Securonix Next-Gen SIEM Reviews

Securonix or SNYPR is a UEBA tool. It has all the features. It can work as a traditional SIEM as well as do behavior-based analysis. 

In terms of deployment, it is on the cloud. It is hosted with Securonix. We are using it as a service, however i have worked on premise deployements as well.

We have this tool to monitor all types of log activities. It can monitor whatever is happening. It can monitor traffic-related things, and it can monitor EDR and all types of logs. It has a set of use cases, and it can alert us if any abnormal activities are happening and if there is any suspicious and malicious traffic. It definitely does 24x7 monitoring of the activities happening in our environment and the type of possible attack that can happen in any of the environments.

It provides a lot of analytics. For handling alerts, we have a manual approach, and it is a team effort. Whenever there is a flag or violation, we check the behavior in the tool or in the UI itself. We can check each and everything in the tool itself. On the basis of that, we identify whether something is a false positive or not. If it is a false positive, we work on the policy condition.

An analyst's efficiency is all about the analytics present in the tool. They provide sufficient analytics. Recently, they have added one more analytics. They already have more than 15 analytics for threat detection purposes. They definitely help us to do more in less time. 

In our environment, we do not have external TPI integrated. So, we don't have any external sources for IOCs. With Securonix, all the IOCs are available in their Threat Lab. We are using that feature, and we are also receiving the reports. They check our environment against the IOCs available in their lab and provide us with the report. So far, we haven't got any high severity or medium severity issues. Whatever we got has been of low severity. Sometimes, we see traffic coming from a particular IP address continually, which is blocked in our fiber. We get to know that we have to be very careful about this external, malicious IP address that is trying to hit our environment. Because we do not have the external IOCs or TPIs integrated, we find this report very useful. 

It adds contextual information to security events, which is very helpful.

SNYPR has a bundle of features. It has the UEBA feature that tells you about the behavior of a person or entity. In the tool itself, there is an incident management feature, which is definitely valuable. It is a value-added item. It also has third-party TPI.

SNYPR is valuable for any organization because it is not only a traditional SIEM. It is also a UEBA tool. It does behavior analytics. As a UEBA tool, it has a lot of features. You can see a lot of things in the UI itself. It provides a lot of analytics. You can see how a policy is working and how it is giving you the flags if you want to reduce false positives. You can have all the visibility in the UI itself. You don't need to check anything in the backend for this.

It has a feature called Threat Model to identify a threat. For intelligence, it has a feature called Autonomous Threat Sweep that is valuable. 

Sometimes, there is instability in the data in terms of the customization of the time. They should work on stability on tool. However 6.4 jupiter version is much more stable.

I have been working with this tool since 2018 till today.

They have improved it a lot over time. We don't see a lot of issues related to stability in our environment. Sometimes, we see instability issues, but they are not very regular.

Performance-wise, it is good. It has a lot of analytics. We see the value in having this tool. Our management is also happy with the tool. It is reliable. We had a lot of configuration mistakes in our environment, and we could detect them with the tool.

It is scalable. We have 1,500 active users. We are operating in the US at three locations.

In terms of the integration of the data sources or the log sources with the Securonix tool, if the connectors are available, we never see any difficulty. I have integrated more than 50 log sources with Securonix. However, if they don't have a connector, we won't have any option for integration. This is common to all the SIEM tools. It isn't something that's specific to this. In any of the SIEM tools, if the connector isn't available, you won't have any option to integrate.

Their support has improved it a lot, They do support us or they do reply to us, but they need to be very fast. They need to be very quick. I would rate them nine out of ten in terms of support.

Positive

I started with Securonix itself. I have read about other solutions such as QRadar and Splunk, but I did not get a chance to work on these tools.

It was not at all difficult for me to use Securonix's interface. This is the first tool that I used. It was not difficult for me to learn. Its interface is very user-friendly, and I don't think anyone will face difficulty operating the tool. Everything is displayed nicely.

