Securonix Next-Gen SIEM is an open platform that includes unlimited scalability, best-in-class behavior analytics, advanced threat detection based on machine learning and automated incident response. It offers flexibility and the freedom to ingest and edit custom logs and data sources.
This SIEM has impressive and preemptive threat hunting capabilities. It has MITRE-based detection to analyze attacker behavior and provide comprehensive threat landscapes and advanced threat intelligence feeds. Securonix integrates with expense systems to show insider threat indicators and user activity data. The SIEM stores user sessions from login to logout. Security teams can then build customized correlation rules that cross-reference threat intelligence feeds for indications of compromise and patterns of suspicious activity.
Delving into events shows the entire linear progression of an attack, not just a single indicator of compromise and reveals plain English explanations and context. This information is tremendously valuable because it gives both security and non-security professionals the big picture they need to quickly and thoroughly understand events, including what has occurred and whose machine has been infected, so that teams can respond in a timely manner.
Subscribers can customize or create their own dashboards with easy, out-of-the-box templates and widgets that have varying levels of detail. Dashboards and reports have a highly useful, bi-directional relationship. The platform can aggregate all events and raw data and export them as a report and can then convert report queries into widgets for dashboard use. The subsequent generated reports offer great insight into environments that security teams can leverage for compliance purposes. Teams can also manually run reports or schedule them to run automatically.
Robust filtering and querying options, including pre-built MITRE-based searches for attacks, give security teams the ability to investigate various events that are populated in dashboards and in reports. Securonix also has a designated threat hunting team that continuously investigates environments for new threats so that they can better detect zero-day and low-and-slow attacks. Machine learning builds neural networks from data garnered by the analytics engine and then alters these networks according to security analyst responses. Because this process leads to more SIEM automation, security professionals will see a significant reduction in their workloads.
Several playbooks are provided out-of-the-box to get security teams up-and-running quickly with automated, best-practice responses. If an investigated event requires further action, automated playbooks will take all necessary remediation steps. Teams can also opt to remediate issues manually based on MITRE recommendations, if they prefer. We found creating playbooks on Securonix slightly difficult, however and needed to consult the provided instruction manuals to guide us.
Nonetheless, Securonix Next-Gen SIEM is well-developed and has multi-tiered analytics and built-in support for various compliance frameworks. This highly customizable solution, with its transparent pricing model, extensive pre-packaged analytical capabilities and intuitive investigations, appears more mature than some other SIEM solutions.
Pricing starts at $25,000 for 800 users and includes 24/7 phone, email and website support. Customers have access to a knowledgebase and FAQ list.
Tested by: Tom Weil
