configure. It is very intuitive for our use cases. App integrations are also pretty nice. 

It could be improved a little bit more for admin users. There should be more administrative options related to security for admin users. For example, for forensic purposes, the admin should be able to stop a specific user from erasing some information. I would be helpful in certain situations, such as during an internal fraud.

I have used it for two years separately, in 2020 and the last year, 2021.

Its stability is pretty nice because we don't have too many problems with it. The complexity is related to what we want to see. There are no issues with the performance. We have not experienced any performance issues when the solution is ingesting all of our log sources. 

It is 100% cloud. So, its scalability is pretty nice. We have all the capabilities and options to grow. Our environment has more or less four locations with about 1,000 devices. We don't have any plans to increase its usage in the near future.

I have had to call support three or four times, and I would rate them a ten out of ten.

Positive

I have worked with Splunk and LogRhythm. I am using Securonix because, in this company, most of our clients are using Securonix. So, I had to learn how it works and understand its architecture and capabilities. It is very easy to understand for anyone who has worked with similar solutions. It is 90% easier than Splunk, which has a lot of code. Securonix is very radical and intuitive.

I wasn't involved in its setup and onboarding process, but I would assume that it is very quick. That's because it is very simple to use for my use cases, and they have nice support and help.

Its maintenance is pretty lightweight. We have another team that is in charge of that. There are most probably two people who take care of SIEM and cybersecurity solutions.

Securonix cloud-native platform helps to minimize infrastructure management. It allows us to focus on threats versus engineering or managing the platform.

We have surely seen an ROI when we look at multiple threats that we have been able to prevent.

It improves analysts' efficiency to do more with less time. By using the contextual information that it provides, we can be more accurate in our investigation. It has saved about 30% time.

Its pricing is quite similar to others and is very competitive. The other solutions have different types of licensing, but when you do the math, it is competitive.

You should know your environment and connectivity requirements very well. You should understand the analytics that Securonix is providing for the team. You can make a lot of improvements based on those analytics.

I would rate it a ten out of ten.

We were using it for data loss prevention and data acceleration. We wanted a platform with a proper ticketing facility, and as and when we reviewed a user, we also needed a proper documentation setup. Securonix provided that. We were able to integrate playbooks and a lot of other modules so that we not only looked at a particular problem area but also at other factors. We didn't only want to look at exfiltration but also at any lateral movement inside the company by a user. We wanted to look at the outliers in a better way, not only in terms of a user's activity but also in relation to the peer activity to show that it is not a team; it is just a team member doing something wrong.

We most probably were using version 6.0.

It was very easy for us to do our manual threat hunting. We had a lot of instances where we found our internal users exfiltrating data. We were able to see that they were exfiltrating data. We could confirm that through the platform by taking a deeper look, which was very nice. It is user-friendly and handy. It allowed us to look at all kinds of activities and logs.

It provides actionable intelligence on threats related to the use cases. After you have done the configuration, it triggers an alert for any incident. This actionable intelligence is very important because it allows us to respond in time without missing the window of being able to take an action. Sometimes, threats are small, and the indicators do not pop up, but with manual analysis, we can get a complete view. So, it is very important to have real-time triggers.

We have been able to find a few true positives. Based on the triggers from the tool, we got to know that people have been exfiltrating data over a period of time. They had been doing it in small amounts, and that's why it went unnoticed. After the tool notified us, we discovered that one or two users have exponentially exfiltrated data over a period of time. Without the solution, just by looking at the logs, we wouldn't have known that. The tool understood the behavior and triggered a notification, and we got to know that. The users were not just sending our data to themselves but also to another vendor. They were contractors, and they were exfiltrating the data to another vendor. They were about to leave the company, and we were able to catch them before they left.

It reduces the amount of time required for investigations. If I had to check logs from different log sources or tools from different vendors and create tickets, it would have taken time. With SNYPR, we were able to perform a lot of actions within the same platform, and we were also able to push tickets to our SOAR management tool. Everything was in one place. We didn't have to navigate between different things. It was helpful for incident management. It took time for analysts to check whether an alert was a false positive or not and provide the right evidence. Having incident management within the tool reduced time in creating and closing some of the incidents. Instead of 30 minutes before, it was reduced to 10 to 15 minutes per incident. We didn't have back-and-forth navigation. Everything was in one place. 

