PCI DSS

SIEM & Log Management

Accelerate your threat detection and compliance with a full SIEM and built-in essential security capabilities.

See how AlienVault USM makes SIEM and log management easy.

Launch the Interactive Demo

Trusted by thousands of customers.

eHarmony Peet's Coffee and Tea Save Mart Supermarkets The Davey Tree Expert Company Terre Haute Savings Bank Boise State University ABP Foods Epsilon Systems Solutions Benaissance Florida Heart Research Institute Progress Software Ubisoft Wintershall Noordzee B.V. Big Fish Games New York Times Company NemoExpress High Plains Bank LifeSpan BioSciences Pepco Holdings Regis University Skyhigh Networks Ziosk

A Complete SIEM, And So Much More

Single-purpose SIEM software or log management tools provide valuable information, but often require expensive integration efforts to bring in log files from disparate sources such as asset management, vulnerability assessment, and IDS products. With the AlienVault USM platform, SIEM is built-in with other essential security tools for complete security visibility that simplifies and accelerates threat detection, incident response, and compliance management.

Fully Integrated SIEM Capabilities on Day 1

Drastically simplify SIEM deployment and gain valuable insight into your environment with an all-in-one platform that includes all the essential security capabilities you need, managed from a single pane of glass, working together to provide the most complete view of your security posture.

  • SIEM / event correlation
  • Asset discovery and inventory
  • Vulnerability assessment
  • Intrusion detection
  • NetFlow monitoring
  • Actionable, relevant threat intelligence from AlienVault Labs threat research team
  • Integrated global real-time view of emerging threats and bad actors from OTX, the world’s first truly open threat intelligence community that enables collaborative defense with actionable, community-powered threat intelligence

Day One Results

Deploy AlienVault USM and see
actionable threat insights on day one.
Download a Free Trial >

  • 2,000+ Correlation Directives
    Ships with over 2,000 pre-defined correlation directives so you don’t have to spend hours creating your own.
  • Always Vigilant
    Continuous updates from AlienVault Labs include new correlation directives, threat signatures, remediation guidance, and more.

Try AlienVault USM for Free!       Interactive Demo

More Than Just a SIEM

– It’s Unified Security Management!

Traditional SIEM solutions promise to provide what you need – but the path to get there is one most of us can’t afford. Traditional SIEM solutions integrate and analyze the data produced by other security technologies that are already deployed, but unfortunately most mid-market organizations don’t have those other technologies deployed yet!

AlienVault USM provides a different path. In addition to all the functionality of a traditional SIEM, AlienVault USM also builds the essential security capabilities into a single platform with no additional feature charges. And AlienVault’s focus on ease of use and deployment makes it the perfect fit for mid-market enterprises and organizations with limited budget and few in-house resources.

Features: AlienVault USM Traditional SIEM
Management:
Log Management Yes Yes
Event Management Yes Yes
Event Correlation Yes Yes
Reporting Yes Yes
Trouble Ticketing Built-In $$
(3rd-party product that requires integration)
Security Monitoring Technologies:
Asset Discovery Built-In $$
(3rd-party product that requires integration)
Network IDS Built-In $$
(3rd-party product that requires integration)
Host IDS Built-In $$
(3rd-party product that requires integration)
Netflow Built-In $$
(3rd-party product that requires integration)
Full Packet Capture Built-In $$
(3rd-party product that requires integration)
File Integrity Monitoring Built-In $$
(3rd-party product that requires integration)
Vulnerability Assessment Built-In $$
(3rd-party product that requires integration)
Additional Capabilities:
Continuous Threat Intelligence Built-In Not Available
Unified Management Console for security monitoring technologies Built-In Not Available
“The #1 best benefit of AlienVault USM is the all-in-one [platform] and not having to switch to different products to check on different issues/reports. Running everything from a single interface gives me the ability to become an expert with one product, but with a full picture view.”

Eric Shaver II,
Security Officer, The Plateau Group, Inc.

“Pre-integrated features make deployment easier and involves less maintenance time.”

