No more typing reviews! Try our Samantha, our new voice AI agent.

LogRhythm UEBA [EOL] vs TrendAI Vision One comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 2, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
120
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
LogRhythm UEBA [EOL]
Average Rating
7.0
Reviews Sentiment
6.5
Number of Reviews
11
Ranking in other categories
No ranking in other categories
TrendAI Vision One
Average Rating
8.6
Reviews Sentiment
6.9
Number of Reviews
128
Ranking in other categories
Endpoint Detection and Response (EDR) (4th), Network Detection and Response (NDR) (2nd), Extended Detection and Response (XDR) (2nd), Attack Surface Management (ASM) (1st), AI-Powered Cybersecurity Platforms (3rd), AI Security (1st)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Venda E - PeerSpot reviewer
Cloud Option Engineer at a tech vendor with 10,001+ employees
Behavior analytics has improved insider threat detection and reduces false positives for our team
The best features LogRhythm UEBA [EOL] offers are its behavioral balancing, baselining, risk scoring, and correlation with SIEM events, and what stands out most is risk scoring, which gives clear visibility into which user behaviors are genuinely risky and helps our team to focus on the highest priority threats without drowning in noise. Risk scoring helps us to quickly identify which users' activity needs immediate attention by clearly ranking threats based on impact and likelihood; it changes our day-to-day operations by reducing time spent on low-risk alerts and allowing the team to prioritize investigations and response actions more effectively and consistently. LogRhythm UEBA [EOL] has positively impacted our organization by improving our ability to detect insider threats and compromised accounts earlier, resulting in better security visibility, reduced false positives, and faster investigations and response times, which helped the team operate more effectively with greater confidence. I observed a noticeable reduction in false positive alert volume, which shortened the investigation time per incident, improving the mean time to detect and respond, and helping identify high-risk user activities earlier, which prevented potential security incidents from escalating.
SemihDalkıran - PeerSpot reviewer
Cyber Security Senior Technical Consultant at a consultancy with 11-50 employees
Built faster threat response and improved visibility with real-time monitoring and flexible deployment
TrendAI Vision One allows us to monitor attacks in real time, which is a significant benefit. We can quickly see where the attack is coming from. TrendAI Vision One enables us to use different products with a flexible license. For example, if a customer is using endpoint security and wants to switch to another solution, they can instantly use a different Trend Micro product, such as email. TrendAI Vision One has helped to reduce the time to detect and respond to different threats, as it can respond to attacks very quickly. With playbook templates, in cases of recurring attacks, responses can be made quickly using predefined playbooks. TrendAI Vision One has helped to reduce noise from false positives. There have been false positives before, but it was due to the customer not telling us which app they were using. Best practice configurations must be applied properly to avoid such issues. TrendAI Vision One helps customers consolidate the use of security vendors and reduce silos by offering one platform for all product management.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature is that you can select remote access of any machine for sandboxing."
"I recognize that Cortex XDR by Palo Alto Networks is one of the best products in its category regarding capabilities."
"The anti-exploit is impenetrable. We chose Traps because it is the only product that we were not able to get anything past."
"It is easy to use."
"Palo Alto is the best security solution in the market."
"We use it for malicious connections from malicious websites, to identify payloads that might be inside the traffic, to identify malicious processes or bugs that are running on the network, and any activities that tend to lead to data infiltration."
"These days it's machine-learning technology and behavior-based analytics features that make us more secure."
"The solution allows us to make investigations. Other XDR solutions also provide similar capabilities but for investigation, Cortex XDR is better."
"Licensing is on a yearly basis, and it's not expensive compared to its competitors."
"It has a lot of features. It has file integration monitoring."
"The solution is useful for privilege accounts and super admin accounts. It is beneficial from a security perspective. The tool uses machine learning rather than threshold-based alerts. For instance, it can detect unusual user logins, such as a user logging in from a new browser or location."
"LogRhythm UEBA’s best feature is the dashboard. It provides several graphs, charts, and event logs."
"The capability of pinpointing specific cyber incidents is a valuable feature for us."
"Overall, this is a really good product and I recommend it."
"It is easy to monitor users and that is how the solution is adding value to our firm."
"The solution's most valuable features are the graphical user interface and the reporting."
"Since the alerts are high fidelity and TrendAI Vision One requires less overall from the security analyst perspective, it reduces cyber risk effectively."
"TrendAI Vision One has helped me to consolidate my use of security vendors quite a lot."
"The proactive approach is the best feature."
"TrendAI Vision One has positively impacted our organization by giving us fewer false positive alerts, and with its support, we are securing our environment against upcoming vulnerabilities such as zero-day attacks."
"TrendAI Vision One platform's ability to provide centralized visibility and management across protection layers is quite helpful."
"TrendAI Vision One offers a complete XDR solution that integrates all of these aspects into a single application so instead of starting my shift and logging on to separate products for all of these, I just need to log in to TrendAI Vision One and I have single-click access to all of these applications."
"The user interface is very good."
"For scalability, I would give a rating of ten out of ten."
 

