Securonix Next-Gen SIEM is a security information and event management solution designed to provide advanced threat detection, response, and compliance capabilities. It leverages machine learning and big data analytics to offer a comprehensive security platform for modern enterprises.
| Product | Mindshare (%) |
|---|---|
| Securonix Next-Gen SIEM | 1.3% |
| Splunk Enterprise Security | 8.0% |
| IBM Security QRadar | 5.6% |
| Other | 85.1% |
| Company Size | Count |
|---|---|
| Small Business | 10 |
| Midsize Enterprise | 3 |
| Large Enterprise | 18 |
| Company Size | Count |
|---|---|
| Small Business | 203 |
| Midsize Enterprise | 97 |
| Large Enterprise | 180 |
Securonix Next-Gen SIEM utilizes advanced analytics and machine learning to detect complex threats that traditional SIEM solutions might miss. Its architecture is built on Hadoop, enabling scalability and the processing of large volumes of data in real-time. This allows organizations to gain deep insights into security incidents, prioritize threats, and automate response actions. The solution also includes behavior analytics to detect insider threats and unknown attacks, integrating seamlessly with existing IT infrastructure.
What are the critical features of Securonix Next-Gen SIEM?
What is the ROI expectations?
Securonix Next-Gen SIEM is implemented across various industries, including finance, healthcare, and retail. Its flexibility and advanced analytics capabilities make it suitable for environments with complex security needs. In finance, it helps detect fraud, while in healthcare, it ensures patient data security. In retail, it protects against data breaches and payment fraud.
In summary, Securonix Next-Gen SIEM offers advanced threat detection, scalability, and integration capabilities, making it a robust solution for modern enterprises.
Securonix Next-Gen SIEM was previously known as Securonix Security Analytics.
Dtex Systems, Pfizer, Western Union, Harris, ITG
| Author info | Rating | Review Summary |
|---|---|---|
| Assistant VP, Idm Compliance at a financial services firm with 1,001-5,000 employees | 3.5 | We use Securonix Next-Gen SIEM primarily for cloud solutions due to its big data analysis and strong user behavior analytics. While its dashboard and automation are advantageous, customization and log parsing at the admin level remain challenging. |
| VP International Business and Alliances at a tech services company with 51-200 employees | 4.5 | We work with Securonix Next-Gen SIEM as a reseller, valuing their updated AI tools for minimizing false positives. Their customer response is excellent, though service turnaround times could improve. Solution choice varies based on company needs and preferences. |
| Works | 4.0 | We utilize Securonix for alert management with features like auto-incident creation and behavioral analytics, though fine-tuning is needed. However, large data queries sometimes fail. Adding automatic incident assignment, as competitors offer, could enhance functionality. |
| Senior SOC Developer at XVE Security | 4.0 | We use Securonix Next-Gen SIEM for effective threat detection and integration, appreciating its AI capabilities and time-saving benefits. Despite initial setup complexities, it offers more out-of-the-box functionality than Splunk, which required extensive manual setup. |
| Regional Channel Manager at i2sBusiness Solutions | 4.0 | I use Securonix Next-Gen SIEM for security monitoring and user behavior analytics, finding its interactive dashboards and training features valuable. However, better integration with other technologies, like firewalls, would enhance its effectiveness, with ROI typically realized after a year. |
| Lead - Cyber Security at NMC Healthcare | 4.0 | We use Securonix Next-Gen SIEM for threat detection and SOC management, appreciating its analytics, scalability, and cost-effectiveness. While improvement is needed in dashboards and reporting, its ROI is positive, especially for high-compliance environments. |
| SOC Analyst L2 at a tech vendor with 10,001+ employees | 4.0 | I use Securonix Next-Gen SIEM primarily for creating correlation rules and dashboards. The option to choose resource group names simplifies log queries, but the system can be slow, especially during specific log searches. I previously used Splunk for six months. |
| Sr.Vice President & Head - Global Cybersecurity Business at Tech Mahindra Limited | 4.5 | I use Securonix Next-Gen SIEM in hospitals to analyze user behavior and detect unauthorized access to patient data. Its data analytics are top-notch, though it needs better automation and more tailored use cases for specific hospital needs. |
| Head of Cybersecurity at a tech services company with 11-50 employees | 4.0 | Securonix greatly optimizes our threat hunting, incident response, and reduces false positives, saving considerable staff time. I find its intelligence and flexibility superior to traditional SIEMs, though I desire more open threat intel data. |
| SOC Analyst at ComWare S.A | 5.0 | Securonix has vastly improved our security event correlation, user monitoring, and threat detection, saving hours and mitigating risks. I value its data integration and cloud-native platform, finding it superior to McAfee, though I desire more local, face-to-face training. |
We have actually used our company, which is a large one, and we are using multiple Securonix Next-Gen SIEM technologies. For the on-premises environment, we are using Securonix Next-Gen SIEM, and for cloud, we are using Sentinel.