When we have a cloud deployment or we take it as a service, we don't get involved in the deployment of the SNYPR application, but we do get involved with on-prem Remote Ingester. So, application deployment is done by Securonix, but the integration with other sources is done by us. We don't have any difficulties with the integration because we have been working with it for a long time. So, we're aware of the backend and how to integrate. It is quite simple and easy. We also have a call with Securonix SME twice a week.

The maintenance is handled by Securonix themselves. They sometimes do the monthly maintenance. We only get the notification, and we know of the maintenance window. After maintenance, we check everything. We just validate that everything is working fine. They also validate from their end, but we also validate. We haven't had any difficulty after the maintenance or upgrade. It always works fine. There are no issues.

The Securonix cloud-native platform helps minimize infrastructure management. We don't need to buy a server. We don't need to manage it. 

It is a good solution, but it definitely requires some improvements. It has already improved a lot. They are upgrading it in every build, and it is getting better. They work on policy decommission. Whenever a policy gets old or replicated, they remove the policy. They work on the content refresh. For example, last year when we had the Log4j vulnerability, they immediately updated their content and applied the policy. They provided an update for the Log4j vulnerability.

I would definitely recommend this tool. It is really a good tool. It has all the features available. I don't know anything about the pricing. I don't know if it is more expensive or cheap as compared to the other tools, but as a UEBA tool, I would definitely recommend it to everyone.

Overall, I would rate it an 9.5 out of ten.

We use Securonix to monitor attempted malware attacks. It sends us alerts, so we can investigate suspicious entities. We'll refer it to the consent team, who will give their solution or comments. 

We have a server where all the data is stored. The Securonix people will take the data from that server, encrypt it, and send it back to the application. From there, we can work on the alert and monitor the data.

The product reduced our investigation times by about 85 percent. Data and geolocation enrichment are the two essential components of the detection part. When there is an IPS alert, we generally need to check to see where the IP is located. Securonix will tell you where the IP is located in the city and country. Securonix helped a lot when the Log4j cybersecurity attack broke out last year. It enabled us to investigate that threat deeper. 

The behavioral analytics features reduce our false positive rate compared to traditional antivirus and cut the time spent detecting and responding to threats by about two hours each week. 

Next-Gen SIEM provides valuable contextual information about security events. We are adding all the information, like user data, from Active Directory. Whenever a user is terminated or retires, we will get an alert stating that the user has separated. 

The built-in management tool improved our security teams' efficiency. You can raise a ticket with one click when you see something suspicious. You can work on it and do your analysis in the backend. It will open a ticket and send it to the teams. 

The analysis will be completed in 15 to 25 minutes. The solution will email the consent team to tell them they need immediate action. In other tools, we have to go to another third-party tool to raise a ticket, and we need to escalate the issue ourselves. There is typically another procedure, but Securonix has a built-in management tool. This reduces a process that would typically take an hour to about 15 or 25 minutes.

It also helped us avoid data loss because we integrated SharePoint into Securonix. We get a notification when someone deletes files in Sharepoint that reports the SharePoint link, the user, deleted files, etc. We will investigate whether it's a legitimate activity or something else. 

The most attractive feature of Next-Gen SIEM is UEBA. The solution creates a user baseline and detects spikes and outliers. Before we started using Next-Gen SIEM, we used traditional signature-based detection. Signature-based detection checks whether a malware signature exists in the database, whereas behavioral detection analyzes all the data.

For example, let's say a given user accessed a device ten times in the last 30 days during regular business hours on weekdays. Next-Gen SIEM will send an alert if the user accesses the device on the weekend or 20 times in a single day. Based on that, we will investigate and email the manager.

The correlation rules and the Spotter carriers are essential in any SIEM. One new feature I like is the Autonomous Threat Sweeper. We will get a notification that a recent attack has entered the environment. They'll provide all the information we need to investigate. It's an excellent feature, but we've only been using it for three to four months. Threat Sweeper does the job in the background whenever we all have some other work. We go through the notifications and decide whether they're essential or not. 

