It just works. I have seen multiple viruses and malware get past other antivirus software like TrendMicro, Webroot, and Kaspersky. Bitdefender GravityZone always catches what others miss. It has a very light footprint when it comes to system resources. The centralized management console is nice, but I prefer the console before they redesigned the UI.
AlienVault Unified Security Management (USM) Anywhere is a cloud-based security information and event management solution that provides effective and affordable threat detection, incident response, and compliance management capabilities. USM Anywhere is well suited to mid-size enterprise environments operating in the cloud. USM Anywhere is also well suited to enterprises whose operations teams require easy deployment and management. Last, USM Anywhere is considered a highly affordable option compared to competitors. USM Anywhere lags competitors in several areas, such as application monitoring, database monitoring, and integrations with third-party solutions such as cloud access security brokers (CASB), DAM, DAP, and DLP.
The Gravity Zone console is quite easy to use, particularly if the person assigned to implement and deploy have a good understanding of how to make it work to get at the information needed.
The Dashboard is customizable to get at the information needed in one location.
Pushing tasks across the network is quite easy.
Having said the what is available in gravity zone, it is easy to see what devices have activity that frequently result in quarantines. This allows us to address "misuse" of our devices. Which brings me to my final point...
The policies can be set up to lock devices down with very strict rules (such as device locking) or with relaxed policies.
The USM platform provides the essential security capabilities that work together for a fast and cost-effective way for organizations to have complete visibility into the security of their environment.
With the information gathered during asset discovery, USM will correlated that information with known vulnerabilities for continuous vulnerability awareness. In addition, USM contains an active scanner capable of scanning for over 30,000 known vulnerabilities.
To give better visibility into your network, and possibly detect intrusions that don’t follow behavioral patterns, we offer Netflow information, bandwidth monitoring, and traffic capture, all part of our behavioral monitoring capabilities built into USM.
I wish we could access logs from the cloud-based product. Not just in a viewable sense but from a download so that we can scrape them for interesting strings.
Bitdefender needs to make it easier to export data from the web interface. As it stands now, it's a time-consuming copy and paste activity.
I would like for there to a notification service when someone encounters malware. For example, an email to our IT team when someone's Bitdefender quarantines a file.
USM Anywhere doesn't allow you to multi-home sensors. So if you have non-routable networks, you'll need to investigate the on-premise solution too.
You have to be on top of tuning else a constant stream of alerts will cause your SOC staff to begin ignoring alarms.
You have to be on top of tuning else you'll eat your allotment of storage for that month. It is really easy to exceed your storage quota if you don't proactively monitor log sources. USM could do a better job letting you know if a log source is too chatty.
It works. I rely heavily on my vendors to provide a product that works, is easy to implement, and that they support. As well as be a decent value for the money
The centralized logging and retention for PCI compliance was our main driver, and it is meeting that need. Otherwise there has been enough frustration with the lack of documentation and the need to customize through the CLI that I would be open to alternatives.
The console is easy to use, but has grown to have a lot of functionality. The only challenge is that all functions (even disabled and not installed ones) are shown. It would be great if only the functions that are active would be visible.
Once you are able to navigate the different panels, finding what you need is quite easily. Before getting used it it can be a bit of challenge . Each panel is quite well laid out and the filtering search capabilities are quite strong.
Yes its very available. The software continues to protect you even if you are offline. It constantly runs in the background and will check for updates again once back online.
We do have issues with maintenance on the AlienVault USM as the disk fills up from time to time with other data sources. Sources for scanning logs and net flow data isn't calculated in regular disk maintenance and can easily fill up our disk if we do not keep an eye on it with some custom Nagios plugins. The system does properly trim logging data from logging sources properly.
The console is quite fast and responsive, and once you start to get used to it, it is easy to use and you can see the main dashboard status at a glance. You can then dig deeper into the individual Companies / Endpoint clients and check the status of each. The software itself is not heavy on system resources in each PC.
