This document provides a summary of new features in AlienVault USM v4.5, including: - A new look and feel with improved user interface. - A plugin suggestion engine to help users identify and enable plugins for assets. - A new errors and warnings dashboard to monitor system health. - Improvements to the first time wizard for easier log management configuration. - New built-in status monitors to check for failure conditions. - Alarm tag forwarding in federated environments to identify the source of alarms. The document also describes a new USM health check service to optimize USM deployments.

1. MARCH 2014
What’s New in AlienVault USM v4.5?
USM Customer Webinar

2. AGENDA
Feature Overview
Examples of how to use
USM
New Health Check
Service Offering
Questions

3. New v4.5 Features

4. SUMMARY OF NEW FEATURES
New Look and Feel New Plugin
Suggestion Engine
New Errors and
Warnings Dashboard
First Time Wizard
Improvement
New Status Monitors Alarm Tag Forwarding

5. NEW LOOK AND FEEL
Feature Summary:
 Color, layout, and style improvements
 Common library of UI elements (buttons, tables,
interaction, workflow)
Value to You:
 More intuitive, consistent, and easy to use
 Predictable, consistent interaction and workflow
 Reduced learning curve, increased time to value
– “results in day one”

6. PLUGIN SUGGESTION ENGINE
Feature Summary:
 Identify assets sending data but with no plugin enabled
 Identify assets not sending data and with no plugin
enabled
 Offer suggestions and built-in workflow to enable the
proper plugin
Value to You:
 More easily identify assets with no data collection and
help the user easily enable the right plugin
 Increase time to value when configuring new assets.

7. NEW WARNINGS & ERRORS DASHBOARD
Feature Summary:
 Warn administrators of conditions that require
attention
 Provide suggestions on how to resolve the error
or warning
Value to You:
 Self-monitoring to prevent system failure
 Proactive notification

8. FIRST TIME WIZARD IMPROVEMENT
Feature Summary:
 Separated the Log Management step into two
separate pages
 Provide better clarity about each asset, plugin
selected, and if AlienVault is receiving data.
Value to You:
 Make the log management section more intuitive
and easy to use.
 Provide better information to tell the user if
AlienVault is collecting data or not.

9. NEW STATUS MONITORS
Feature Summary:
 Built-in monitors to assess the system for failure conditions
Monitors Available:
 The Asset is not sending any log to the system
 Asset is sending log to the system, but there isn't a plugin enabled to parse the logs
 The Asset was successfully sending logs to the system, but no log received within the
last 24 hours
 The System is dropping packets, overloaded
 The System is dropping packets, malformed network packets
 The System Disk space is under 25%
 The System Disk space is under 10%

10. ALARM TAG FORWARDING
Feature Summary:
 Alarms sent from a child server in a federated
environment are tagged to uniquely identify the
source
Customer Value:
 Better support in MSSP, federated environments
 Allow users to more easily discern what child
server an alarm was generated on

11. Use USM to
Answer Simple
Questions

12. Is one of your system administrators running a
bittorrent in the data center?

13. What known malicious hosts are your systems
talking to?

14. Which of my vulnerable assets are under attack?

15. Introducing…
USM Health Check
Service

16. Let us help you tune your AlienVault USM
deployment so you can maximize the value of
your investment.
USM Health Check Service
Validate that USM components are performing
optimally and within specification
Assess directives, policies, and alarms to get you
results you are expecting
Provide guidance on how to most effectively utilize
USM to get results.
Deliver a comprehensive findings report to drive
correction and improvements.

17. This Service Is For …
Who have …
A single All-in-One [25A, 50A, 75A, 150A,
or Standard]
A Standard USM Server, Standard Sensor
and Standard Logger combination
A Standard USM Server or All-in-One with
up to 5 remote sensors
Other Options Available
Existing
s

18. A Certified AlienVault Consultant will …
Spend one day (8 hours) to evaluate your deployment
Services performed remotely
Evaluate …
Operating system configuration and health
• Query performance and indexing response times
• USM content memory utilization
• Sizing, capacity, and growth metrics
• Data collection and plugin health
• Policies to determine false positives and optimization options
Report delivered at the end of the engagement to provide …
• Investigation results
• Any remediations done during the engagement
• Recommendations

19. Contact support@alienvault.com
Interested?