Unomaly

I like the fact that Unomaly starts to return valuable insights to what's going on immideatly. And that adding the Unomaly superpower is as easy as sending the logs!

Starter sets of "knowns" should be supplied. Events that is known garbage should be filtered, and the nasty ones should be lifted regardless of their cadence.

We catch failures in our services early, often before the users notice anything!

Makes finding anomalies in systems (logs look very easy, pretty much does all the work for you, and can be taught new stuff easily on the run. Can go through large amounts of data with no problems. Software is updated regularly, and user feedback is taken seriously.

Not many downsides to really mention, actually can't think of any at the moment... It's not free?

Give it a try, it's easy to set up.

Don't have to set up complex rules for log monitoring, or spending hours going through log files manually.

That it filters out the noise and shows what is relevant

A bit expensive but if it helps us prevent an attack it's worth it.

It is an extra layer of security. New events that are important are communicated and compliance with existing routines is checked. We are also using it to monitor scheduled jobs and audit logs.

The best thing is the overview enabling us to act before things become an issue.

Setting up the system and adding nodes are done in minutes.

Should you ever run into an issue the Unomaly support will literally help you within minutes.

The updating of the server could be a bit smoother, from the web interface for instance.

If you try it, be prepared to buy it.

We get an overview of our systems that is not possible without this system.

Users reaching quotas, services not running are some of the things we pick up on very fast.

Excellent tool when you don't really know what you are looking for.

A bit strange with the different systems showing up.

To find situations that don't comply with the normal operations.