The Devo Platform

My main use case for Devo is predominantly data storage, specifically security log data storage, which provides a great opportunity in terms of cloud data storage. The primary use case I focus on is data sovereignty with country-specific restrictions that helps significantly.

A specific example of how I use Devo for security log data storage includes two components: incident information and raw logs that are being generated. We have specific storage requirements for the customer that we addressed using Devo's SIEM solution.

Regarding my main use case for Devo, since it is a cloud-based platform, I do not need much local or on-premise infrastructure to be hosted, which solves the delays caused by procuring hardware.

Let me dive into one of the customers we have recently worked with, where the key impact points are mean time to detect and mean time to respond. These metrics help any organization identify threats faster, initiate threat hunting activities, and allow us to reduce alert noise and analyst burnout through Devo's SOAR playbooks, making incident investigation efficient without overwhelming tier one analysts with numerous notifications.

Regarding the reduction in analyst burnout and alert noise, the prime concern in security is the time to respond to detected incidents. If an analyst takes hours to respond to a detected threat, the organization risks more breaches, which is mitigated by automated playbooks that assist analysts in focusing on responses rather than spending extensive time investigating incidents.

The best features Devo offers include processing, parsing, and enrichment, which involves parsers that come with logic engines that transform into standardized and searchable schema events, helping in multiple technological environments. I particularly appreciate the Hyperstream engine for analytics and core detection, which powers Devo, driving real-time alerting and the multi-tenancy capability.

These capabilities enhance query performance over massive rolling windows of data without traditional indexing shutdowns, and the correlation and detection rules at large scales for complex multi-stage rules that detect suspicious patterns and anomalous behaviors on attacks are very impressive.

The Hyperstream engine and real-time alerting help my team by leveraging a stream-oriented architecture that minimizes latency during data ingestion. It helps bypass traditional indexing bottlenecks and utilizes advanced nested file storage to achieve high compression ratios, such as 10:1, which reduces storage footprints. Query performance allows for executing complex searches across massive rolling windows, while also eliminating batch processing delays significantly.

In terms of improvements, I believe Devo should focus on refining the pricing component.

Another needed improvement is related to index-free query functionality. Sometimes raw logs are stored without initial normalization, causing some issues. I believe integrating custom parsing and mapping for non-standard logs is essential due to compatibility challenges with various technologies.

I have been using Devo for six years.

Devo is stable.

Regarding Devo's scalability, its horizontal scalability is quite good with no significant hassle, although data storage can be on the expensive side.

Customer support can be improved, particularly in APAC, as they have a small team and response quality sometimes lacks. I would rate the customer support around 5.5 or 6.

We used various SIEM solutions including Microsoft Sentinel, IBM QRadar, Splunk, and FortiSIEM, along with some proprietary SIEM engines including Palo Alto XCM Cortex. Our choice of Devo is often dependent on customer inclination and cost considerations.

I do not have a hard number for ROI, but we achieve early identification of security incidents that could potentially breach the customer environment, which would have been costly. Currently, we are running a lean L1 team, allowing us to provide 24x7 services with reduced operational costs.

The pricing could be simpler, and while the initial setup cost for a new instance is a bit expensive, the licensing can currently be user-based or driven by log volume, which is better if there is expansion of our user base.

Before choosing Devo, we evaluated options including Microsoft Sentinel, FortiSIEM, and Cortex XCM from Palo Alto. It is standard for customers to request comparative views when proposing Devo as a solution.

On a scale of 1 to 10, I would rate Devo a 7.

I chose 7 out of 10 because despite having amazing features, there are still improvements needed in areas such as supportability and integration capabilities with third-party solutions.

Regarding Devo's AI capabilities, the governance and security aspects still need verification as I lack visibility on how AI models are developed and governed.

The accuracy of Devo's AI capabilities is roughly 85 to 90% reliable in terms of output. In terms of deployment, we primarily use public cloud, but have opted for private cloud for one customer due to data sovereignty restrictions.

For our public cloud deployments, we predominantly use AWS and Azure in APAC.

For those looking into using Devo, I would recommend focusing on scalability and out-of-the-box detection engines, particularly on the processing speed of events, MTTD, and MTTR reductions.

I have been using Devo as a partner and system integrator for three years. For log monitoring, the clients' use cases can utilize Devo perfectly.

Compliance and security operation monitoring are the biggest benefits from the product.