It saved us a couple of hours of our day-to-day activity because everything was consolidated. Once I logged in, one or two hours were enough for me to look at everything and identify things to take an action on.

It has definitely helped us with threat management. Because of the sample use cases that we saw from Securonix, we were able to design a few of our own use cases. We would not have thought of those use cases in the past. We were able to add use cases that were helpful for our data internally. We were able to understand logs even better and create our specific use cases. It was good learning.

It is user-friendly. Its user interface is better than the other tools.

I like the playbook integration. In the beginning, we had a few hiccups because the tool was developing, but after that, the threat intelligence tool that we integrated got more accurate and better. The whitelisting and blacklisting of IPs, domains, or users were also working. 

Risk scoring was nice. We could exactly see which user had the highest risk score, and then we could pick it up and work on it. 

Securonix accommodates customer requests in the upcoming versions very well. They do their best to bring in the features required by a customer. We were able to have custom widgets for different departments or specific use cases. All tools do not provide such customization. Securonix was good at taking a request, reviewing it, and if it made sense, adding it. We got at least one or two features added. 

When they did upgrades or applied patches, sometimes, there was downtime, which required the backfill of data. There were times when we had to reach out and get a lot of things validated. 

I have been using this solution for about 2.5 years. Right now, I'm not using it, but I have used it in the last 18 months.

Initially, during patch management, we did see a few downtimes, which required a backfill of data. Before I moved out of the previous company, patch management and upgrades had improved, and the tool had become stable. The queries we were running weren’t breaking the tool. We were able to fetch reports for more roles and data as compared to when we started.

The company that I was working with was midsize. We didn't have a huge amount of data. We were accommodated pretty well. We didn't have any thresholds or limits, but I cannot speak for companies that have a huge amount of data. 

Their archiving and deletion policies also worked well for us. We didn't see any performance issues when the solution was ingesting all log sources. Its scalability was pretty nice. We started with six to seven data sources, and then we moved on to add a few more. It could easily accommodate any increase in the number of users or data. We didn't have to just stop at a particular point.

With on-prem, customers have control over the infrastructure, and they can tweak it, but a cloud solution is more simplified. You don't have the headache and overhead of maintaining your resources. So, it is definitely scalable. They partition you based on how big the company is. So, even if you move to a bigger scale, more resources get added to make it work better. It is seamless. We didn't have many issues. We had a few slowness issues at times, but they were resolved. We didn't have to deal with them for a long period of time.

Their support was pretty good. We didn't have any issues there. They were pretty fast. Anytime we had downtime or any issue, we were certainly helped. We got emails telling us how long it will take, and they would stick by it. There were a few times when there was a one-day or two-day delay in response, but eventually, it all worked out. We didn't have major issues. I would rate them a nine out of ten.

They also provide a review with their content team. For the initial few months, they did a lot of threat hunting and showed us why they think a user is doing something in the company and why it is something that is worth taking a look at. It was helpful to have analysts from their side and see how the users are doing it and what are the patterns.

Positive

I have only worked with this solution.

We had another engineering team that took care of its deployment. My involvement in its setup was only for providing the type of data that we need to pull into Securonix. Some log sources took a while in terms of the data format that we wanted and accommodating it with the APIs on the Securonix end. We only had issues with a few data sources. It wasn't a very difficult process, but it did take some time. It took about two months.

Overall, its onboarding was pretty smooth because we were on SaaS. In terms of the strategy, we had to provide the data sources that we needed. They were divided into three levels. We first integrated one or two data sources, and when we saw it triggering, we integrated a few more. We also worked on fine-tuning it for false positives with their content team. They trained us on various use cases and algorithms behind those use cases. If there was any incorrect trigger, they explained the reason for it. It did take quite some time to configure it for our own custom use cases. This phase took more time than the initial integration of data sources. It took at least two to three months to onboard all the sources.

Because it was a SaaS solution, they did the maintenance. It didn't require any effort from our end. It minimizes infrastructure management. In case of downtime or outage, they used to notify us and fix the issue. It did not require our intervention, except monitoring and checking if things are running fine.

They provided flexibility in terms of features and patches. If we wanted to stay on a particular patch or have a few features in the next version, they were able to accommodate that. They were able to add our features even when other customers did not need them. 