Threat Sweeper is handy. It will clearly show where the anomaly in the data occurs. There is clear information about the IOCs, IP addresses, domain names, etc. We can easily run it in the background and forward the same threat detection report to the other consult teams, like the network and server teams. Another new feature is XDR. I haven't used it, but I've heard it uses signatures and behavioral analysis efficiently.

When I started to use Securonix, I was a little confused, but I could pick it up after a week. Everything is UI-based, and all the information is available on one page, so you don't need to go to different tabs to get what you need. It's very user-friendly. With a click, you can open all the reports you want and generate as many queries as you need. There's no need to use commands.

It takes too long to generate Spotter reports. For example, a 90-day report is around 100 megabytes. That takes a while, but a one-day report can be generated in a few seconds. We would be happy if they sped up the process. 

I have been using Securonix for about a year and a half.

We can rely on Securonix. Whenever we get a new solution or new part, we'll always follow the vendor's suggestions, and they will give us an idea about what is happening or what we have to do.

Securonix is scalable.

I rate the technical support a nine out of ten. They're friendly. Whenever we have a P1 issue, we write an email and our issue is resolved in one or two hours. 

I previously used McAfee's SIEM solution. I switched because I shifted to another project using Securonix. Securonix is faster and more user-friendly. McAfee takes five minutes to load, whereas Securonix will load in the blink of an eye, and I never face any slowness in the application in Securonix. It takes an hour to generate a report on McAfee. It's no competition for Securonix.

I joined after the implementation, but it requires very little maintenance after deployment. We have one or two hours of downtime for quarterly maintenance. 

I rate Securonix Next-Gen SIEM nine out of ten. If you plan to implement Securonix, I recommend buying it now because they're offering a limited-time discount. It's an excellent SIEM, and anyone can afford it right now. 

We mainly use Securonix for SIEM software architecture and for logs. We generate all the logs from different APIs and firewalls. We also have created other policies. Securonix is the primary tool we use to get everything done for our projects and architecture. We even use it for other solutions like AD.

Primarily, I work on violations and policies, not the backend. As an analyst, I work on SIEM.

The solution is deployed on a private cloud. It is deployed with Microsoft Azure.

Everyone has access to SIEM, but they don't have admin access. We mainly have three people and a team lead on the Azure Securonix team. I am the backup and work on the operational side of that team. Everyone has read-only access except the three team members. 

Securonix primarily helps with our log code situation. We found a vulnerability last December, so it helped us gather logs for that. We informed our vendor, and they provided some queries on how to get those vulnerabilities and logs.

I normally work on policies and face a lot of false positives. We reduced many false positives since using this solution. Securonix has definitely helped improve our threat detection response and reduced noise from false positives.

Sometimes we face threats and sign-in logs from different countries, but we're able to resolve those. Sometimes we face malicious activities from traffic but it's very rare. It happens about twice a month.

Securonix helps a lot with monitoring. My project is in the monitoring and operational stage, so it's a primary tool I use to monitor everything. The implementation stage has already been completed. We have created policies for all kinds of tools and APIs.

As we are the client, most of us don't have the SIEM threat model feature. There isn't a lot of proper information about how to implement that. Customer service doesn't have a proper idea either. We are lagging in this area, but it's good overall.

In some cases, we have observed that people start getting login failures, so we checked the logs from Securonix and resolved the issue. In that way, it's helped.

Securonix Next-Gen helps us detect advanced threats faster and gives us lower response times. Sometimes we face a data source delay and it's impacted badly, but overall it serves us a lot.

I haven't faced any data loss since using Securonix.

The most valuable feature is that it works on user behavior and event rarities. Those features are in Splunk too, but they're not as effective. Securonix's customer service is also pretty good.

It's not difficult to use the interface, but there's a lot of documentation to read.

We haven't experienced any performance issues when ingesting log sources and investigating threats. The response is good.

Parsing needs to be improved. Every time we integrate a new, specific data source, we face a lot of problems in parsing, even for the old data source. That should be updated on a regular basis.

