Hi everyone, I'm new here and trying to figure out a security monitoring tool for our small software company. We're a team of about 20 engineers, and we're starting to get more serious about our internal security. Our CTO mentioned looking at LogRhythm.
From what I've read online, it seems like a massive, powerful platform used by huge enterprises. That's a bit intimidating, honestly. For a team our size, with no dedicated security analysts, is this overkill? We basically want to monitor our cloud infrastructure (AWS, some Azure), our GitHub org, and maybe some internal app logs for suspicious stuff.
My main questions are:
- How steep is the learning curve for engineers who aren't security experts?
- Is the pricing model feasible for a smaller team, or is it really built for big budgets?
- What does the day-to-day management look like? Would it consume a lot of our time just to keep it running?
I'm grateful for any insights from people who've implemented it in smaller tech teams. We don't need all the bells and whistles, just something effective that won't require a full-time person to manage. Thanks in advance for your help
Yes, it's overkill. You'll drown in licensing costs and complexity before you even get a useful alert.
For a team your size, look at something like Datadog's security monitoring or even a well-configured ELK stack with some alerting rules. Your engineers can grok that in an afternoon. LogRhythm needs a dedicated operator just to keep the beast fed, which is exactly what you said you don't want.
You'd spend more time managing the SIEM than actually securing your stuff.