IT Specialist,
State & Local Government

“AlienVault allows us to get a quick picture of everything going on in our environment… it would be hard for me to name a better product for security operations.”

Mike Ahrendt,
Security Officer, Grand Rapids Community College

“AlienVault USM gives us much better visibility into our environment, which helps us with our compliance program.”

Security Manager,
Small Business Insurance Company

Centralized Threat Alerts

Prioritize with Kill Chain Taxonomy

The promise of SIEM software is particularly powerful—collecting data from disparate technologies, normalizing it, centralizing alerts, and correlating events to tell you exactly what to focus on. Unfortunately, achieving and maintaining the promise of SIEM is time-consuming, costly, and complex.

AlienVault USM builds in all the security capabilities you need plus a centralized alarm dashboard that utilizes the Kill Chain Taxonomy to focus your attention on the most important threats. It breaks attacks out into five threat categories that help you understand attack intent and threat severity, based on how they're interacting with your network.

  • System Compromise – Behavior indicating a compromised system.
  • Exploitation & Installation – Behavior indicating a successful exploit of a vulnerability or backdoor/RAT being installed on a system.
  • Delivery & Attack – Behavior indicating an attempted delivery of an exploit.
  • Reconnaissance & Probing – Behavior indicating a bad actor attempting to discover information about your network.
  • Environmental Awareness – Behavior indicating policy violations, vulnerable software, or suspicious communications.

Identify Known Bad Actors Communicating with Your Systems

Indicated by the OTX ‘Atomic’ logo, alarms and events associated with known Indicators of Compromise (IoCs) are highlighted throughout USM. This allows you to prioritize and triage security events that contain data linked to malicious activity.

Reduced Noise

Correlate IDS data with multiple security tools to reduce false positives and increases accuracy of alarms.

Complete Threat Evidence

See attack type, number of events, duration, source and destination IP addresses, and more.

Automatic Notifications

Set up email notifications and implement phone messaging services such as SMS.

Workflow Management

Create tickets from any alarm, delegate to users, or integrate with an external ticketing system.

Drill Down and Analyze Consolidated Threat Details in One Console

Accelerate your response work by analyzing related threat details on one console. See the directive event, the individual event(s) that triggered the directive event, and the correlation level of the directive rule.

You can click on any event to examine details such as:

  • Normalized event
  • SIEM information
  • Reputation of source and destination IP addresses
  • Knowledge base about the event
  • Payload of the packet triggering the event

Search SIEM Events

See events stored in the database, filter for more granular data, and sort by event name, IP address and more.

Inspect Packet Captures

Use integrated packet capture functionality to capture interesting traffic for offline analysis.

Check Assets and Vulnerabilities

Identify whether an attack is relevant by correlating reported vulnerabilities with malicious traffic.

Examine Raw Logs

Search for any raw logs that are related to activity reported by an alarm. Raw logs are digitally signed for evidentiary purposes. You can also filter by time range and search pattern and export raw logs as a text file.

Detect the Latest Threats with
Weekly Threat Intelligence Updates

Researching threats and maintaining your SIEM software, IDS, and vulnerability assessment tools for the latest threat detection isn’t trivial. Let us do the heavy lifting for you.

AlienVault Labs threat research team fuels your USM platform with the latest threat intelligence, so you can focus on detecting and responding to the most critical issues in your network.

AlienVault Labs threat research team spends countless hours mapping out the different types of attacks, the latest threats, suspicious behavior, vulnerabilities, and exploits they uncover across the entire threat landscape. They leverage the power of OTX, the world’s largest crowd-sourced repository of threat data to provide global insight into attack trends and bad actors.

AlienVault Labs delivers eight coordinated rulesets:

  • Network IDS signatures
  • Host-based IDS signatures
  • Asset discovery signatures
  • Vulnerability assessment signatures
  • Correlation rules
  • Reporting modules
  • Dynamic incident response templates
  • Newly supported data source plug‐ins

Learn More About SIEM & Log Management:

Browse all Resources

Free Trial Demo Get Price ChatNeed help?