Integration is easy, and Devo integrates with most products. Devo has connectors that enhance integration with third-party tools such as firewalls and servers.

Querying helps my data analysis, and it is quite fast. The product provides insight and analytics, and the visualization part contributes to how I understand data insights.

Perhaps Devo could add some features in the future on the network part.

Specifically, I think they could improve network traffic analysis capabilities.

I have been using Devo for three years.

Devo is 99% stable and reliable.

I think it is easy to scale up, but we never did a request for that.

The customer service is average. Technical support from Devo is helpful, but they can improve on the support model.

I think they could improve on the response time.

I have used ArcSight and Splunk previously.

The installation is very easy and seamless.

Devo gives value to the end user and is saving compared to other products in the same category.

I think it saves approximately 10 to 15% compared to similar products.

The price is considered okay.

I work with Devo. When comparing Devo with Splunk and Carbon Black, I think Devo is the leader.

I believe this is because it has the updated technology and component.

Devo has automated machine learning modules that help predict potential threats. The product learns the data and provides additional correlation rules on top of that.

I gave this review a rating of 8.

I am using Devo myself. Basically, I work at an MSSP, and we provide services to the organization for Security Operation Centers. In our Security Operation Center, we provide the service of SIEM via Devo. We also provide the service of SOAR via Devo. We are the vendors of Devo, which is why I have a great experience with it.

The features I find most valuable in Devo are that it works on unstructured data. That is the thing that I appreciate about it. It works on the LINQ query, which is similar to SQL syntax. I appreciate this aspect about it, the searching mechanism and the detection mechanism, making and creating the alerts.

Another valuable aspect is the flow editor, which has helped me a lot in my data analysis. Devo has 400 days of hot storage and you can draw your attack chain from more than a year if you are hunting for threats. The results are very faster because it is working on unstructured data.

Visualizations in Devo are great. You can create dashboards, and in Devo, we call them active boards. So visualization is very good in Devo. We have created active boards with the LINQ query. It is a similar process like Splunk. In Splunk, you have to write the query for rules, alerts, and dashboards, and in Devo it is the same thing. We create active boards via LINQ query and visualize and select the layout and which layout we want to see the things we want to see on our dashboards. We also utilize this visualization in height and monitoring. For instance, if there are geopolitical tensions between countries and we are monitoring one of the SOCs of those countries, we utilize these dashboards and active boards in height and monitoring.

Devo can improve in how its connectors enhance integration with third-party tools. Devo's architecture works by having you deploy a relay server in the data center of the client side and Devo SIEM is basically on the AWS cloud. There are specific ports which are enabled on the relay server, which are 514 and 13000, 13151, 152. However, when we talk about databases and custom integrations, there are not default ports in the relay server. No default ports are defined. For JDBC drivers, the port number is 1433, but it is not in the relay server. You have to add it manually. For Oracle RDBMS, the port is 1521, and it is also not there by default.

I would appreciate more third-party integrations including Fortinet and others. Machine learning models can also be improved. Playbooks in the SOAR can also be improved.

Regarding playbooks for automation, we utilize playbooks for automation in SOAR for automated IOC blocking on a firewall, on a web application firewall, on DNS security, etc. The only option for us to run the playbook is to schedule the job for it. However, if I want to manually run the playbook, there is no option for doing so. This needs improvement.

I have been using Devo for a year.

I would rate technical support from Devo around 7.5 out of 10. Both response time and support quality need attention.

The pricing of the product is reasonable if we compare it with other Gartner leading products like Splunk, LogRhythm, Microsoft Sentinel, Google SecOps. Its licensing model is basically on per-day ingestion on the storage, per GB data. It is calculated on the basis of that. However, I do not exactly know how much they charge for per GB data on a day-to-day basis.

I have majority of experience with Devo and a little bit of experience with Splunk and LogRhythm. I have used its advanced querying capabilities.

MTTR and MTTD are the most critical metrics for me when using Devo's analytics engine. I utilize the threat link metrics in SOAR for calculating my metrics.

Devo's automated machine learning models have helped in predicting potential threats, but it needs improvement. It still requires some work because it is not so much vendor agnostic.

Their SOAR support team is very good, but the SIEM team can do better.

I would rate Devo around 7.5 out of 10 for technical support. Overall, Devo as a product, I would rate it 9 out of 10.

I would appreciate seeing more AI automations in Devo and enhancing Security Operation Center's day-to-day tasks. My overall rating for this review is 9 out of 10.