The Devo Platform

I have been using Devo as a partner and system integrator for three years. For log monitoring, the clients' use cases can utilize Devo perfectly.

Compliance and security operation monitoring are the biggest benefits from the product.

Integration is easy, and Devo integrates with most products. Devo has connectors that enhance integration with third-party tools such as firewalls and servers.

Querying helps my data analysis, and it is quite fast. The product provides insight and analytics, and the visualization part contributes to how I understand data insights.

Perhaps Devo could add some features in the future on the network part.

Specifically, I think they could improve network traffic analysis capabilities.

I have been using Devo for three years.

Devo is 99% stable and reliable.

I think it is easy to scale up, but we never did a request for that.

The customer service is average. Technical support from Devo is helpful, but they can improve on the support model.

I think they could improve on the response time.

I have used ArcSight and Splunk previously.

The installation is very easy and seamless.

Devo gives value to the end user and is saving compared to other products in the same category.

I think it saves approximately 10 to 15% compared to similar products.

The price is considered okay.

I work with Devo. When comparing Devo with Splunk and Carbon Black, I think Devo is the leader.

I believe this is because it has the updated technology and component.

Devo has automated machine learning modules that help predict potential threats. The product learns the data and provides additional correlation rules on top of that.

I gave this review a rating of 8.

I am using Devo myself. Basically, I work at an MSSP, and we provide services to the organization for Security Operation Centers. In our Security Operation Center, we provide the service of SIEM via Devo. We also provide the service of SOAR via Devo. We are the vendors of Devo, which is why I have a great experience with it.

The features I find most valuable in Devo are that it works on unstructured data. That is the thing that I appreciate about it. It works on the LINQ query, which is similar to SQL syntax. I appreciate this aspect about it, the searching mechanism and the detection mechanism, making and creating the alerts.

Another valuable aspect is the flow editor, which has helped me a lot in my data analysis. Devo has 400 days of hot storage and you can draw your attack chain from more than a year if you are hunting for threats. The results are very faster because it is working on unstructured data.

Visualizations in Devo are great. You can create dashboards, and in Devo, we call them active boards. So visualization is very good in Devo. We have created active boards with the LINQ query. It is a similar process like Splunk. In Splunk, you have to write the query for rules, alerts, and dashboards, and in Devo it is the same thing. We create active boards via LINQ query and visualize and select the layout and which layout we want to see the things we want to see on our dashboards. We also utilize this visualization in height and monitoring. For instance, if there are geopolitical tensions between countries and we are monitoring one of the SOCs of those countries, we utilize these dashboards and active boards in height and monitoring.

Devo can improve in how its connectors enhance integration with third-party tools. Devo's architecture works by having you deploy a relay server in the data center of the client side and Devo SIEM is basically on the AWS cloud. There are specific ports which are enabled on the relay server, which are 514 and 13000, 13151, 152. However, when we talk about databases and custom integrations, there are not default ports in the relay server. No default ports are defined. For JDBC drivers, the port number is 1433, but it is not in the relay server. You have to add it manually. For Oracle RDBMS, the port is 1521, and it is also not there by default.

I would appreciate more third-party integrations including Fortinet and others. Machine learning models can also be improved. Playbooks in the SOAR can also be improved.

Regarding playbooks for automation, we utilize playbooks for automation in SOAR for automated IOC blocking on a firewall, on a web application firewall, on DNS security, etc. The only option for us to run the playbook is to schedule the job for it. However, if I want to manually run the playbook, there is no option for doing so. This needs improvement.

I have been using Devo for a year.

I would rate technical support from Devo around 7.5 out of 10. Both response time and support quality need attention.

The pricing of the product is reasonable if we compare it with other Gartner leading products like Splunk, LogRhythm, Microsoft Sentinel, Google SecOps. Its licensing model is basically on per-day ingestion on the storage, per GB data. It is calculated on the basis of that. However, I do not exactly know how much they charge for per GB data on a day-to-day basis.

I have majority of experience with Devo and a little bit of experience with Splunk and LogRhythm. I have used its advanced querying capabilities.

MTTR and MTTD are the most critical metrics for me when using Devo's analytics engine. I utilize the threat link metrics in SOAR for calculating my metrics.

Devo's automated machine learning models have helped in predicting potential threats, but it needs improvement. It still requires some work because it is not so much vendor agnostic.

Their SOAR support team is very good, but the SIEM team can do better.

I would rate Devo around 7.5 out of 10 for technical support. Overall, Devo as a product, I would rate it 9 out of 10.

I would appreciate seeing more AI automations in Devo and enhancing Security Operation Center's day-to-day tasks. My overall rating for this review is 9 out of 10.

My main use case for Devo is that it serves as a primary tool for centralized logging solutions, mainly for threat investigation and alert monitoring. It helps us with security and analytic analytics, as we collect all the logs from multiple servers across our three clouds: AWS, GCP, and Microsoft Azure. Devo helps us correlate those events and assists in the investigation of any suspicious activity or improving our incident management lifecycle.

A specific example of how I use Devo for threat investigation and alert monitoring is that since Devo acts as a centralized logging solution in our company, whenever we face any kind of security alert, such as unauthorized usage of our system or alerts related to threats, we use this tool. This tool provides data in a very fast manner because it utilizes all the data in its raw format. The queries we run in Devo give results quickly, and it integrates well with our ServiceNow tool, so as soon as there is a suspicious activity in our systems, an alert gets generated from ServiceNow.

