The LogRhythm NextGen SIEM Platform, from LogRhythm in Boulder, Colorado, is security information and event management (SIEM) software which includes SOAR functionality via SmartResponse Automation Plugins (a RespondX feature), the DetectX security analytics module, and AnalytiX as a log management solution that centralizes log data, enriches it with contextual details and applies a consistent schema across all data types.
N/A
Trellix Intelligent Sandbox
Score 7.1 out of 10
N/A
Trellix Intelligent Sandbox (formerly McAfee Advanced Threat Defense) enables organizations to detect advanced, evasive malware and convert threat information into immediate action and protection. It includes additional inspection capabilities that broaden detection and expose evasive threats. Integration between security solutions—from network and endpoint to investigation—enables instant sharing of threat information across the environment, enhancing protection and investigation. Deployment…
N/A
Pricing
LogRhythm NextGen SIEM Platform
Trellix Intelligent Sandbox
Editions & Modules
No answers on this topic
No answers on this topic
Offerings
Pricing Offerings
LogRhythm NextGen SIEM Platform
Trellix Intelligent Sandbox
Free Trial
No
No
Free/Freemium Version
No
No
Premium Consulting/Integration Services
No
No
Entry-level Setup Fee
No setup fee
No setup fee
Additional Details
—
—
More Pricing Information
Community Pulse
LogRhythm NextGen SIEM Platform
Trellix Intelligent Sandbox
Features
LogRhythm NextGen SIEM Platform
Trellix Intelligent Sandbox
Security Information and Event Management (SIEM)
Comparison of Security Information and Event Management (SIEM) features of Product A and Product B
LogRhythm NextGen SIEM Platform
7.4
Ratings
4% below category average
Trellix Intelligent Sandbox
-
Ratings
Centralized event and log data collection
9.00 Ratings
00 Ratings
Correlation
8.10 Ratings
00 Ratings
Event and log normalization/management
8.00 Ratings
00 Ratings
Deployment flexibility
4.60 Ratings
00 Ratings
Integration with Identity and Access Management Tools
LogRhythm is good for providing a comprehensive view of the environment. It gives a great outline of whatever is going on in our servers and systems regarding security malfunctions. The SIEM sends real-time notifications when there are some occurrences; like creating a new user and inappropriate login attempts. It also avails a good use case that meets our HIPAA compliance.
It is suited for people who are looking to secure their PCs from malware attacks. There is also email threat prevention where it will detect unwanted mails which come through our inbox. The sandbox feature comes in handy when you want to test new applications that will prevent it spreading to multiple systems in an environment if it is malicious. It has good customer support for all our technical queries. Since pricing is quite high, small-scale organizations can't afford it.
LogRhythm is a great SIEM to learn content on because the building blocks are very intuitive and easy to implement. All of the concepts relevant to content development are literally represented as drag and drop building blocks that can be easily manipulated.
The statistical building blocks contain powerful anomaly detection capabilities that are extremely difficult to implement in other SIEMs or not possible at all.
LogRhythm does better event classification than any other SIEM by far. My team typically drops all classification schemes from default installations of SIEMs and rebuilds them from scratch. I can actually use LogRhythms event classifications in rules without worrying about excessive partial matches or correlating unwanted events.
LogRhythm is focused on SIEM. That is their core business. Cost of operations, feature set and ease of use. The Log Rhythm support team is outstanding. Overall reliability is good. Reporting module needs some improvement and LR is promising that there will be significant improvements in future releases.
LogRhythm does a rather decent job of making the functionality advanced (allowing for advanced keyword & field searching, use of "AND" as well as "OR" statements in the search bar) while keeping it accessible (by not requiring a specific syntax to do quick searches). This combined with a user interface that has headings and labels that are intuitive is very helpful.
Support has always been fantastic for this product compared to many other support providers I've worked with. They are always very friendly and seem to be well trained and knowledgeable and never have to wait long for a solution. We usually get the issue fixed in the first call, but also we really haven't had to use support a ton so that's also a plus
Personally, I have only called our internal IT team about needing changes to permissions, not McAfee itself, but our IT team can make the changes though it seems to take them longer than I would think it needs to take. As someone who administers a different program, with different permissions, I would feel they should be able to make the exceptions faster and easier.
The only thing we chose LogRhythm NextGen SIEM Platform for is to allow the Security Analysts to work on the dashboards which don't know much about programming and query languages but has good intuition about cyber-security. It is easy to get hands-on compared to Splunk, which has an initial learning curve before being able to start harnessing its true power. Also, the ticketing system is quite fancy and somehow shows us the recent tickets that we need to jump on, which is not in Splunk.
McAfee brand is used, mcafee antivirus scan, mcafee drive encryption, mcafee DLP, mcafee cloud proxy. He Kaspersky at the corporate level and used his admin dashboard is a bit rough. I recommend mcafee since the graphical environment is very friendly with the administrator. We selected it because at the administration level it is more comfortable, support for end users is very easy, the administration console can create roles and segregate permissions.