There were two people on the engineering team from our side, but I am not sure how many people were there from the Securonix side. For integration, two people were there, and then there were four analysts at the beginning to support the tool and give feedback.

We most probably did see an ROI. I was working only at the analyst level. I do not have the numbers, but it did improve the efficiency to do more in less time. In the beginning, we were hesitant to use a new tool, but it soon became our go-to tool for checking and verifying any issues. We started engaging with the tool quite a lot, and it probably saved four to five hours a day. Documentation and ticketing were the biggest challenges, and it helped in having everything in one place. We could just click on a ticket and see everything.

I had heard that it was much cheaper than Splunk and some of the other tools, and they gave us a nice package with support. They accommodated the number of users and support very well.

My team had definitely looked at other tools, but I was not involved in the PoC. 

I would advise having a look at it. The user experience or the user interface is definitely better than other tools, but you need to see how it interacts with your data sources and how easy it is to integrate it with those data sources.

It took us at least four to five months to realize the benefits of the solution from the time of its deployment. It depends on the log sources you are concentrating on and want to fine-tune. Most SIEM tools, including Securonix, have a lot of use cases that can be tied to Windows, VPN, etc. Modifying and tuning just one log source is not enough. You should tie different log sources so that you get an idea about any lateral movements. Everything that flows into a SIEM solution has to be tuned. If I'm sending a raw log in any format, it needs to be properly sanitized and tuned for my security requirements, which takes time. We had to go back and forth and get a lot of things fixed. It takes a while for the tool to understand and start triggering based on a specific activity.

False positives will always exist. They won't completely go away. When we first deployed it, it used to trigger alerts for 500 to 600 users, which had come down to 20 to 30. It needed continuous fine-tuning, but as an analyst, I was no longer overwhelmed by hundreds of alerts. It took a while to get to that stage and involved a lot of blacklisting and whitelisting. Even though the false positive rate had come down to a pretty good number, we still had to intervene and verify whether it was a false positive or not, but it was easier to do.

It hasn't helped to prevent data loss events, but it has helped to reduce further loss of data. We got to know about an event only when it had already started to happen. When the tool identified that something was happening, it would alert us. If an analyst was active enough to understand that and put a stop to it, it could have prevented any further loss, but I am not sure how much a data loss event would have cost our organization, especially in intellectual property. However, we figured out that about 40 to 50 GB of data was sent over a period of time. It was sent in small bits, and it included confidential reports, meeting keynotes, etc. We would not have known that if the tool had not notified us.

I would rate it a 10 out of 10 based on the experience I had. We didn't have any major issues related to slowness or querying the tool. Querying was pretty simplified, and there were also documents to know the processes. Their support was good, and they were also good in terms of the expansion of the tool. When we wanted a new data source, they were there to review it and modify it with us. They provided good assistance.

We have created correlation rules. When the condition matches, we get the alerts. We start analyzing the alerts and then create tickets for it in ServiceNow. We have also created dashboards in Securonix. If any breaches of data or unpredictable work is detected, it will show in the dashboard.

Securonix is a money-sharing tool. Its price range is very low compared to other tools.

The most beneficial feature is the option for a resource group name. We don't have to type the query specifically. We can select the resource group name or functionality directly of which type of security tool logs we want. We don't need to write the query for that; we just have to select.

I face slowness issues sometimes, especially when we write a query to search specific logs from the resource group. Apart from that, there should be GUI changes.

I have been working with the Securonix solution for eight to ten months.

Securonix is stable, yet sometimes there is slowness.

The solution is scalable.

We are not raising any questions with customer service or support.

Positive

I was using Splunk for six months.

The initial setup was straightforward, and I did not face any challenges.

For new users, it is good to use. For experienced users, they need fast query resolution; otherwise, it will be difficult for them to use. It does not require much maintenance.

I'd rate the solution eight out of ten.

From my experience, clients have been enjoying the product because it enables faster threat detection. We use it daily for hunting and developing strategies, which are much more extensive compared to the results from a traditional SIEM.

With Next-Gen SIEM, we are achieving more with less effort. We can gather more information from the logs and organize it in a different product view, which reduces the need for a large workforce. So we can achieve more with fewer people, and this is particularly advantageous in my line of work, where we need to hire additional staff as we sell more products. However, with this kind of solution bringing in more information about threats and improvements for the organization, we can handle the workload with fewer personnel.

