Blumira Automated Detection & Response

Real-time alerting has become even more reliable, and the text messaging for P2 and higher alerts is convenient! Not at the moment! Everything we use it for seems to be working well. Getting real-time alerts to help prevent BEC for our clients has made a huge difference already, and the moment a forwarding rule indicating a BEC is created, we are able to act on it.

Nothing new to add. You have been receptive to our feature requests. We enjoy the monthly newsletters and webinars to keep everyone updated and involved. We have had some challenges when detections come in and we review them from the Finding details summary page. The user was not being displayed, and Blumira listened to our feedback and later implemented. Thank you for listening! One suggestion would be to add something to the Analysis section of the alert/detection to include the involved user. We are looking for ways to automate responses when false positives occur in our customers' environments, and having more details could help. We are open to strategy sessions between Blumira and our teams to work towards a solution. Blumira is helping us tackle a few big challenges—mainly visibility and alert fatigue. Before, we had gaps in our logging and weren’t always catching things early enough. Now, we’ve got much better insight into what’s happening across our environment. The alerts we get are actually useful and not overwhelming, which has been a huge improvement. Plus, the automated response gives us peace of mind that things are being handled, even if we’re not right there in the moment. It's really helped lighten the load for our team.

I really appreciate the included SOC team with Blumira Automated Detection & Response. As part of a small IT team, the SOC team saves us considerable time by eliminating the need for extensive research. Their support is incredibly valuable. Additionally, the setup was pretty simple, thanks to the sales and support staff, who were great at answering any questions. From an IT perspective, there's really nothing to dislike. I use Blumira Automated Detection & Response for indicators of compromise, which alerts us and reduces response and remediation time for security events. The included SOC team is a huge time-saver for my small IT team, handling research and providing great value.

Implementation was straightforward with their step-by-step wizard. I would like more comparisons of log sources, though. The SIEM functionality provides peace of mind on Azure Logs, which is exactly what I was seeking.

Blumira Automated Detection & Response is extremely valuable for its unified dashboard that aggregates all my security tools and alerts into one place. Having a central logging platform for all our security logs is a big plus. I consider the support to be the most beneficial aspect. It's easy to reach out whenever I have a question, and the personalized attention I get because the team is small enough to know me makes it feel like a dependable support system, unlike a huge, impersonal MSP. They respond quickly and are eager to help with complex issues, which is why we renewed. Additionally, the detections, rule customization, and detection filters work well, and the initial setup was very easy—everything was up and running in under a week. The lack of webhook support has prevented us from connecting several other security tools. I'd like faster integrations; we have a few open requests, which I genuinely believe will be fulfilled, but they tend to take a long time. I'd like to see integrations for tools like Seraphic Web Security, Absolute Security, PRTG network monitoring, NUTANIX, and others we use. Also, if custom detections could be developed more quickly, that would be a big plus. Generally, these features work, but the speed of customization could be improved. I use Blumira Automated Detection & Response to consolidate multiple dashboards into one, simplifying monitoring. It serves as a unified logging platform, keeping all security logs in one place.

I appreciate how rapidly Blumira Automated Detection & Response identifies suspicious activity within the Microsoft tenant. It's both quick and easy to manage, enabling me to take action in my organization. For instance, if there's an attempt to access our tenant, a change in 2FA, an incorrect password, or a sign-in from a different country that violates policies, I get this information from Blumira instantly, allowing us to respond in real time. Blumira was also simple to adapt to and use, making it a better choice than our previous tool. The initial setup was straightforward, with just a few extra steps but no issues. Overall, Blumira is fantastic! One minor suggestion would be better communication about the onboarding process, but aside from that, it's great! I rely on Blumira Automated Detection & Response for immediate detection of suspicious activities in my Office 365 tenant, helping me keep an eye on user sign-ins and address potential threats swiftly. Its integration with our MDR agent supports prompt responses to security violations.

Blumira Automated Detection & Response fulfills its purpose perfectly and is continuously getting better. I appreciate that the team behind it is enthusiastic and highly responsive. The onboarding process was unlike any I've experienced—truly the best. It also integrates seamlessly with all our major security and administrative systems. The initial setup was a breeze, making it easy to get started, and the onboarding team was fantastic. If there were one thing I'd change, it would be the customizability of the workflows associated with its findings—I often feel they could be more useful. It provides us with holistic alerting to events and activities we'd likely miss otherwise, highlighting important issues for our small team to investigate.

What stands out most about Blumira is without a doubt their support team. From the engineers during our testing phase, who were quick to jump on Zoom to assist with setup, to the technical support staff, who have been excellent in guiding me through detection rule configuration, analyzing logs to provide more context for findings, and answering any questions we've had, the support has been invaluable. The only downside we've encountered so far is the sheer volume of data we now have access to, but support has been helpful in managing that. Blumira has identified multiple unauthorized access attempts that we were previously unaware of. Additionally, it has been very useful in adding context to alerts such as email rule changes and location-based detections.

From the initial sales interaction through the entire onboarding, the experience has been seamless. The user interface is highly intuitive, and configuration was straightforward thanks to the detailed guidance. The HTTP Ingestion feature, though relatively new, currently has limited default options for onboarding, and I'm excited to see these expand. It's providing valuable insights we previously had no idea about, which alone has eliminated a problem we used to face. A centralized SIEM was essential for us, and Blumira has really delivered on that.

The detection rules are extremely effective at notifying me whenever new inbox rules are set up or when new apps gain access to my MS 365 environment. It also tracks all activity within MS 365 comprehensively, including SharePoint usage, security details like logins and threats, and Exchange online data. The interface is straightforward, allowing me to review alerts and mark them as expected or as actual incidents, which helps in understanding normal vs. abnormal behavior in our IT setup. In my view, this is an outstanding product that I would strongly recommend. My only wish is for broader integration with more IT platforms—there are a couple of major ones I rely on that aren't supported, so I can't pull logs from them. It has resolved my issue of not knowing about potential security incidents promptly, eliminating the need for manual log checks throughout the day. It also saves me time by offering immediate recommendations on how to handle threats. Overall, it provides the visibility and alerts I need to keep my MS 365 environment secure.