LogRhythm NextGen SIEM and SolarWinds Safety Occasions Supervisor present safety data and occasion administration instruments to customers trying to make sure their group’s community safety and digital system safety. Though each merchandise supply SIEM capabilities, primarily based on my evaluation, I imagine that every platform is optimized for various audiences:

• Log rhythm: Finest for mature firms with deep safety wants and a devoted safety operations heart group.
• SolarWinds: Finest for smaller groups or these on the lookout for simple reporting.

LogRhythm vs SolarWinds: Comparability Desk

Costs

Log rhythm

LogRhythm gives perpetual licensing and subscription-based pricing plans, however the firm doesn’t publicly disclose pricing data. I discovered the shortage of pricing data disappointing, particularly since LogRhythm does not supply a free trial both. The licensing permits limitless customers and log sources, and may be run by way of the cloud, {hardware} and digital machines. Contact LogRhythm to get an actual quote on pricing.

For extra data, try our LogRhythm vs Splunk comparability and our information to adopting Splunk’s SIEM platform.

SEE: All the pieces you’ll want to know in regards to the cybersecurity menace of disinformation (TechRepublic Premium)

SolarWinds

SolarWinds pricing begins at $2,992, with an choice to get a customized pricing plan. Customers can select from the perpetual license choice, which permits for limitless license use, or the subscription-based mannequin. Whereas the preliminary value of subscription-based licensing is way lower than the price of buying the perpetual license, the long-term value is increased. A 30-day free trial is accessible from SolarWinds, which stood out to me since LogRhythm doesn’t supply a free trial.

LogRhythm vs SolarWinds: Characteristic Comparability

Risk Monitoring

LogRhythm displays the info and occasions of organizations to detect anomalies all through their networks and endpoints. The system collects safety information, log information and stream information to offer holistic real-time visibility and efficient menace detection. The chance-based monitoring eliminates blind spots and rapidly identifies threats so customers can reply earlier than they trigger critical harm.

LogRhythm’s Endpoint Risk Detection Module makes use of menace intelligence, machine studying and behavioral analytics to seek out potential threats. I additionally appreciated that LogRhythm SIEM consists of a number of strategies for menace detection, together with figuring out irregular communication patterns, lateral motion, and modifications to delicate information.

The SolarWinds SIEM answer offers steady menace detection and real-time monitoring throughout customers’ units, providers, information and folders with its on-premises and multicloud deployments. The intuitive dashboard and consumer interface make it simple for customers to navigate by the instrument’s options. The centralized repository collects log information with the SIEM log collector instrument, and uncooked community log information is organized and normalized for customers within the system.

This is among the most important the explanation why we named it the best choice for log aggregation on our listing of the most effective SIEM instruments. As well as, I recognize that SolarWinds consists of event-time correlation and superior search capabilities, that are useful when conducting forensic evaluation and safety investigation.

Risk evaluation

The LogRhythm NextGen SIEM platform makes use of multidimensional analytics to detect and cease safety threats. Knowledge collected by the system is normalized and correlated to establish doubtlessly harmful exercise, offering better accuracy. I additionally appreciated that community visitors and packet information have been analyzed for patterns and behavioral outliers.

The behavioral analytics options can course of customers’ exercise inside a community and establish deviations from regular baseline conduct; it’s enabled by machine studying and will help guarantee safety towards insider entry abuse and information exfiltration. As well as, the system permits for each contextual and unstructured searches.

SolarWinds SIEM processes information and occasions for indicators of safety threats. The occasion log analyzer collects and analyzes log information, offering customers with perception with real-time visibility and context. Occasions are monitored to establish suspicious exercise, comparable to permission modifications and information modification. This information is then correlated utilizing built-in and customized occasion correlation guidelines.

I recognize the automated insights these SolarWinds options present, which may be useful in serving to customers and community directors diagnose system vulnerabilities, troubleshoot community issues, and enhance their useful resource administration.

Notices

When a menace is detected, the LogRhythm SIEM platform notifies its customers primarily based on their settings and the occasion’s severity. The Alarm and Response Supervisor can notify customers when threats are detected or warn them of suspicious exercise. The LogRhythm DetectX answer makes use of analytics to find out the prioritization of threats primarily based on their severity degree.

I additionally appreciated that the safety evaluation may be personalized, or developed totally by customers, in order that no notifications slip by the cracks. Moreover, customers can combine their instruments with open supply or STIX/TAXII-capable suppliers for much more alert accuracy.