The most valuable aspect is the ability to automate tasks, particularly user behavior analytics. It streamlines processes and makes it very efficient to work with, both for me and the users in my company.

I work in Brazil, and the solution is not very well known here. The market for technology in Brazil, not related to the quality of the product, is not very favorable yet. I see this as a challenge. We need to invest more effort in raising awareness and educating people about the product's capabilities. 

Additionally, one aspect that could be improved is the pricing of the product in Brazil. It is reasonable, but when compared to similar tools or products that are more common in Brazil, it tends to be a bit higher.

I started to use this solution about two years ago; my company started to work with Next-Gen SIEM.

To say the truth, neither I nor my colleagues who work with me have encountered any complaints about stability. As the leading company in Brazil for Securonix or the biggest seller of Securonix in Brazil, we have had no issues with stability up to this point. It has been very reliable, and there have been no instances of lagging, crashing, or any significant downtime reported.

The solution is highly scalable since it operates in a public cloud environment. This allows us to store and process a large amount of information as needed. The scalability is one of the remarkable qualities of this product, which makes it very effective, especially when we are dealing with substantial data volumes in the cloud.

Since I work in the sales team, I didn't need technical support. My role is mainly focused on discussing and selling the product to customers, highlighting its advantages.

So, if any technical assistance is required, it would be handled by the partner or someone else in the client-facing team. I have mostly been involved in the sales process, and I haven't had the need to engage with the technical support team.

I work with two options for Securonix. I use the Legacy and the Advantage versions. The Advantage option is beneficial because it includes the features of the Legacy version at the price of the Legacy package. However, it gets complicated when dealing with User and Entity Behavior Analytics (UBA) and other additional features. The EPS (Events Per Second) quantity grows significantly, leading to the need for more resources to handle the workload when using UBA and other advanced features. 

If Securonix aims to grow more and improve its position in the Brazilian market, it might need to consider adjusting its pricing to be more competitive. Currently, as we work with AI solutions, the price might need to go down to better grow its presence in the Brazilian market.

I believe in the quality of the product, so I would rate the pricing as a seven out of ten, where one is low pricing, and ten is high pricing.

When we talk about SIEM, it's important to understand how it brings the necessary information to the company and how we can apply the right intelligence to extract insights about threats and other relevant aspects. I suggest investing time to clearly define what you want to achieve with the SIEM solution. If you don't have a clear understanding of your objectives, the results may not meet your expectations. Take the time to thoroughly understand your requirements to make the most out of the system.

In my market and environment, I compete with Splunk, QRadar, and IBM. I've also heard about Hexabeam, but it's not a major competitor here in Brazil. Another one we're considering, which has posed some challenges, is Google Chronicle. However, the two biggest competitors for me are Splunk and QRadar.

When comparing Securonix to Splunk, one issue is the pricing; I believe even Securonix is on the higher side. However, in terms of working with cloud environments, Securonix has an advantage as it performs exceptionally well in the cloud. Unlike Splunk, which struggles in cloud setups, Securonix handles it perfectly. Additionally, in terms of crunching work in the database (DB), Securonix performs better and more efficiently than Splunk, making it a better choice for such tasks.

Other products seem to have a more established market presence, and people are familiar with them, but they might not be as acquainted with Securonix. However, I am confident about the quality of Securonix, and when I get the chance to demonstrate how it works, people tend to like it.

Furthermore, in comparison to IBM, I don't encounter any technical problems with Securonix. The quality of Securonix is solid, and I have no issues discussing its capabilities. When it comes to pricing, Securonix offers a more competitive solution. Even if it's only ten percent better than Splunk in some aspects, the overall value makes it a better option in the end. If the price difference is not as significant, it's more likely that customers will choose Securonix over other options.

Overall, I would rate the solution an eight out of ten. 

Securonix provides us with a fine-tuned environment. It helps eliminate false positives with certain parameters.

It is a SIEM that works automatically when it comes to behavior and the analysis of certain parameters that we did not have visibility into before. It is very productive for our business. So far, from what we have seen, Securonix is very useful.

