The setup was pretty easy, and the free version is pretty complete. I think it's a great option for businesses that are cost sensitive. The UI is intuitive and the features are in places that make sense w/o having to dig around. The software integrates with quite a few technologies, including Windows & Linux Hosts. Performance on the VM I created for it seems fine, and I have not had many issues w/ slowdowns or crashes. Community support for the software has been pretty decent, and we have considered purchasing support. There is no AI integrated that i am aware of.

What I like most about UTMStack is its genuine “All-in-One” approach to security management. Rather than dealing with the high costs and integration headaches that come with maintaining separate tools for SIEM, XDR, and SOAR, UTMStack brings everything together in a single, cohesive ecosystem. From an architectural standpoint, it feels highly efficient. Because it uses its own proprietary correlation engine—instead of relying on heavier, resource-intensive ELK or Kibana setups—it can filter and correlate log data before ingestion. That approach significantly reduces false positives, helps eliminate alert fatigue, and keeps infrastructure costs under control. On top of that, its compliance management capabilities are extremely valuable. The built-in “no-code” compliance builders for frameworks like SOC 2, HIPAA, and ISO 27001 transform what used to be a weeks-long, manual auditing effort into a more streamlined and automated process. When you add in the seamless cloud integrations (AWS, Azure) and the recent AI-driven SOC analysis, it delivers enterprise-grade visibility and automation that still feels accessible for smaller cybersecurity teams.

I've known UTMStack since the early days, when their whole mission was making cybersecurity affordable for small companies — which is exactly what we were. As a cybersecurity company ourselves, compliance isn't optional, and UTMStack has had us covered there from the start. Over the years it's grown into so much more than threat detection. When they integrated the SOC AI they were pioneers in that space, and it genuinely changed how we work — it cuts through the noise and helps us focus on what actually matters. Performance has also been very solid. It has been working with fewer resources than we expected for the amount of data we send, which has been a pleasant surprise. The real-time pre-ingestion correlation is a game changer compared to traditional SIEMs, and the all-in-one open-source approach — SIEM, XDR, SOAR, and vulnerability scanning under one roof — means no more stitching together multiple tools. For a lean security team, that's a big deal both operationally and cost-wise. Yes, the UI could use some polish, but honestly that's the least of my concerns — I'm not here for aesthetics, I'm here for what the core does, and the core delivers. To be honest, I haven’t needed support very often, but when I did open a ticket, I received professional treatment and fast resolution. It supports all major vendors out of the box, but what I really appreciate is that you can build your own integrations on top of it using their flexible ingestion and correlation rules. It's not hard if you read the docs. Overall, it's been a great journey with one of the most capable open-source SIEMs on the market.