Blumira

Automatic event alerts for suspicious activities allows us to begin investigation soon after a suspicious event. Automated report generation for less sensitive activities allows us to monitor actions of interest to our organization. The Report Builder UI is straightforward and with practice can be used to create detailed reports of log activity for specific events, as is needed during investigations. Event management UI provides for communication to Blumira staff for additional support, attachment of documents from investigations and documenting the resolution of the event.

It takes some practice and experimentation to identify which fields to use in filtering logs into reports. Blumira normalizes the logs for storage in the database and it can be challenging to get the right data items into the report you want. However, Blumira support is always ready to help figure it out.

Easy setup and operation. It includes a honeypot feature. Attractive cost for a small organization compared to other options.

When the local "sensor" was powered off recently we weren't alerted. It doesn't tell us if we aren't receiving logs from a particular device that has been previously sending logs.

The platform has done an amazing job of taking the various events, alerts, alarms, and other notifications and boiling them down into actionable alerts that any member of an IT team can work with and react against. Alert fatigue is a real concern, and the fact that our support staff can be given the infrequent and important findings -- while being given a playbook on how to respond -- is the reason this software is successful.

While the initial setup was straightforward, it did not include the same large amount of documentation that other vendors provide. This did involve then reaching out to Blumira support, which has been, hands-down, the most knowledgeable and fastest support team that I have ever used in my 20 years of utilizing untold numbers of networking and security vendors.