In some of the policies, the geographical location for a single IP is from a specific country, but the IP doesn't match. For instance, if the log is from China, the actual location of that IP will be from somewhere else, not China.

I have been using this solution for more than a year.

It's reliable and very stable. We haven't faced any major or even minor issues with security.

It's definitely scalable and fulfills my needs.

Technical support is good, but sometimes we face delays with responses.

I would rate technical support as nine out of ten.

Positive

The solution was already in the mid-stage of implementation when I joined the organization. I mostly worked on fine-tuning the policies.

We have a team that takes care of maintenance updates. The solution needed some updates because the user behavior wasn't working properly for some of the policies. As of now, instead of using user behavior, we use event rarity. After version 6.4 is implemented, the issue will be resolved. There are two or three more issues we have that will be resolved after the update.

I would rate this solution a nine out of ten. 

My advice is to get a proper idea of the tool you are working on and be sure to read the documentation.

We are using it for monitoring firewalls, Windows operating systems, some Linux operating systems, active directories, and some of the solutions in the cloud such as Office.

In terms of deployment, everything is in the cloud. Our licenses are on the cloud. We don't deploy anything on premises except the RIN.

We are a managed service provider, and we offer this service to third-party clients. Most of our clients are very happy with the solution. We can detect a lot of threats, which are not false positives, and we can describe the threats very well. A lot of information can be obtained from this SIEM, and we can provide very good incident reports to our clients.

We were using another solution previously. The other solution couldn't compete with the features and functionality that we were looking for as a managed service provider. Some clients ask for specific features, and we couldn't complete those needs with other products. They were more about calculations, such as events per second (EPS). With Securonix, it is easier to sell the product and make quotes for our clients. It has helped us a lot at the administration, commercial, and operation levels.

It provides actionable intelligence on threats related to our use cases. It can detect violations and reduce false positives. This actionable intelligence is one of the most important parts because we have suffered with some of the other solutions in terms of receiving a lot of events and alarms where most of them were false positives, which made it a bit difficult for us to investigate and generate incident reports. Securonix is handy for engineers and the security operations center.

Its analytics-driven approach is pretty good at finding sophisticated threats and reducing false positives. When it comes to monitoring network devices, such as firewalls, it can detect behaviors that would be difficult for other solutions to detect or for normal engineers to detect manually. It has a lot of violation policies, and it is very handy and helpful at this level.

It adds contextual information to security events, which is one of the most important points. We can fill a lot of information into our reports for our clients.

Everything is saved for us and indexed. We can review any event we need within three or six months. We can review even when the data is in the cold phase. We never faced any case where we lost any event data. When clients asked about some events in the past, we could find them very easily and without any issues by using the queries.

It improves analysts' efficiency to do more with less time. Spotter is one of the best tools for me for searching and visualizing various things such as policies. With the Spotter language, you can search for whatever you need. You can search for any endpoint, any IP, any hostname, or any violation name. Even though it is not very fast, it is fine for us. Splunk or Elasticsearch is faster than Securonix because this is their job. Even though Spotter is not as fast, it has been helpful for us.

The detection of threats and reduction of false positive alarms as compared to other solutions are valuable features. It has improved threat detection response and reduced a lot of noise from false positives as compared to our previous SIEM solutions. This was one of the reasons we decided to try or move to Securonix. Other products generated thousands of events, and a lot of them were false positives, which made it difficult for us to handle all the events. For example, we were monitoring a firewall internally, and that firewall generated about five million events per month. The previous product detected almost 1,000 to 1,500 events as positive events, whereas Securonix generates less than 200 events, and most of them are not false positives.

It can integrate with a lot of solutions. Being able to ingest all our log sources when investigating threats is one of the good points of Securonix. After we started to use Securonix, we could integrate a lot of solutions, which we couldn’t do previously. It works with many devices, platforms, and cloud solutions. It is pretty good in terms of integration.

The incident response area should be improved.

