Logentries Reviews

Graylog is the AI-powered SIEM and log management platform built for teams that need clarity, speed, and control. It unifies event data from every corner of the environment so security and IT operations can detect threats sooner, investigate faster, and manage data costs predictably—without compromise. Graylog delivers explainable AI that highlights what matters, accelerates investigations, and guides consistent response—while keeping analysts firmly in control. Its open, extensible architecture integrates easily with the tools organizations already use. With Graylog Security, Enterprise, API Security, and Open, more than 60,000 organizations in 180 countries rely on Graylog to simplify detection, strengthen response, and cut through noise. Headquartered in Houston and rooted in open source, Graylog continues to help modern teams work smarter and stay ahead—on their terms.

Manage Engine's EventLog Analyzer stands out as the most cost-effective security information and event management (SIEM) software in the market. This secure, cloud-based platform encompasses vital SIEM functionalities such as log analysis, log consolidation, user activity surveillance, and file integrity monitoring. Additional features include event correlation, forensic analysis of logs, and retention of log data. With its robust capabilities, real-time alerts can be generated, enhancing security response. By utilizing Manage Engine's EventLog Analyzer, users can effectively thwart data breaches, uncover the underlying causes of security challenges, and counteract complex cyber threats while ensuring compliance and maintaining a secure operational environment.

File Activity Monitoring on Servers – Monitor who is creating, accessing, or transferring your files and directories, while also tracking changes to file permissions. Receive immediate notifications regarding critical file operations and contain malicious actions, such as ransomware attacks and mass file deletions. Automatically mitigate risks to your Windows servers by executing PowerShell scripts, allowing you to specify precise responses for various alerts and threats. Containment strategies could include: - Disabling the user responsible for the threat - Blocking the remote IP address associated with the threat Workstation File Activity Monitoring: Keep track of who transfers files to USB drives or other external storage devices. Monitor file uploads via FTP or web browsers and prevent file creation on USB or removable media. Get email alerts whenever a removable device is connected. Active Directory Monitoring – Maintain audit records and receive immediate alerts regarding significant changes in Active Directory, eliminating the need to navigate SACLs or Windows Event Logs. Server Authentication Monitoring: Observe authentications in Citrix sessions and Windows Servers, ensuring that all unsuccessful login attempts are logged and reviewed. Workstation Logon/Logoff Monitoring: Gain insight into user logon and logoff activities at workstations, which includes tracking locks, unlocks, and password changes, thereby enhancing overall security awareness. This comprehensive approach ensures that all user activity is recorded, providing a clearer picture of network interactions.