We primarily use Securonix Next-Gen SIEM to detect policy violations, firewall detection, and other basic parts for the on-premises system, but we primarily focus on the cloud solution because cloud is the scope of our work and we are moving to cloud slowly.
The other SIEM solutions lack an option for big data analysis, whereas in the Securonix Next-Gen SIEM, we have this option, so considering the scope of the project we planned, we chose Securonix Next-Gen SIEM over other vendors.
We utilize user and entity behavior analytics in the Securonix Next-Gen SIEM.
The reporting in the Securonix Next-Gen SIEM is very good, and the dashboard is great.
We have a separate dashboard for MTTD and MTTR. Compared to the previous solution we used, Securonix Next-Gen SIEM has many advantages on the MTTR part, as the containment and alerts automations are feasible from the response point of view.
The customization in Securonix Next-Gen SIEM is more difficult compared to other solutions. At the operation level, we are not facing many challenges with automating things using Securonix Next-Gen SIEM, but at the admin level, we have many challenges where log parsing is causing issues and compatibility is not present.
The primary technology challenge we have is not at the security tools level. For example, firewall Cisco and others are capable. However, specific to product, for SAP, we are using certain products, and developing custom connectors for each product, especially the internal applications, is difficult, and Securonix Next-Gen SIEM is not up to the mark.
I have been working with Securonix Next-Gen SIEM for almost one and a half years, and we have undergone a major migration. Earlier, we were an individual company, but we have now merged with MBD, so the bank scope has been widely spread, and we have migrated to Securonix Next-Gen SIEM.
We had an individual product before we purchased Securonix Next-Gen SIEM, having separate SOAR and SIEM solutions, along with separate tools for each activity. Securonix Next-Gen SIEM has built a centralized environment where we can perform all these tasks without any dependency on a separate SOAR solution for containing alerts' action items, and the big data plays a major role, allowing a large setup of datasets to be parsed into Securonix Next-Gen SIEM without issues.
The stability of Securonix Next-Gen SIEM is based on the events we are processing. For certain solutions where not much log is generated or stored, it handles tasks efficiently, but where a large number of logs are generated in a short time, it keeps them as a cache and releases them as an event, which takes some time. It is stable, but only at a certain level.
I do not face any challenges regarding scalability. I can rate it around eight to nine, and it is very scalable and capable of handling tasks, especially for the on-premises product.
For technical support, I can rate it as seven. They also have the same issues other vendors are facing. They are good at resolving issues but not all of them. When we reach out to someone, we often wait for the right person with the right skills to come and fix the solution, which is the major challenge.
Neutral
We validated ArcSight, Securonix Next-Gen SIEM, and Splunk while considering suitable SIEM solutions. Before using Securonix Next-Gen SIEM, we used ArcSight, where the integration created many issues, particularly data integration, because most end-of-life service systems are not supported in ArcSight, and regular content updates are not up to the mark. Securonix Next-Gen SIEM provides both options, which made us switch from ArcSight.
We also considered Splunk, and we noticed the customization in our organization is not at the level we need. We tried providing some applications to develop a custom parser, but we do not think Splunk is capable of handling such complexities.