It is more difficult than other products, but overall, it is good. The platform has a lot of options and functionality. So, you need to check almost everything. For new engineers or people who don’t have much experience with this kind of platform, it is a bit difficult, but for experienced engineers, it is not that difficult.

When you have been doing a lot of work for about one or two hours, and you have a lot of tabs open, it slows down or gets stuck. There is a delay of 10 to 15 seconds in opening tabs or dashboards. I don't know why this happens, but for me, it is not a big issue. I just wait, and that's all.

I have been using this solution for one year.

It is stable, but it slows down or gets stuck when you have a lot of tabs open.

Overall, it is scalable, but when you are investigating a lot and you have a lot of tabs open and are involved in big work, it sometimes becomes slow or gets stuck.

In terms of its users, our SOC team has three engineers, and I am the fourth one. We have three clients for now for Securonix. We use it internally to monitor our company. Overall, there are five or six users using the interface, investigating, and reporting to the clients.

Most of the time, their support is very good, but sometimes, we had to escalate the issues. Sometimes, we opened a ticket, and we immediately received an answer for fixing the issue, but at other times, we got a response after one, two, three, or even seven days. I guess it is based on the impact or severity, but when we have an urgent issue or problem, Securonix solves it very fast. I would rate them an 8 out of 10.

Positive

We were previously using Splunk, and we wanted to continue, but when we did the evaluation, we found Splunk to be more difficult to implement than others. It is fine to operate it, but its implementation is more difficult. It also had fewer features than Securonix. Securonix is dedicated to security information event management, but this is not the main functionality of Splunk. Even though Splunk is very strong in security, and we have been using it, when it comes to, for example, machine learning, Securonix has pre-configured policies. So, we don't have to spend that much time, whereas when it comes to Splunk, we have to configure everything. We have to install the applications and configure the dashboards. Considering the functionalities, features, and pricing, we felt that Securonix would be the best option.

It is better than previous solutions in terms of threat investigations and onboarding. That's because most of the other solutions are based on rules. Sometimes, there is no intelligence when it comes to detection, whereas Securonix has policies that are a collection of rules. Securonix doesn't only extract the log and tells us that it is a low-impact event or informative event. It also tries to correlate most of the events according to the policies and takes us to the main point. This is how Securonix has helped us to reduce a lot of false positives. Other solutions only worked with rules, and they only sent us events. We had to review most of those events, which is not the case with Securonix. It has a lot of policies for all types of detections. There are almost 1,000 policies, and Securonix can correlate various types of behaviors and pieces of evidence to detect advanced threats. It is good at this level.

We have the cloud license of Securonix. Everything is on the cloud. We only implement RIN on-premises, which is straightforward. You just download the executable, give it permission, and execute it. You provide the information it asks. There are a few packages that you need to install previously, but overall, it is very handy and straightforward.

I implemented it on my own. 

Its price is fine. We found it to be cheaper than LogRhythm, Exabeam, Splunk, as well as Elastic Security. A few months ago, when we were comparing Securonix with Elastic Security, we found Securonix to be cheaper than Elasticsearch. We were pretty surprised that Elastic Security is more expensive than Securonix because Elasticsearch is just starting, and it cannot compete with Securonix at this time. So, the pricing of Securonix is pretty good for now.

We tried to evaluate some of the other products, but we decided to go with Securonix for the business part. It was easier for us to meet the needs of our clients related to calculations.

We evaluated LogRhythm. The first problem that we faced with LogRhythm was that it would have been pretty difficult for engineers to handle in terms of the user interface. As compared to Securonix, it was also very expensive. Securonix had most of the features or functionalities that we were looking for. We also evaluated Exabeam, and we had the same problem with the price and features.

It has somewhat reduced the amount of time we require for investigation. It hasn't probably helped in detecting advanced threats faster along with lower response times because there is this gap between the RIN receiving the information and then sending this information to the cloud. This gap makes it a little bit late as compared to other solutions. Other than that, it is good.

I would rate it a 9 out of 10.