Securonix provides "enrichment" of event information thanks to connectors with Third Party Intelligence and that has helped to make us more efficient in our investigations. Threat hunting that used to take two to three hours can now be done in less than one hour because we have certain graphs configured within the platform that allow us to search for more detailed events in a shorter amount of time. The training we have received has been absorbed quickly by our analysts and we have managed to do more in less time.

Another benefit is that, as a SaaS environment, it allows us to free ourselves from support issues. We escalate everything directly with Securonix.

Among the most valuable features are its

• reporting capacity
• graphics 
• UEBA analytics.

The UEBA functionality indicates a lot about behaviors that are not found through a traditional SIEM. We have exploited that more than anything since we started using it.

The autonomous threat sweeper also seems very good to me. It is a very striking and productive tool for our business. It's highly important to implement ATS because it allows us to scan for specific events that may happen.

Also, the ease of searching that the Spotter tool offers us is a welcome feature and the data insights have been very useful for our research work.

It seems to me that within Securonix there is no option for completely visualizing the types of sources or if there is any loss of logs. I've heard that they have an additional module to validate those types of cases, but in terms of the platform itself only, I can only see how often it sends data but not any specific detail.

I have been using Securonix Next-Gen SIEM for six months.

We have not had any major problems with the platform since we started working with it. There has only been one problem that had to do with something that did not load on the platform, but that was it.

We have had no problems ingesting all our log sources.

Being a cloud environment, it gives us unlimited scalability. When we have integrated larger sources we have not experienced any problems.

We have had some slightly delayed response times from technical support, but it is nothing out of the ordinary.

Positive

We use platforms such as RSA enVision, QRadar, and McAfee. We have not eliminated these platforms but we are more inclined toward Securonix because it provides us with UEBA analytics, which is something that we have not been able to exploit as much on other platforms. The solution's UEBA data analysis is what caught our attention.

I was involved in a certain part of the implementation that focused on the RING installation. The implementation was simple. They shared an interactive manual with us and there were no problems. Onboarding the sources was not such a complicated process. We needed three to five employees for the implementation.

They also provided guided training in which a representative from Securonix helped us with the queries we had.

Maintenance is mostly managed by Securonix. We are hardly involved in it.

More than anything, we have seen ROI thanks to the metrics we get from Securonix.

Securonix is very user-friendly and intuitive. In terms of nomenclature, it is very easy to understand where the information you want is located. Compared to other platforms, there are several UI qualities in favor of Securonix. It puts everything at your fingertips and the options tab is very accessible.

In terms of reducing false positives, we have not seen much difference between Securonix and other platforms at the moment.

Information about Securonix is all available within the online documentation and it enables you to get to know the platform independently. It is very beneficial if you're looking for a high-quality SIEM.

The most important thing I have learned by using Securonix is the exploitation of UEBA analytics. I had not seen that in another SIEM and it has been a definite benefit for me.

Foreign Language:(Spanish)

¿Cómo ha ayudado a mi organización?

Securonix nos proporciona un entorno optimizado. Ayuda a eliminar falsos positivos con ciertos parámetros.

Es un SIEM que funciona de forma automática en respecto a comportamientos y análisis de ciertos parámetros que no eran visibles antes. Es muy productivo para nuestro negocio. Hasta ahora, por lo que hemos visto, Securonix es muy útil.

Securonix proporciona un "enriquecimiento" de la información de eventos gracias a conexiones con Third Party Intelligence, esto nos ha ayudado a ser más eficientes en nuestras investigaciones. La búsqueda de amenazas que antes tomaba de dos a tres horas ahora se puede hacer en menos de una hora porque tenemos ciertos gráficos configurados dentro de la plataforma que nos permiten buscar eventos más detallados en menos tiempo. La formación que hemos recibido ha sido absorbida rápidamente por nuestros analistas y hemos conseguido hacer más en menos tiempo.

Otro beneficio que tiene es que, como se trata de un entorno SaaS, nos permite liberarnos de los problemas de soporte. Escalamos todo directamente con Securonix.

¿Qué es lo más valioso?

Entre las características más valiosas se encuentran..

• capacidad de reporte
• gráficos
• analíticas UEBA.

La funcionalidad de UEBA indica mucho sobre comportamientos que no se encuentran a través de un SIEM tradicional. Eso lo hemos explotado más que nada desde que empezamos a usarlo.