As I mentioned, it has been hardly a year. We have a premium subscription with the vendor for Securonix Next-Gen SIEM implementation and related activities, and so far, we have never faced any issues since the vendor support is available. It may become a challenge in the fourth year if we do not renew as a premium license and go with an operational license.
It does take some time to get there.
I would rate Securonix Next-Gen SIEM as six to seven out of ten.
From my perspective, it changes based on the organization using it. If your scope focuses on big data, I recommend going with Securonix Next-Gen SIEM. If you plan to maintain the same level of scope in the on-premises environment without any advanced technology, then I would suggest going with better SIEM solutions.
We work with CrowdStrike, Securonix Next-Gen SIEM, and other cybersecurity products such as Gurucul. We are a service provider and partner of Securonix Next-Gen SIEM. We operate as a reseller of Securonix Next-Gen SIEM for their customers' cybersecurity as their primary defense mechanism.
They are very updated. Their customer responses are great, and they keep using the new AI tools to keep themselves at the edge of the game.
This is very helpful because there are many false positives which keep cropping up, and one of the things that Securonix Next-Gen SIEM does very well is ensuring they don't give attention to false positives. They don't take attention away from the real problems and reduce a lot of noise.
We look forward to more developments from Securonix Next-Gen SIEM in terms of their service turnaround times and staying connected with customers.
Given that they have already started improving on the service levels, there isn't much we can recommend at this point. We will wait and see how things unfold.
We have been using the solution for about four years.
We have experienced no latency issues with the system.
It's fairly scalable. We have not had any customers come back to say they cannot scale at the speed of their business growth. Typically, Securonix Next-Gen SIEM is chosen by customers who are already fairly large. They don't have very small customers implementing Securonix Next-Gen SIEM.
It's certainly meant for large entities and to some extent medium entities who are on a growth trajectory, but certainly not for small ones.
They excel in response times and quick reactions when there's an actual threat. We work with a particular team which is regionally based out of the Middle East, and they have been very responsive, so we don't want to make any changes.
Positive
The solution is easily integrable and fairly easy to implement.
The solution is definitely not expensive. It's benchmarked against others in this space, and we haven't received any negative feedback about pricing from customers or prospects.
The choice depends on the posture that the particular company would take. If they are more mobile intensive with more endpoints, they would go for solutions from companies such as CrowdStrike. It also depends on which tool the CISO and the rest of their team is more comfortable dealing with.
Automated threat hunting is an evolving space because you can only hunt so many threats, but there are always some that go completely unnoticed. You only know what you know.
The system is pretty robust because it covers all applications and the entire spectrum. There are cycles that you keep going through and review periodically.
Whatever feedback we provide to the Securonix Next-Gen SIEM team, they have been very forthcoming.
I rate Securonix Next-Gen SIEM a 9 out of 10.
We use Securonix for alert generation by feeding events from different data sources and creating policies. Based on policy violations, we manage alerts. It's essentially a SIEM system for what we do with Securonix.
One of the valuable features of Securonix is the auto-incident creation, which was not available two or three years ago. Previously, we had to create incidents manually when a violation was triggered. Now, the process is automatic, reducing our workload. Additionally, behavioral analytics is a useful function, even though it sometimes triggers due to legitimate actions. It requires fine-tuning but correctly detects abnormal behavior.
When dealing with a large amount of data, such as when firewall logs increase, queries sometimes crash or get stuck. This issue became noticeable after transitioning from a NetApp to a Snowflake environment. Improving this would be helpful.
I have been using Securonix for the last three years.
I would rate stability as an eight out of ten.
I rate scalability as seven out of ten.
The technical support from Securonix is good. If I raise a ticket, it initially goes to the L1 team, but the next level of escalation is really effective. Response times are satisfactory and meet deadlines.
Neutral
I have used other SIEM and SOAR solutions that automatically assign incidents to engineers, which would be a beneficial feature to add in Securonix.
Our tech team handles the setup outside of my working hours, and the process is simple.
I'm not sure about subscriptions and pricing as it's handled by others.