We mostly use it for user-behavior analytics. It is used for all the behaviors related to users. In terms of the environment, there are multiple connections at different sites and locations, and there is also integration with other platforms. For some endpoint use cases, I have to do integrations with different customers who already have the platform.

Its deployment is hybrid. The cloud providers are Amazon and Google Cloud Platform.

When we have an endpoint threat, we have to move very quickly. We detect it through another tool that is associated with Securonix, and automatically the endpoint is isolated from the network. We also get some information for investigation and forensics allowing us to understand the type of threat. We get to know whether it is related to the endpoint or user behavior. We can get information on web-application firewalls and other solutions connected to Securonix, which allows us to understand the depth of the threat for a specific use case.

It provides actionable intelligence on threats related to our use case. After the alerts, we can isolate the endpoints and make some modifications. We can also do some searches about the related IP on the internet and intelligence platforms. That's very nice.

This actionable intelligence is pretty important. When we integrate different platforms, Securonix provides a lot of visibility and allows us to see the whole environment, not just a part. I have been working mostly on the endpoint side, but other people who are working on wider use cases can see all the dashboards and improve the security posture with Securonix.

Its analytics-driven approach to finding sophisticated threats and reducing false positives is very important. With other similar tools, we have to work a lot to reduce or manage false positives. We have to improve the rules and integrations because there are a lot of false positives. With Securonix, we have fewer false positives, and there is also automatic recognition for false positives allowing us to move very quickly.

It adds contextual information related to the use cases. My use case is very specific, but my partners and other teams get a lot of contextual information related to the whole company. It provides a lot of analytics related to a threat in terms of user behavior, environment, and target applications, such as databases, which is very important.

It has saved a lot of investigation time. As compared to other solutions, it has saved more than 50% time.

It has improved the threat detection response and reduced noise from false positives as compared to our previous SIEM solutions. The improvement in the response time is dependent on the scenario, but generally, it is about 40% more effective. When it comes to false positives, it is about 60% more effective.

It has been helpful in detecting advanced threats faster and lowering response times, but I don't have the metrics. 

Its console is very easy to use and configure. It is very intuitive for our use cases. App integrations are also pretty nice. 

It could be improved a little bit more for admin users. There should be more administrative options related to security for admin users. For example, for forensic purposes, the admin should be able to stop a specific user from erasing some information. I would be helpful in certain situations, such as during an internal fraud.

I have used it for two years separately, in 2020 and the last year, 2021.

Its stability is pretty nice because we don't have too many problems with it. The complexity is related to what we want to see. There are no issues with the performance. We have not experienced any performance issues when the solution is ingesting all of our log sources. 

It is 100% cloud. So, its scalability is pretty nice. We have all the capabilities and options to grow. Our environment has more or less four locations with about 1,000 devices. We don't have any plans to increase its usage in the near future.

I have had to call support three or four times, and I would rate them a ten out of ten.

Positive

I have worked with Splunk and LogRhythm. I am using Securonix because, in this company, most of our clients are using Securonix. So, I had to learn how it works and understand its architecture and capabilities. It is very easy to understand for anyone who has worked with similar solutions. It is 90% easier than Splunk, which has a lot of code. Securonix is very radical and intuitive.

I wasn't involved in its setup and onboarding process, but I would assume that it is very quick. That's because it is very simple to use for my use cases, and they have nice support and help.

Its maintenance is pretty lightweight. We have another team that is in charge of that. There are most probably two people who take care of SIEM and cybersecurity solutions.

Securonix cloud-native platform helps to minimize infrastructure management. It allows us to focus on threats versus engineering or managing the platform.

We have surely seen an ROI when we look at multiple threats that we have been able to prevent.

It improves analysts' efficiency to do more with less time. By using the contextual information that it provides, we can be more accurate in our investigation. It has saved about 30% time.

Its pricing is quite similar to others and is very competitive. The other solutions have different types of licensing, but when you do the math, it is competitive.

You should know your environment and connectivity requirements very well. You should understand the analytics that Securonix is providing for the team. You can make a lot of improvements based on those analytics.

I would rate it a ten out of ten.