Features comparison WAZUH | AlienVault | RSA

[Azhar Hj.Mohd Ghazali]

Hi,

If you dont mind, can share me the features comparison for above products.

Thanks

[Facundo Orsi]

Hi Azhar, I hope you are doing well.

I've prepared the following comparison between Wazuh, Alienvault OSSIM (Open Source alternative), Alienvault USM (Commercial version) and RSA Netwitness. Have in mind that the commercial alternatives (NW and USM) need other components to obtain full functionality or the same features that you can get with the unified Wazuh platform. 

Features	Wazuh	Alienvault OSSIM	Alienvault USM	RSA Netwitness
Open-source platform
Auditable code
Public roadmap
Endpoint / Container oriented solution
High Availability / Cluster deployment
Horizontal scalability and auto-scaling
Lightweight modular components
Log data collection
Signed archival data storage
Correlation and cross-correlation
File integrity monitoring (FIM)
Auditing who-data
Anomaly and malware detection
Security configuration assessment
Monitoring system calls				with Endpoint component
Command monitoring
Active response				with Endpoint component
Anti-flooding mechanism
Automated system inventory				with Endpoint component
Host-based vulnerability detection				with Endpoint component
VirusTotal integration
Osquery
Fluentd forwarder
Native JSON support
NIDS Integration (Suricata, Snort, Zeek, etc)
Elastic stack integration
Kibana visualizations / Advanced Dashboards
Cloud-based alternative
Monitor cloud environments (AWS, Google
Orchestration and deployment integration (Ansible, chef, puppet, etc)

Let me know if you find this information helpful!

Regards.

--

Facundo Orsi 
Security Engineer
The Open Source Security Platform

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/CAPqNNT1p3F7-O-BcfqsCjNbxfURuy8Luz3KWvkJ_XxBWFJJT2A%40mail.gmail.com.

[Blason R]

Nice man!! Looks like much effort put there to prepare those.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/CAG65QjZ9tWJzGDPSYfoR95X8bLhvsuVJQk9SQ%2B4W69qFXt2tRQ%40mail.gmail.com.

[Azhar Hj.Mohd Ghazali]

Hi facundo

Greats matrix of comparison.

Really appreciate it.

Thank you.

[Facundo Orsi]

Hello Davide, it means that the archived (cold storage) files have a checksum calculated (signature) against it and stored on a related file to check if the file has been tampered with. For example:

- Historic compressed alert file with its corresponding checksum file:

- Content of the checksum file:

Hope this clarifies!

Regards.

--

Facundo Orsi 
Security Engineer
The Open Source Security Platform

On Wed, Mar 3, 2021 at 10:35 AM Davide Bozzelli <davide....@gmail.com> wrote:

Hi

What you mean with "Signed archival data storage" ?

tHX 

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/CAG65QjZ9tWJzGDPSYfoR95X8bLhvsuVJQk9SQ%2B4W69qFXt2tRQ%40mail.gmail.com.

--

Got problems with Windows? - ReBooT
Got problems with Linux? - Be RooT

[Facundo Orsi]

No problem! Just let us know if you need anything else and, as always, thank you very much for posting on the community!

Regards.

--

Facundo Orsi 
Security Engineer
The Open Source Security Platform