If you could improve query stability with large data sources, it would be beneficial.
Overall, I rate Securonix as an eight out of ten.
We use Securonix Next-Gen SIEM as a SIEM, security incident and event management solution in our organization.
Securonix Next-Gen SIEM has effective features for threat detection, such as models and custom trap models which are useful. Its integration capabilities are good and comprehensive, allowing us to connect with various necessary components.
Additionally, the AI capabilities enhance threat detection, although they were relatively new at the time. Finally, the solution has shown to be time-saving in the long run.
The passing and setup are quite complex at the beginning, making onboarding not smooth, which is an area that needs improvement.
We have been using the solution for around two years.
I rate the stability of the solution as eight on a scale of one to ten.
The solution is scalable as it is cloud-based and cloud-native.
Customer support is rated around seven to eight out of ten. The support system requires creating support requests, and there is no UK-based support, which leads to delays in waiting for US support.
Positive
Previously, we used Splunk. We switched to Securonix Next-Gen SIEM since Splunk required a lot of hand-holding in terms of creating rules and models. We needed a solution out of the box as we have a small team.
The initial setup involved complex passing and setup, which made the onboarding process not smooth.
Deployment was handled by the vendor, Securonix themselves.
The solution is time-saving, particularly in the long run after it is deployed, enabling us to get value promptly.
The pricing has similar ingestion charges compared to other solutions, such as Splunk.
I would recommend Securonix Next-Gen SIEM depending on the use case. For a small team that wants to get things done without much additional work, it is suitable.
Overall, I would rate the solution at eight point five.
I use this solution for security monitoring and user behavior analytics. Banks, governments, and the oil and gas sector utilize it.
The software includes user behavior interactions, dashboards, and training capabilities. These features are interactive, allowing for comprehensive engagement.
In terms of improvements, SIEM could have better integration with other technologies.
Additionally, it might benefit from integration with other sources, such as firewalls. It all depends on specific use cases.
I have been using the solution for three years.
I have found the solution to be stable.
The system is very scalable, and I would rate it around eight out of ten.
I find customer service to be very good.
Neutral
The initial setup is not very complex, however, it does have its intricacies, and I would rate it around seven out of ten.
The return on investment depends on the customer. It typically takes at least a year to realize the value.
Comparatively, it is reasonable when compared to solutions like Splunk and Exabeam. Licensing is based on events per second (EPS), costing between $50 to $60 per EPS.
My rating for the solution would be around eight out of ten.
If organizations are on a journey to move to cloud, I recommend transitioning to Securonix over an on-premise solution due to its ease of deployment in cloud.
We use Securonix Next-Gen SIEM primarily for managed SOC, focusing on threat detection, baselining, and ensuring the maturity of our SOC security operations.
It is integrated with threat intelligence and utilizes frameworks like MITRE ATT&CK and the Cyber Kill Chain.
The solution helps in threat detection, especially with use cases like brute force attacks, port scans (both horizontal and vertical), other insider threat activities, Privileged access abuse, Ransomware detection and Data exfiltration prevention. We also customize and fine-tune these use cases based on our requirements.
Securonix Next-Gen SIEM has significantly improved the visibility of tools and technologies within the environment.
It enhances our security posture by providing comprehensive oversight of users and devices, aiding in threat detection and prevention.
Additionally, its scalability and ease of onboarding new devices and technologies have streamlined our security operations.
The most valuable feature of Securonix Next-Gen SIEM is its advance analytics, flexibility and scalability. We ingest billions of logs without worrying about resource allocation. This makes it a robust and cost-effective solution for our needs. Its user entity and behavior analytics (UEBA) are also integral for detecting insider threats and lateral movements within the organization. These features help organizations strengthen their security posture, protect sensitive data, and maintain compliance with strict regulatory requirements.
The dashboards in Securonix Next-Gen SIEM need more customization and informational capabilities.
The reporting features also require improvements.
Additionally, the multi-tenancy functionality should be enhanced to allow individual consoles for different customers, which is currently a limitation. This feedback has been given to Securonix for future improvements.
