No more typing reviews! Try our Samantha, our new voice AI agent.

LevelBlue USM Anywhere vs Security Onion comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 24, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

LevelBlue USM Anywhere
Ranking in Log Management
29th
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
115
Ranking in other categories
Security Information and Event Management (SIEM) (27th), Endpoint Detection and Response (EDR) (37th), Compliance Management (12th)
Security Onion
Ranking in Log Management
22nd
Average Rating
8.2
Reviews Sentiment
7.0
Number of Reviews
7
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of October 2026, in the Log Management category, the mindshare of LevelBlue USM Anywhere is 1.5%, up from 0.5% compared to the previous year. The mindshare of Security Onion is 1.6%, down from 4.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Mindshare Distribution
ProductMindshare (%)
Security Onion1.6%
LevelBlue USM Anywhere1.5%
Other96.9%
Log Management
 

Featured Reviews

Kris Nawani - PeerSpot reviewer
Co-Founder/Director at Bangkok MSP Company Limited
Offers complete coverage without the need to install additional software
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence and various other investigation tools The solution offers complete coverage without the need to install additional software, as it is maintained by the vendor. It helps in saving…
MS
Hands-on monitoring has built my threat detection skills and now supports my graduate research
The biggest challenges I have experienced with Security Onion are the learning curve and resource requirements, as it is not necessarily something you can install and immediately understand without networking and Linux knowledge. I actually encountered an HTTP 500 error with the management interface recently, which required troubleshooting and expanding my storage, showing me how important storage planning and system maintenance are when running Security Onion. What I would improve about Security Onion is probably the documentation around troubleshooting common issues, particularly storage management, and making the interface more approachable for new users. Having documentation of what works best would help, especially since you can have nodes or have it all built-in one as a standalone. If you use nodes, you have to have several different Security Onion instances downloaded, then have a manager and connect all of them together.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"SIEM log collection is great, and all of the rules that support updates with maintenance."
"AlienVault has provided a nice, unified system for monitoring and reporting."
"Customer Service: The customer service is excellent, we have quick and knowledgeable help on all our calls."
"Overall, I find that this product is amazing."
"The Event Correlation and vulnerability scans have been the most useful. As a 24/7 SOC, we use the incoming alarms to give an overview of suspicious traffic going through the network. It's easy to look at the correlated events and see the broad picture of traffic for that customer. Vulnerability scans are good for providing patch and remediation guidelines to keep customer systems secure."
"It helps to monitor the entire office in in a single point."
"The asset management functionality (active and passive scans) is also really important. You can't protect what you do not know about, so having an inventory of all your devices and software is critical to a security management program."
"Ease of deployment across various environments."
"What I appreciate most about Security Onion is that it combines multiple security monitoring tools into one platform."
"We use Security Onion for internal vulnerability assessment."
"The most valuable feature of Security Onion for security monitoring is its ability to find infected ports."
"Security Onion brings these tools together in one platform, making it easier to investigate security events and understand what's happening across the network."
"Security Onion is the most mature solution in the market."
"Security Onion has positively impacted my organization by enabling students to analyze logs, understand network traffic, comprehend intrusion detection, and utilize threat hunting and incident response skills in a practical environment, which are best practices we have implemented with the students."
"Security Onion is a completely open-source and free platform, making it a cost-effective solution that works smoothly and effectively for our organization."
 