Cons

"The connection to the internet has not performed as expected."
"In the next release, I would like to see more UI improvements. Their UI is a bit basic. When we are speaking about Palo Alto Networks they are the big company, so they can improve the UI a little bit. The UI, the reports, the log system can all be improved."
"The onboarding process could be better."
"In terms of areas of improvement, we have not completed our review of the product. We're also looking at other products. So, it's a little bit hard to tell what could be different because we have not completed the review of this product, but based on our experience so far, its implementation is quite complex."
"In some cases, there are too many options for me, and it is a bit too hard to find some settings which I really need to implement."
"Enhancing UI simplicity and playbook flexibility are areas that could benefit from more low-code automation options for smoother integrations."
"It is not very strong in terms of endpoint management. It should have additional features like DLP, encryption, or advanced device control. Currently, Cortex is good in terms of the security of the endpoints, but it is not as good as other vendors in terms of the management of the endpoint."
"Cortex XDR by Palo Alto Networks could improve by adding a sandbox feature to better compete with their competitors which have it."
"It should have better mitigation with other solutions and be tightly integrated with other solutions. It has to be improved."
"In general, if something needs to be improved in the algorithm, it would be the dashboards."
"The search feature needs to be improved."
"The product should improve its dashboards. Splunk has neat dashboards. Additionally, we would like to enhance the use cases provided by LogRhythm as its use case library is not as extensive as other tools. Its machine-learning capabilities need to improve when compared to other solutions. It lacks risk quantification in a single, transparent view for individuals such as CSOs."
"The cloud version is lacking and not up to par."
"The product could be user-friendly for someone who doesn’t have any prior experience working with it."
"The UI could be improved a little bit."
"The solution is very expensive. There are also costs beyond the standard licensing fee."
"Alert noise and false positives are areas that should be improved. The initial deployment generates too many alerts, so we need better AI filtering and more accurate prioritization."
"When you deploy these tools from Trend Micro, the integration and getting them to work together, are among the more difficult pieces of the puzzle. But when you get that set up and working, you're glad you did."
"Vision One's functional capabilities are excellent, but the platform can be upgraded and simplified in many ways. We use multiple playbooks to automate many things, but I'm not sure there are mature cybersecurity applications. There are several external alerts, and their behavior changes daily, so I'm not sure automation can help you that much. We're using the playbooks, but it might require some improvement."
"The area for improvement is to provide more clarity on the query part, including examples for creating reference sets and documenting capabilities thoroughly so future users can benefit without needing to experiment."
"They need to stop changing Vision One once a week. They're in a hurry to change things so badly and so fast that I can't find where stuff is half the time, which is a challenge sometimes."
"The automation capabilities on-premises could be improved, as we currently have to manually activate servers and push policies."
"Also, XDR should improve its coverage of the latest IOCs. Their suspicious object management works, but the coverage should be improved. It will take one or two months to get those things covered. XDR will detect on a behavioral basis, but these databases will not get updated daily like some other solutions. If you're dealing with new ransomware or malware, it may take around a month before it's covered by Trend Micro."
"They are planning on adding the Security Playbooks as a complete feature. In the preview mode, it is available; however, it is not released."
 