I have previous experience with Securonix Next-Gen SIEM for almost three years in deployment management and baselining in my past experience.
Securonix Next-Gen SIEM is very stable and reliable, but like any sophisticated security platform, its stability depends on several factors, including deployment architecture, environment, and proper maintenance. It handles billions of logs efficiently, along with the managed service, ensure its reliable performance especially when deployed in the cloud. However, to maintain long-term stability, it's important to ensure the platform is well-resourced, updated regularly, and properly configured. When implemented correctly, Securonix SIEM delivers reliable performance and security monitoring without significant interruptions.
The scalability of Securonix Next-Gen SIEM is seamless. We don't have to worry about resource allocation as long as we have the required EPS licenses. The solution is designed to scale according to our needs without any hassle.
Securonix is generally regarded for its strong customer service and support, which is a critical factor in ensuring the success of complex security solutions like SIEM. Overall, Securonix offers solid and responsive support with a team that is technically proficient and helpful, especially in complex deployments. The proactive guidance, customization support, and strong documentation make it easier for organizations to implement and maintain their SIEM effectively. However, for critical issues, it's advisable to escalate promptly and ensure you're engaging the appropriate level of support for your organization's needs.
Positive
Prior to Securonix, we evaluated LogRhythm and IBM QRadar. Based on our company’s requirements, reduced operational overhead, lower TCO and improved threat detection Securonix Next-Gen SIEM was the best fit.
The initial setup includes evaluating technology that fits our organizational needs, signing NDAs, scoping, providing inventory, and EPS calculation. Once we procure the licenses, there is an expectation setting for onboarding, followed by workflows for exchanging guides, documents, and prerequisites. After the environment is ready, we proceed with onboarding.
I was closely working with the internal team and the vendor, leading the project. Including me, there were four people involved in the onboarding and baselining part.
From a business point of view, it can be assessed in both quantitative and qualitative terms. The ROI may vary depending on the organization’s size, security needs, and how well the platform is utilized and is highly positive in environments with high compliance requirements, frequent security incidents, or large amounts of data to process. By reducing incidents, improving operational efficiency, and simplifying compliance, the cost savings and protection against expensive breaches can quickly outweigh the initial investment.
The pricing of Securonix Next-Gen SIEM is reasonable, especially considering the package they provide. If we went with the same package with another vendor, it would be significantly more expensive. It’s value for money.
Before choosing Securonix, we evaluated LogRhythm and IBM QRadar. Based on our requirements need for more advanced analytics, scalability, better cloud integration, and automated threat detection., Securonix Next-Gen SIEM was found to be the best fit.
My recommendation would be to evaluate the solution precisely based on the company's requirements to avoid scalability issues in the future. Careful calculation of the EPS during initial sizing is crucial as it can become costly to procure additional EPS licenses later.
I'd rate the solution eight out of ten.
We have created correlation rules. When the condition matches, we get the alerts. We start analyzing the alerts and then create tickets for it in ServiceNow. We have also created dashboards in Securonix. If any breaches of data or unpredictable work is detected, it will show in the dashboard.
Securonix is a money-sharing tool. Its price range is very low compared to other tools.
The most beneficial feature is the option for a resource group name. We don't have to type the query specifically. We can select the resource group name or functionality directly of which type of security tool logs we want. We don't need to write the query for that; we just have to select.
I face slowness issues sometimes, especially when we write a query to search specific logs from the resource group. Apart from that, there should be GUI changes.
I have been working with the Securonix solution for eight to ten months.
Securonix is stable, yet sometimes there is slowness.
The solution is scalable.
We are not raising any questions with customer service or support.
Positive
I was using Splunk for six months.
The initial setup was straightforward, and I did not face any challenges.
For new users, it is good to use. For experienced users, they need fast query resolution; otherwise, it will be difficult for them to use. It does not require much maintenance.
I'd rate the solution eight out of ten.
We use it for user behavior analytics in a hospital. Consider patient health information. We use the product to understand where the information is, who's using it, who's accessing it, whether the access is authorized or unauthorized, and whether there is a possible risk of someone stealing that data. There are many such use cases.