With SolarWinds, customers can arrange customized alerts or view SEM alert feeds, in order that they’re all the time conscious of safety threats. Customers can handle their techniques to offer threshold-based alarms and notifications for safety system occasion stream triggers, system failures, IDS/IPS techniques with an infection signs, crash reviews, and so forth.

I used to be additionally happy to see that its refined file integrity monitoring filters may be personalized to make sure that solely high-priority file-related occasions generate reviews. When safety occasions happen, or threats are recognized, SolarWinds Log & Occasion Supervisor can ship customers notifications by way of e mail.

Automation and response

LogRhythm SIEM displays organizational information and occasions for suspicious exercise and takes actions to reduce impression with its automated response options. Its embedded answer, RespondX, can coordinate these response actions into repeatable processes to handle occasions rapidly and effectively.

I additionally appreciated that the instrument has pre-configured modules and reviews, that means customers have full visibility into threats and issues and by no means must seek for the knowledge they should reply appropriately. Moreover, the platform gives playbooks to streamline operational workflows.

As soon as the SolarWinds SIEM instrument identifies safety incidents and threats that require motion, it will possibly reply in a number of methods. Customers can set customized responses to flagged safety occasions or suspicious exercise by automation. This could embrace blocking or quarantining contaminated units, killing processes, restarting servers, logging customers off, and even disabling an agent’s entry to the community. I like seeing these automated responses as a result of it means you do not have to depend on your IT group manually addressing each single suspicious incident.

As well as, I recognize that Lively Response permits customers to scale back dangers with both customizable or pre-configured settings for a extra hands-on expertise. Customers may set their notification choices to be alerted to essential occasions.

LogRhythm professionals and cons

Advantages

• Permits customers to align their safety and IT operations with established safety frameworks comparable to MITER ATT&CK and NIST.
• Simplify the method of gathering and analyzing information from a number of sources by a centralized log administration system.
• Supplies consumer and entity conduct evaluation capabilities.
• Can automate repetitive duties with its embedded safety orchestration, automation and response capabilities.
• Complement conventional log assortment with endpoint monitoring.
• Use machine information intelligence capabilities to assist customers contextualize and simplify complicated information.

Disadvantages

• Pricing data will not be publicly out there.
• The customization choices may be slim in comparison with different instruments.
• No free trial is obtainable.

SolarWinds Professionals and Cons

Advantages

• Help compliance reporting and audits for HIPAA, PCI DSS, SOX, and extra.
• Licensing prices are primarily based on the variety of log-emitting sources, not the log quantity.
• Permits customers to regulate actions primarily based on menace intelligence findings.
• Can ship generated uncooked occasion log information in numerous codecs comparable to CSV or by utilizing syslog protocols.
• Affords a free 30-day trial.

Disadvantages

• Restricted AI and machine studying enhanced capabilities.
• Restricted pricing data.

Ought to your group use LogRhythm or SolarWinds?

In my view, LogRhythm gives a extra sturdy SIEM answer with its superior AI and machine learning-backed menace detection and response capabilities. The answer simplifies menace detection workflows as its SOAR performance is built-in into the dashboard. I like to recommend LogRhythm in case your group has complicated safety wants and operates a devoted SOC group.

Then again, SolarWinds gives a extra fundamental and user-friendly interface design. Whereas it will possibly allow you to successfully monitor and handle safety occasions and generate compliance reviews, it might not have among the superior options and customization choices present in LogRhythm. For that purpose, I believe SolarWinds is a more sensible choice for smaller organizations on the lookout for a easy SIEM instrument that’s extra user-friendly.

If you’d like extra basic steerage on choosing the proper SIEM instrument, see our SIEM Purchaser’s Information. And if you need readability on what SIEM instruments can and may’t do to guard your enterprise, try our article explaining the six SIEM myths.

Methodology

I’ve each SIEM options for this SolarWinds vs. LogRhythm assessment compares by consulting product documentation, demo movies and consumer suggestions from trusted assessment websites like Gartner Peer Insights. I thought of options comparable to menace monitoring, menace analytics, notification settings, automation instruments, and incident response instruments. I additionally weighed different elements comparable to pricing, licensing choices, buyer help, consumer interface design, and LogRhythm SIEM integrations versus SolarWinds integrations.