With the latest release of AlienVault USM overall performance has not been an issue. We have noticed single source events per second does not scale well with the overall system. 2,000eps on a vmware system with a single source produces delays of up to an hour for us. Pages, reporting and even raw log searches are rather quick though.
Support is an area Bitdefender has always struggled with. While their products work great, the GravityZone dashboard is very technical in nature. If you aren't IT inclined, it could be difficult to setup. While most times support is helpful, we tend to work with them over email because of their very thick accent, they are hard to understand over the phone.
Support is friendly but response time has been spotty. Also initially when we signed up there was a lot of pointing us at the documentation, which has been spotty and ad-hoc for what is supposed to be a commercial product. Overall the feel of AlienVault and the support has been of a very new and startup company that is trying to grow up out of it's open source roots, and I'm not sure if they've totally been able to make the transition to being able to meet the expectations of the enterprise customers.
The trainer went through everything in the console an showed me what each setting did. If I had any questions on how to do something, he showed me where to go and how to do it. The trainer was very helpful and knowledgeable, and also professional and patient. Highly recommended.
I did not have any experience with "in person" training directly. The free online classes offered for a half a day are based on the actual training offered. These little teasers are very good and well worth your time to learn a few quick and dirty ways of getting more information from your SIEM
The trainer went through everything in the console an showed me what each setting did. If I had any questions on how to do something, he showed me where to go and how to do it. The trainer was very helpful and knowledgeable, and also professional and patient. Highly recommended.
The instructor gave detailed overview and went through the labs before allowing us to attempt using them. I enjoyed the balance of time and level of instruction received. The content went deeper that usual and the lab environment was easy to use and all results were consistent. I came away from the course knowing more than i did if I had just read the course notes.
AlienVault USM was a very simple to implement and get up and running. We started with a trial version and had that up and going within an hour of receiving email instructions from the sales engineer. We never had to contact support to get the system up and going. It was extremely easy to convert over to a full license once we started with a paid version.
Bitdefender offered the largest number of tools with the smallest footprint of any providers we have tested and used. The cloud platform is very well thought out and will give us all the information we need very quickly. Resources required have been greatly reduced, both on Endpoints and in the day-to-day management of the product. We also gained Patch management and vulnerability scanning as part of the switch, which has enabled us to keep on top of updates, making the environment more secure.
The cost of AlienVault is what sold us on AlienVault. However, considering the amount of time and effort that has gone into getting it set up and realizing that views and reports cannot be shared across groups makes it not worth the savings.
I give it this rating because one you have the console running, you can add or remove whole companies, add computer endpoints (and remove them), and easily create and deploy endpoint packages to the machines that need the software. Once installed, the software starts to report back to the Bitdefender servers and the number of active licences is then seen and billed.
The AlienVault USM is not very scalable. Some scalability can be achieved by installing additional sensors, but this only offers 500eps per sensor and is still overall limited by the installation type of VM or physical. We have also noticed the EPS (events per second) is rated overall and not towards a single source. A single source on a very healthy VMware partition tops out at 2,000eps for us, no matter how we configure it. Maybe this is a problem of the 5.2 release?
Estimating the ROI with Bitdefender [GravityZone] is rather difficult. While there is an obvious cost to using Bitdefender [GravityZone] (via a monthly or yearly subscription fee for each device being protected), it is hard to estimate the cost of if a computer or computers become infected via a piece of malware. In the best-case scenario, a single computer becomes infected with a relatively benign piece of malware that can be removed after infection; in a worst-case scenario, an entire infrastructure is infected by ransomware completely crippling an organization.
Since implementing Bitdefender [GravityZone] across multiple organizations, not a single one has [added] a malware outbreak.
The initial cost of setup and the cost of maintenance is more than worth it for if nothing more than peace of mind.
Once you hit the 150 asset mark, you have to jump to their unlimited license. There is no middle ground. We were only 10 or so assets above the 150 so we had to chose to either not monitor those assets or pay the price of the upgrade.
AlienVault brings all the information to one place which makes it much quicker to track down problems.