Additionally, we can find who's accessing the data at a particular time in the hospital network. It is flagged as a potential risk if it is an unlikely behavior. When unauthorized access is made, an investigation is launched. There are similar use cases of Securonix that we built in hospitals in the US over the last six or seven years.
The big data security analytics platform, structured and unstructured data analytics, and user and entity behavior analytics provided by the product are probably the best in the industry.
The solution could provide more automation. There should be proactive creation of use cases specific to particular hospitals. What we get out of the box is not necessarily good enough. We have to build the use cases as a service provider. There's room to improve the use cases provided by Securonix.
We are partners and managed service providers of the solution in multiple markets across different regions.
The product is stable. I would rate the stability an eight out of ten.
The solution is scalable. It is the size of the organization that determines the number of users. It could be 10,000 or 20,000 users if it's a large organization. Sometimes, we see up to 30,000 users in a large corporation across multiple geographies. It all depends on the size of the company. Anything above 10,000 users is the standard size that we get with Securonix. I rate the scalability an eight out of ten.
The initial setup is easy. I don't see that as a challenge. All the features are user-friendly, and anyone with basic training should be able to install and get it started.
Generally, government clients or large enterprises prefer the product on-premises. Around 20 to 30% of our clients prefer to have it on the cloud. Most of our clients have installed it on-premises because they are very large companies. Fortune 500 companies would prefer to have it in their own environment and not on the cloud. However, Fortune 2000 or Fortune 5000 companies would be more interested in a cloud environment.
Compared to other known brands in the industry, the overall cost of the licenses is a bit higher than what customers expect. We have segmented Securonix as a platform for high-end customers, large banks and hospitals. The product is not suitable for mid-tier customers.
There are no hidden costs. The product has a transparent policy. The cost of the platform could depend on the number of users. There could be one price for one user per month. It is typically how all such platforms are priced. The pricing can also be done based on data usage. It would depend on how much data we are processing and managing.
We have clients in Europe and US. The tool is pretty good in the market. We must keep our eyes and ears open and look for different products. Nothing in the world of cybersecurity is going to stay for long. We see dynamic changes happening in the environment. As we see new threats emerging, the tools that are scalable and responsive are the only tools that will matter. We must keep benchmarking and checking out the best in the market.
Overall, I rate the solution a nine out of ten.
We have customized the uses of the platform for our benefit. In general, we use it for failed access attempts, network issues, and allowed/blocked, and we have use cases for platforms such as Windows Server.
We are a service company and partners of various vendors. We provide support to customers. Our strategy is that each piece of equipment sold to customers comes with value-added service, and Securonix protects our customers.
It is an excellent tool that helps us optimize threat-hunting operations, detect intrusive events on the network, and respond to security incidents. It is a tool that helps debug false positives and eliminate noisy alerts. It helps us focus on the alerts that we should take into account for analysis.
Using old, traditional SIEMs did not provide us with the same responsiveness and ability to operate. And if they did provide us with something similar, we needed more staff to review things, event by event. That meant some risky events could occur unnoticed. With Securonix, those issues no longer exist. Securonix shows us information that we must consider as a threat and helps us know when to start an investigation to avoid an incident.
It's very good at adding contextual information to security events. It has reduced the time spent by admins on the dashboard. They can now see information connected to attack risks or even users. The single dashboard alerts them and quickly reports if there is any threat.
It has helped us to better understand what is happening in our network through the indicators of compromise. We have saved days of work. And it optimizes the time that analysts take to review events, compared to other tools that do not have as much intelligence and as many indicators. With Securonix, the information automatically enters and adds intelligence to the indicators. This saves a lot of time that would otherwise be spent reviewing noisy data. It saves our analyst between four and eight hours when analyzing events.
When it comes to advanced threats, it shows us the threats or events that have been detected, with their risk level. It shows us a vulnerability bar and that helps us see who is looking at us, who is trying to deliver certain information to our systems, who exploited us, or if there is any alert due to someone extracting certain information. The automation of information delivery has facilitated everything, saving us three or four days.