Devo has positively impacted our organization because we have been using only one tool for our centralized logging systems. Previously, we used Microsoft Azure's Microsoft Sentinel, which gathered data but was costly and less user-friendly. When we learned about Devo and its features, UI experience, reporting capabilities, and threat detection automation, we moved to Devo. We also manage other customers, and whenever they come to us, we introduce them to Devo's logging tools, and they are always happy to accept it as their centralized logging system. No one has provided negative or bad reviews for using Devo, and I believe both we and our customers are very happy using it.

I can say there has been an improvement in incident response with Devo. It serves as the main solution for all log ingestion across AWS, Azure, GCP, or Oracle Cloud, capturing data from all these clouds. Any unexpected or suspicious behavior or activity from unknown users simply generates a ticket with the help of ServiceNow, integrating seamlessly with third-party tools. I think that is a great feature for us and our customers, as they receive incident reports in a very fast manner with Devo's assistance.

The best features Devo offers include its focus on security investigation as a SIEM tool. Our SOC and NOC teams mainly depend on this tool for security operations and data analytics. For them, this tool is the main foundation for their daily work, which I believe is a key feature for Devo.

Devo stands out for our SOC and NOC teams compared to other tools such as Elastic because of its SIEM capabilities for threat detection and investigation. It utilizes 400 days of hot data, allowing queries to run very fast and yield results quicker than other tools in terms of security and SIEM capability. The 400 days of long-term data retention for searchable log data without transitioning to cold storage is significant. If data moves to cold storage, it takes time to retrieve it into hot storage, but Devo provides hot data for 400 days. The security orchestration is an exceptional feature of Devo for our SOC and NOC teams.

I think some features could be added to Devo. The cost is a little higher compared to other tools such as DataDog or Elasticsearch, so they could work on reducing costs. Additionally, while the support team is good, I feel that the documentation is not always very helpful for some use cases, so improvements could be made in the documentation as well.

The UI configuration could be simplified for new users. While it may be straightforward for seasoned users, new users often feel confused by the vast options available in Devo's UI. I believe there is room for improvement in that area.

I have been using Devo since I started working in my current company, which has been for the last two years.

Previously, we used Microsoft Azure's Microsoft Sentinel, which gathered data but was costly and less user-friendly. When we learned about Devo and its features, UI experience, reporting capabilities, and threat detection automation, we moved to Devo.

Devo stands out for our SOC and NOC teams compared to other tools such as Elastic because of its SIEM capabilities for threat detection and investigation.

There are other improvements needed when comparing Devo with other tools on the market, especially since we have started using Elasticsearch for DevOps and infrastructure. Elastic is much better and less costly than Devo, and it offers a free tier for first-time use, allowing users to gain a good understanding of the tool. Due to this, we have stopped using Devo in our company for the past six months and have transitioned to Elasticsearch, which is performing well.

Devo's main job is to provide a centralized logging system, so we do not have to use other logging systems for other servers. It helps us correlate events from our clouds and third-party clouds, providing all those solutions in one system. Devo is a great tool for anyone to analyze logs and reports.

Devo helps our teams with incident investigation and security monitoring, and it also assists in providing compliance reports, which helps us improve our systems day by day.

My advice to others looking into using Devo is that if you have a large or even small customer project and want to utilize SIEM and security threat analytics, you should consider Devo. It is a great tool. However, if you need infrastructure monitoring and DevOps observability, you might want to opt for Elasticsearch. I rate Devo an eight out of ten.

One practical scenario involved investigating suspicious authentication activity where we had to review logs from multiple sources. Devo helped us centralize the data and allowed the team to investigate faster by correlating the logs instead of checking multiple systems separately.

Devo functions as our centralized visibility and investigation platform, integrated with security workflows. It becomes more valuable when multiple log sources are connected together because it provides a unified SIEM solution.

Typically, we have integrated Devo into an enterprise monitoring environment, which supports centralized log collection and analytics.

In our day-to-day work, fast querying and correlation help reduce our effort because our SOC analysts do not need to manually switch across systems for logs. Correlated visibility helps speed up the investigation and provides more context for decision making. When the analyst uses queries to search, it pulls the data quickly, in a second, which aids us greatly with the investigation.

Devo helps us improve visibility across different environments and allows better incident tracking. The search and analytics capability is also useful for our teams as well as the security teams.

Devo has improved our visibility, log management efficiency, and investigation capabilities positively. Teams are able to investigate events with better context and faster access to the relevant data.

Our analysts can investigate faster when using Devo. It has absolutely reduced our investigation time, improving our investigation quality as well. This helps security teams respond more efficiently.

Devo's main value comes from improved investigation speed. It has improved significantly, and its centralized visibility has reduced our effort in log analysis.

UI improvements, a simplified dashboard, or an easier reporting workflow could further improve analyst productivity.

I rate the customer support a nine out of ten because of their timely technical guidance and responsiveness during the deployment and troubleshooting periods.

Devo provides a good experience overall. It is an enterprise-grade monitoring platform.

I would rate this review an eight out of ten.