It allows me to extract specific logs with the System Monitor agent in a very precise manner (Windows events easily, the events we want from Linux/UNIX) and the server is capable of forwarding the logs to other SIEM systems just as it receives them, allowing it to become an on-premises pivot. Another additional point is that the agent allows for FIM very easily without consuming resources. Review collected by and hosted on G2.com.

The web UI should be more user-friendly, as there are other next-generation SIEMs with better graphical interfaces. Review collected by and hosted on G2.com.