For optimization and data analysis, it has a good evaluation engine for repeat offenders and that has helped us to detect, on time, what other basic SIEMs did not detect. Those other solutions needed more time to detect at that same level.
We can customize our use cases with the tools provided by Securonix.
It is an excellent tool that can ingest data in different ways and is very flexible.
Securonix could open up information regarding the indicators of compromise or cyber-threat intelligence databases that they use. The idea is that they share what threats they are detecting.
It is stable, both in the cloud and on the servers. We have never had access problems or experienced any performance issues.
Scaling is flexible. If we fall short in terms of EPS, we would simply increase the EPS. And if the RIN server has low resources, as it is a virtual machine we could increase the resources according to the data quantity.
It is an excellent option for the cloud in terms of scalability. It is flexible for both us and our clients. We have plans to increase usage for certain customers.
The support is excellent. At the service level, they attend to us quickly. We have a post-sale person who follows up in some cases. He can also see the tickets and can escalate something according to the urgency.
We used a traditional SIEM where everything was very manual. It did not have threat intelligence or threat hunting of compromises, while Securonix has those features.
We changed because we wanted a good tool to automate certain manual processes so that everything is more flexible. With Securonix, you have the option of integrating with other indicator-of-compromise services, and that helps create a more powerful platform and eliminate false positives.
I started the process of design and continued with onboarding and implementation. The initial implementation was simple, but we had some delays because we had new solutions and we had to create new templates. But in general, if you have traditional solutions that have a template, it is easy to implement. It would take a week.
As for our implementation strategy, the tool that we had previously had a forwarding functionality, so what we did was deploy information to the RIN and, from there, sent the information to the cloud. After that, we created a pipeline and sent the rest of the events so that we could take the previous SIEM out of production.
The sources took a month to incorporate. It took us a month to get access to the teams because we do not manage certain teams. It was a bureaucratic process.
Securonix does the maintenance. It doesn't require work from us. They send us emails indicating that the system is going to have a brief reboot and it takes a short amount of time.
We hired an onboarding engineer from Securonix who helped us with the implementation of the RIN. He explained the process to us until we understood everything.
Our experience with the onboarding engineer was good. He helped us with any questions we had and followed up through emails.
For the implementation of Securonix, we only needed one person from our side. I was the point of contact with our other areas.
Where we see our best return on investment is in the time and manpower we save. Before Securonix, our staff had to investigate events constantly. Now, one engineer with some expertise is enough to speed things up and give the rest of the admins time to do other things.
The pricing is fine compared to the market but I think that at some point the competitors will catch up on price. It would be good if, for example, there were an option to offer customers who have used the solution for more than a year some kind of additional trial or service.
There is no cost outside of the standard licensing fee, other than an initial installation service charge. Otherwise, there is simply a monthly cost for the service.
We were thinking about Splunk, QRadar, and Rapid7. One of the drawbacks of those systems would be the infrastructure. Many of the other platforms, including McAfee, need boxes or deployment servers in our infrastructure or our clients' infrastructures and, in many cases, the infrastructure is growing continuously.
With Securonix, that does not happen. It is a cloud solution that only requires a small deployment server with low resources, depending on how many events are received. And all that information is stored in the cloud as well.
The cost, compared to other solutions, is better.
Compared to other platforms, it is very simple yet, at the same time, it is very efficient because it packs information into a glance. After that, it gives you the option of hunting threats and that can be initiated on the dashboard.
It is very intuitive. A person who has a certain notion of cyber security can move quickly since it gives you information about any attack. It gives you a summary and it gives you links to receive information. And if you don't have much knowledge of the tool, you can always take the courses that are free on the web. Doing so helped us understand the solution.
This is a solution that will help you a lot in hardware processing and in optimizing the time it takes to review events, which is what admins often spend their time doing.
There are things on the network that you can't see with traditional tools. There are tools that don't give you the visibility that Securonix gives you.
We use it for the correlation of security events.
