How's Adlumin - have you used it?

Boss is looking for a cybersecurity tool - he doesn't know what he's doing or what he wants. I've taken a back seat on this ride because I don't feel respected by him and constantly being asked to do too much.

We've gone through their demo and maybe I'm missing it but I don't see the value.

They can ingest all of our logs, so as a SIEM it works.

Their SOAR seems to lack a lot (I've not used extensively used one before) - they have maybe a dozen or so prebuilt SOAR automation but we can't add our own. On a recent call, they said that they don't really use syslogs (such as from our firewall & AV as part of their "intelligent" threat finding - so as I understand it we can create custom detections but confused as to how this is different than just an alert from an existing system. Our AV already protects against Ransomware.

Their tool doesn't look at or report vulnerabilities - we'd have to go with something like Sophos or syslog them from our AV/MDM tool to them.

Because of cyber security insurance, we wouldn't use them for incident response as they require a specific company to do it.

Even when asked about account logins, it doesn't seem like they can tell if someone is an actual threat actor vs not.

We demo'd one other vendor and their solution was similar to Adlumin but worse.

Am I underestimating the value of them ingesting our client and server logs?