El barredor de amenazas autónomo también me parece muy bueno. Es una herramienta muy llamativa y productiva para nuestro negocio. Es muy importante implementar ATS porque nos permite buscar eventos específicos que puedan ocurrir.

Además, la facilidad de búsqueda que nos ofrece la herramienta Spotter es una característica beneficiosa y la información de los datos ha sido muy útil para nuestro trabajo de investigación.

¿Qué necesita mejorar?

Me parece que dentro de Securonix no hay opción de visualizar completamente los tipos de fuentes ni tampoco si hay alguna pérdida de logs. Escuché que tienen un módulo adicional para validar ese tipo de casos, pero en términos de la plataforma en sí, solo puedo ver la frecuencia con la que envía datos, pero ningún detalle específico

¿Por cuánto tiempo he usado la solución?

He estado usando Securonix Next-Gen SIEM durante seis meses.

¿Qué pienso sobre la estabilidad de la solución?

No hemos tenido mayores problemas con la plataforma desde que empezamos a trabajar con ella. Solo ha habido un problema que tenía que ver con algo que no cargaba en la plataforma, pero eso fue todo.

No hemos tenido problemas para ingerir todas nuestras fuentes de registro.

¿Qué opino de la escalabilidad de la solución?

Al ser un entorno en la nube, nos brinda una escalabilidad ilimitada. Cuando hemos integrado fuentes más grandes no hemos experimentado ningún problema.

¿Y el servicio de atención al cliente y el soporte?

Hemos tenido algunos tiempos de respuesta ligeramente retrasados por parte del soporte técnico, pero no es nada fuera de lo común.

¿Cómo calificaría el servicio y soporte al cliente?

Positivo

¿Qué solución usé anteriormente y por qué cambié?

Utilizamos plataformas como RSA enVision, QRadar y McAfee. No hemos eliminado estas plataformas, pero nos inclinamos más por Securonix porque nos brinda análisis UEBA, que es algo que no hemos podido explotar tanto en otras plataformas. El análisis de datos UEBA de la solución es lo que llamó nuestra atención.

¿Cómo fue la configuración inicial?

Estuve involucrado en cierta parte de la implementación que se centró en la instalación de RING. La implementación fue sencilla. Compartieron un manual interactivo con nosotros y no hubo problemas. Incorporar las fuentes no fue un proceso tan complicado. Necesitábamos de tres a cinco empleados para la implementación.

También brindaron capacitación guiada en la que un representante de Securonix nos ayudó con las consultas que teníamos.

El mantenimiento es administrado principalmente por Securonix. Apenas estamos involucrados en eso.

¿Cuál fue nuestro Retorno de Inversión?

Más que nada, hemos visto el Retorno de Inversión gracias a las métricas que obtenemos de Securonix.

¿Qué otras soluciones evalué?

Securonix es muy fácil de usar e intuitivo. En cuanto a la nomenclatura, es muy fácil entender dónde se encuentra la información que buscas. En comparación con otras plataformas, hay varias cualidades de interfaz de usuario a favor de Securonix. Pone todo al alcance de tu mano y la pestaña de opciones es muy accesible.

En términos de reducción de falsos positivos, no hemos visto mucha diferencia entre Securonix y otras plataformas por el momento.

¿Qué otro consejo tengo?

Toda la información sobre Securonix está disponible en la documentación en línea y te permite conocer la plataforma de forma independiente. Es muy beneficioso si estás buscando un SIEM de alta calidad.

Lo más importante que he aprendido usando Securonix es la explotación de análisis UEBA. Eso no lo había visto en otro SIEM y definitivamente ha sido un beneficio para mí.

Our company does manage a stock of solutions for our customers. We use some tools like Splunk SIEM and some other technologies as well.

The reason why a customer chooses the solution for its features depends on the customer. Customers may choose it based on budget or the features they're looking for, and it varies, honestly.

I am from the sales team and the technical team, because of which I can't speak much about its features.

Customers may plan their next year's budget. If customers find that they haven't derived value from the solution, they might think about the prices, and then they would reevaluate the solution, after which they choose another solution.

The technical support of the solution is an area with shortcomings and needs improvement. My customers didn't face any issues regarding support from the solution's vendor, but it could be from the partner or from those providing support for the solution. Support could be more flexible, and they can delegate the support part of their operations to partners.