Securonix provides feedback from integrations with third parties so that it is always up to date regarding security events that occur daily.
It has helped a lot because previously we did not have as much control over the procedures or things that the company's users did. With Securonix, we have been able to monitor the activities of both internal and external users in the company.
Securonix has published a lot of information regarding how to use the platform. They have a lot of information online that has helped us add contextual information to security events. In the event of a security breach or a risk, it helps us monitor things. So far, with the solution in place, we have not witnessed any attacks, but it has helped us to monitor possible events that, if not taken into account, could be security breaches. It has helped us to mitigate potential gaps.
With this solution, we have saved hours in case management. It has helped us detect things faster and the integration with third-party sources has given us the ability to correlate and act on internal and external events, such as malicious attacks or malicious sites. We have improved in our response to certain incidents and types of browsing thanks to external lists that Securonix has provided us with. We can automatically detect threats.
Another benefit has been the ability to integrate practically all our specialists from different areas, including Windows, security, virtualization, et cetera, to respond with better quality. It has improved the efficiency of analysis.
It has also helped with data loss events in a certain way, through integration with our email accounts. In an event of data loss, the loss for our organization would be incalculable.
One of the most valuable features is the integration of all types of data sources to extract relevant information regarding events. It is a good solution when it comes to the correlations that it makes within all the data handled in our company. It has provided us with a lot of information and research.
We would like a little more face-to-face training. Securonix has several tutorials on its website, but we want there to be a person in Colombia who does training or workshops to give us a better understanding of the platform.
We have been using Securonix Next-Gen SIEM for about a year.
It has not presented us with problems. Most of our support cases are related to the generation of policies, but the platform has not been an issue for us.
Securonix carried out an analysis of our entire infrastructure. It provides us with the level of processing required and, if you are planning to take on new clients, you can always increase the EPS.
I would rate their support at 8.5 to nine out of 10. Sometimes it has taken a little while because the investigation team has already begun to analyze other cases, but they always resolve our issues. While they are a little slow in certain cases, most of the time they solve them quickly and efficiently.
We used McAfee before. The person who was in charge left the company just when Securonix came in and that is when I started working here.
One of the main differences is having service through the cloud. Before Securonix, we had the service locally. Now, the service is processed in the cloud and when a case is generated on the platform, they have always been willing to help us.
Securonix is in the cloud. We have a virtual machine that stores certain platform configuration information, and since it is in the cloud, we can manage the platform from anywhere. The cloud-native platform helps minimize infrastructure management. Having everything integrated into one place makes things much easier for us.
I was only involved a little in the implementation of Securonix, but from what I heard, their team was helping our entire company, day and night, to get the implementation out as soon as possible. There may have been some problems in integration, but support cases were created and their team was always there with updates and new ways to connect our sources with their platform. Overall, it was not that complicated.
On our side, we had specialists involved from each department that wanted to be integrated with the platform, such as Windows, networking, security, et cetera. The Securonix staff was always present.
Securonix has provided us with a consultant here in Colombia. We are in contact regarding configuration of the platform to rule out possible false positives and help us focus on events that we must take into account.
It took us four months to incorporate all the sources.
There are no maintenance requirements on our part. They are constantly notifying us of updates and, before making changes, they let us know if there are going to be any interruptions in the service.
Our company is already trying to sell Securonix services, although it is a fairly new solution in the company. First, it is being handled internally, but they are already beginning the process of selling the service. That is the best return on investment.
Compared to other brands it seems more affordable to us.
There are no costs in addition to the standard licensing fees.
The Securonix interface is very intuitive. McAfee had some good features and we have only been with Securonix for a short time, but it has not presented us with any problems. It seems to us much better compared to McAfee, in terms of event correlation and case tracking.
Securonix seems to be a good solution that has met all our requirements.
If you want to have a more centralized solution to improve the performance of case and incident analysis and management, Securonix seems like a very good option.
The most important lesson is that you can always improve. There are features that may be unknown to you in the service but, through the documentation, you can realize all the benefits of things that might not be used initially.