Cons

"Most of the troubleshooting requires going through the Linux command line and bypassing the GUI."
"I think plugin management should be self-service on AlienVault USM. The other product is self-service but on the USM side. You have to submit a ticket then AT&T creates and updates the plugins."
"The other thing is the agent is OSSEC. They needed to create its own agent to help to find threats on the devices that it happens to be installed."
"The one thing I continue to dislike about the USM is the limitation on reports."
"One area that has room for improvement is storage. AllienVault is a good place to put logs, but sometimes it's a tough place to go get logs... The logger can only hold so much data. If they improved that, that would help."
"There could be some type of integration with our existing portal. We have our own customer portals, and it would be good if there was an integration so that our portal can provide reports. There could be some type of API into the AlienVault system with the USM system so that it is easy to show the customers high-level reports of the system through our portal."
"The reporting is mediocre and is something that needs to be improved."
"The solution is very user-friendly, but the dashboard could be improved as well as the level of customization."
"One of the improvements for Security Onion could be to address the issue of many logs and false positive alerts by reducing the number of false positives, as storage management is very hard sometimes due to a lack of storage space for logs, and they could implement methods to expand storage."
"The product is not easy to learn."
"Security Onion can be made easier to set up initially, as it is somewhat difficult at the start, but once configured, it becomes a great tool to use."
"The initial setup of the solution is a little bit difficult."
"Security Onion's user interface could be improved."
"One way Security Onion could improve is by making the initial setup and configuration easier, especially for new users."
"The biggest challenges I have experienced with Security Onion are the learning curve and resource requirements, as it is not necessarily something you can install and immediately understand without networking and Linux knowledge."
 

Pricing and Cost Advice

"Its price is much lower than McAfee ESM."
"It is affordable, and it also has many features that the premium products such as ArcSight and QRadar have. It is a very good platform for a SIEM solution. Everything is included in the price."
"I don't know exactly, but I know it is based on the number of logs and the retention duration, such as 30 days or something like that. So, the smallest package is about 500 a month for 30 days of logs. There is a virtual machine. You need resources for it. It is a log collecting VM. They provide the software, and you just have to load a virtual machine. So, you're going to incur some CPU RAM and storage for wherever this log collecting appliance is running, which typically is in our cloud and on our platform for the customer."
"The pricing is a good value. The key thing is that for the new product, the licensing of it, is subscription-based and it's based on data. Clients need to be really careful when thinking about that, because odds are they're going to need to put a lot more data into it than what they initially estimate, which is going to drive their subscription costs up."
"QRadar, ArcSight and Splunk are some of the most expensive SIEM products out there in the market and not everyone has the budget to buy them. In such cases, AV USM is a very cost effective alternative."
"The price of this solution is reasonable, which is one of the reasons why we selected it over other solutions."
"It allows you to do a lot with a small price tag... The pricing is the best on the market."
"AlienVault is flexible on their pricing for unlimited licenses."
"Security Onion is an open-source solution."
"It is an open-source solution."
"Security Onion is a free solution."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
917,433 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
18%
Outsourcing Company
17%
Comms Service Provider
9%
Financial Services Firm
8%
Comms Service Provider
12%
University
11%
Government
10%
Construction Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business65
Midsize Enterprise29
Large Enterprise25
By reviewers
Company SizeCount
Small Business3
Midsize Enterprise1
Large Enterprise5
 

Questions from the Community

What needs improvement with AT&T AlienVault USM?
There are scalability issues due to a 60 TB limit, which restricts its use for large customers like banks. It is also limited when used with bigger products and has complex password requirements.
What is your primary use case for AT&T AlienVault USM?
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence and various other investigation tools.
What is your experience regarding pricing and costs for Security Onion?
Security Onion does not require any cost, as it is open-source and free.
What needs improvement with Security Onion?
Security Onion can be made easier to set up initially, as it is somewhat difficult at the start, but once configured, it becomes a great tool to use. I assigned a rating of eight out of ten because...
What advice do you have for others considering Security Onion?
Security Onion is a completely open-source and free platform, making it a cost-effective solution that works smoothly and effectively for our organization. Security Onion integrates well with our e...
 

Also Known As

AT&T AlienVault USM, AlienVault, AlienVault USM, Alienvault Cybersecurity
No data available
 

Overview

 

Sample Customers

Abel & Cole, Bank of Ireland, Bluegrass Cellular, CareerBuilder, Claire's, Hays Medical Center, Hope International, McCurrach, McKinsey & Company, Party Delights, Pepco Holdings, Richland School District, Ricoh, SaveMart, Shake Shack, Steelcase, TaxAct, Taylor Morrison, Vonage and Zoom
Information Not Available
Find out what your peers are saying about LevelBlue USM Anywhere vs. Security Onion and other solutions. Updated: September 2026.
917,433 professionals have used our research since 2012.