Pricing and Cost Advice

"Cortex XDR by Palo Alto Networks is quite an expensive solution."
"The price is on the higher side, but it's okay."
"The price of the solution could be reduced. I have customers that have voiced that the solution is good for the value but if I want to sell more of the solution the price reduction would help."
"Very costly product."
"Our customers have expressed that the price is high."
"It is present, but when compared to other competitive products, I would say it is not less expensive; however, when all of the other added values are considered, the price is reasonable."
"It has a higher cost than other solutions, like CrowdStrike or Microsoft’s EDR tools, but it reduces the cost of our operations because it’s a new generation antivirus tool."
"I don't like that they have different types of licenses."
"The pricing is nice when compared to other products in the industry."
"As LogRhythm UEBA is pretty expensive, I'd give its pricing a seven out of ten."
"It is quite a budget-friendly product."
"Licensing is on a yearly basis. It's not expensive compared to its competitors."
"I rate the product's pricing a three out of ten. However, the cloud version is expensive. You need to hire professional services for deployment and migrations, which can be expensive."
"Trend Micro recently switched from a license-based pricing model to a credit system, which caused some initial frustration during my renewal."
"When we have a good product such as Trend Vision One, the price is fine."
"The price is reasonable. It's not exorbitant. CrowdStrike and other players are on the higher side."
"The price for Trend Vision One is reasonable compared to Microsoft and Symantec."
"Trend Vision One is cost-effective because it offers detailed reporting and environment control features."
"Trend Micro XDR is expensive."
"It is costly. It is not that affordable for a small organization. Only big organizations can afford it. It is a new feature that has been added, so its price is fair. Its licensing is probably subscription-based. It is for one or two years."
"I feel that Vision One is a bit expensive. As for the pricing or licensing, I would rate it a seven out of ten."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
917,433 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
13%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Comms Service Provider
12%
Retailer
11%
Outsourcing Company
10%
Construction Company
10%
Manufacturing Company
11%
Comms Service Provider
10%
Outsourcing Company
10%
Financial Services Firm
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business48
Midsize Enterprise21
Large Enterprise56
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise4
Large Enterprise4
By reviewers
Company SizeCount
Small Business72
Midsize Enterprise21
Large Enterprise51
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with LogRhythm UserXDR?
In general, if something needs to be improved in the algorithm, it would be the dashboards. The dashboards with solut...
What is your primary use case for LogRhythm UserXDR?
I typically use the product for reducing cyber risk, and I can investigate attacks more quickly using machine learnin...
What advice do you have for others considering LogRhythm UserXDR?
I would not necessarily recommend LogRhythm due to its complexity and lack of modularity. I would always recommend Sp...
What is your experience regarding pricing and costs for Trend Micro XDR?
I find the pricing very reasonable because our clients purchase credits that last for two years, allowing them to use...
What needs improvement with Trend Micro XDR?
TrendAI Vision One can improve, especially when I send a support ticket, as sometimes the support response is not sat...
What advice do you have for others considering Trend Micro XDR?
TrendAI Vision One is deployed in our organization as a hybrid model since it is a Software as a Service (SaaS) servi...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
LogRhythm UserXDR, LogRhythm Enterprise UEBA
Trend Vision One, Trend Micro XDR, Trend Micro XDR for Users, Trend Vision One - XDR for Networks, Trend Micro Vision One
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Panasonic North America, Decathlon, Fischer Homes, Banijay Benelux, Unigel, DHR Health,
Find out what your peers are saying about SentinelOne, TrendAI, Palo Alto Networks and others in Extended Detection and Response (XDR). Updated: September 2026.
917,433 professionals have used our research since 2012.