I have been using Securonix Next-Gen SIEM for three or four years. My company acts as a system integrator and reseller while also having a partnership with Securonix.

The solution has proven to be stable so far.

The solution is easy to scale up.

My customers who use the solution are enterprise-sized businesses.

Technical support for Securonix is good. I rate the technical support an eight out of ten. I don't give a ten out of ten rating because all the solutions need a marginal score to improve. None of the solutions would have a hundred percent satisfaction from customers.

Positive

I work with Splunk. The pros and cons of a solution depend on its features, customers, and the scale of the customer.

As per our technical team, the initial setup was fine. It wasn't really difficult.

I am from the sales department, so I don't get involved in the implementation.

The solution is deployed on-premises.

Pricing of the solution is an aspect that depends on a customer's budget. Sometimes the price fits a customer's budget. At times, the solution's price becomes a huge burden on the customer.

A yearly payment has to be made toward the solution's licensing costs.

Additional costs other than the solution's licensing costs are for the installation and support.

I rate the pricing an eight on a scale of one to ten, where one is cheap, and ten is very expensive. It is a pretty expensive tool.

The solution requires maintenance, and the people required for maintenance depend on the applied or rolled-out solution's size. If the solution is applied at a larger scale, more team members are needed for maintenance. It is not difficult to maintain the solution.

I recommend the solution to those planning to use it since it is a good solution in the SIEM and SOC space. Some different providers or vendors also work in the SIEM and SOC space. The customers or potential users should evaluate a product before buying it, and everything would be fine.

The solution can fit all sizes. It's not only for enterprises since you'll find some SMBs looking for solutions like Securonix Next-Gen SIEM, but it will be a bit expensive out of their budget. Usually, SMBs don't place a budget for SOC since they can go for a managed SOC. Securonix Next-Gen SIEM could fit the requirements of SMBs as well.

It is a good product that needs to improve.

Overall, I rate the solution an eight out of ten.

In our organization, we handle cybersecurity. As an IT services company, we are limited to setting up the security operations center in different forms for our customers' requirements.

We are in the business of setting up the security operation center for the customers and we also provide other stock services for many of the customers. We do have a lot of service offerings on our stock management platform.

We do MDR via cloud security and its monitoring services, so we are very familiar with the leading platforms in the market today like QRadar and Splunk. We use them in our environment today. I have been searching out the next-gen SIEM. Then I brought Securonix to my board. I came to learn that Securonix is leading in the innovative ideas and innovations on the SIEM platform side. Particularly because my role is a security practice in Veeam SM. If you evaluate the market trends you understand the products released into the market and how best to leverage that integration and make sure that there is no bounce back to the customer in these situations. That's why I started evaluating the Securonix in a typical lead evaluation.

We are not partnered, we have just done a couple of initial discussions with some of the folks here in India. We are still in the stage of evaluating these products, including Securonix.

I noticed that this is more on the open data platform when it comes to managing the locks from a different angle and for different assets. That's one area which is more interesting for us.

Compared to other competitors in the market, what I have seen is that their module is the UEBA, User and Entity Behavior Analytics, module. That is something different which they are offering today.

These are some of the differences I see. Additionally, is the pricing issue. They are moving from DB pricing to the identity-based pricing. But I'm still confused about that identity pricing. I still have to get more clarification from the products.

The feature that I have found most valuable is their analytics platform where they have the open security data-link, which they introduced. This is typically different from the other vendors.

As far as what can be improved, again it is the pricing. I'm not sure how they are proceeding with the identity-based pricing compared with DB pricing which most of the vendors are using today. Some of them are dealing with EPS based pricing.

There is still a need to evaluate the stability because we are very new to this platform. So we need some more time to do that.

The initial setup is straightforward, it is easy to deploy.

We did evaluate other options before choosing Securonix. As an MSSP we use many products. It all depends on the kind of requirements we get from the customer. We evaluated QRadar and Splunk. As an MSSP, we use a combination of tools.

The major difference between Securonix and the rest is that their security data-link is very open and the hosting of that platform is much simpler compared to other vendors.

Because there is no proprietary thing involved here the log management should be much easier compared to others.

On a scale of one to ten I would rate Securonix an eight.