Skip to content
SPECIFICTION
Get listed

UTMStack

utmstack.com

From $238.80/mo Free trial Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit utmstack.com
Spec score 8.5 #6 of 36 in Alert Management Software

What it is

UTMStack is an open-source unified threat management platform that combines SIEM and XDR. It provides log management and correlation, threat detection and response, threat intelligence, alert investigation, file classification, SOC AI-powered analysis, and compliance capabilities. Its modules include vulnerability management, access-rights auditing, automated incident response, endpoint protection, dark-web monitoring, and file tracking. The platform correlates data during ingestion before indexing to support real-time detection and reduce alert noise. Deployment options include an ISO, Ubuntu installer, cloud SaaS tenant, virtualized environments, physical servers, and public-cloud virtual machines. Its v11 guide is designed for Ubuntu 24.04 LTS and also notes Red Hat support. The free trial is free; Essential costs $238.80 a month, billed monthly, and supports 25–50 devices on average with 150 GB HOT storage. Deployments above 500 data sources or devices require secondary worker nodes for horizontal scaling.

Spec sheet

What it does
UTMStack combines SIEM, XDR, SOAR, threat intelligence, log management and compliance reporting in one security console.Read 15 Oct 2026 · utmstack.com
Deployment
UTMStack can be deployed with an x86-64 ISO, an Ubuntu Linux installer, a dedicated cloud SaaS tenant, virtualized environments, physical servers, or public-cloud virtual machines.Read 1 Oct 2026 · utmstack.com
API
The REST API exposes alerts, log data, incidents and system management through an OpenSearch-backed interface.Read 15 Oct 2026 · docs.utmstack.com
Integrations
The integrations catalog lists 33 built-in connectors covering operating systems, clouds, firewalls, endpoint security, VMware, databases, Suricata, GitHub and UTMStack health logs.Read 15 Oct 2026 · utmstack.com
Compliance
UTMStack scores nine frameworks, including GDPR, HIPAA, PCI DSS 4.0, SOC 2, CMMC 2.0 and ISO 27001:2022, using a shared NIST SP 800-53 control library.Read 15 Oct 2026 · utmstack.com
Support
UTMStack advertises 24/7 customer service and technical support, while paid cloud tiers include premium support through tickets and chat.Read 1 Oct 2026 · utmstack.com
Agents
Windows, Linux and macOS agents collect logs, execute response actions, self-update and reconnect; the macOS agent requires a paid subscription.Read 15 Oct 2026 · utmstack.com
API tooling
Official API materials include a Postman collection, an OpenAPI file, Bearer-token authentication and documented pagination headers.Read 15 Oct 2026 · docs.utmstack.com
Automated response
Visual response flows can enrich alerts, call APIs, execute endpoint commands, isolate hosts, kill processes, log users off and block IP addresses.Read 15 Oct 2026 · utmstack.com
Cloud hosting
Cloud customers receive dedicated instances hosted on OVHcloud regions in the United States, Canada, United Kingdom, France or Poland.Read 15 Oct 2026 · utmstack.com
Company profile
LinkedIn lists UTMStack as a privately held computer and network security company with 11–50 employees, founded in 2016 and headquartered in Miami, Florida.Read 15 Oct 2026 · linkedin.com
Core capabilities
The platform provides log management and correlation, threat detection and response, threat intelligence, alert investigation, file classification, SOC AI-powered analysis, and security compliance.Read 1 Oct 2026 · github.com
Correlation engine
UTMStack correlates data during ingestion before indexing to support real-time detection and reduce alert noise.Read 1 Oct 2026 · utmstack.com
Detection
The platform advertises more than 600 detection rules mapped to MITRE ATT&CK and evaluates events before storage.Read 15 Oct 2026 · utmstack.com
Documentation scope
Documentation includes installation, agents, SIEM, SOAR, integrations, vulnerability scanning, rules, upgrades, federation and API sections, plus a custom-plugin area.Read 15 Oct 2026 · docs.utmstack.com
Extensibility
Additional sources can send syslog in CEF or LEEF, use the UTMStack agent, call cloud APIs or submit JSON to an HTTP intake.Read 15 Oct 2026 · utmstack.com
Founder
Crunchbase lists Rick Valdes as founder and CEO and describes UTMStack as a private Miami company with 11–50 employees.Read 15 Oct 2026 · crunchbase.com
Installation
The installer targets a dedicated Linux server or VM and typically takes 15–30 minutes; an ISO appliance is also offered for common hypervisors.Read 15 Oct 2026 · utmstack.com
Legal and address
The official site identifies the maker as UTMStack and gives 3301 North University Drive, Suite 100, Coral Springs, Florida 33071, United States.Read 15 Oct 2026 · utmstack.com
Licence
The public repository identifies UTMStack as open-source software under the GNU Affero General Public License version 3.Read 15 Oct 2026 · github.com
Limit: AI availability
A G2 reviewer said the free deployment had no AI integration that they knew of.Read 15 Oct 2026 · g2.com
Limit: report templates
The Software Advice reviewer wanted a more automatic incident-report creator based on templates.Read 15 Oct 2026 · softwareadvice.com
Log search
Log Explorer searches hot and archived data together, including SQL queries and exports, without first restoring archived logs.Read 15 Oct 2026 · utmstack.com
Notable news: v11.3.0
GitHub release notes dated October 13, 2026 describe new GCP, NetFlow and pfSense dashboards, geolocation maps, search improvements and fixes for detection, compliance and agent issues.Read 15 Oct 2026 · github.com
Notable news: v12.0.0
The v12.0.0 release notes add tenant-specific administration, a docked SOC-AI assistant, new SOAR capabilities, AI dashboard creation, API-key settings and a web log-ingestion endpoint.Read 15 Oct 2026 · github.com
Praise: all-in-one correlation
Another G2 reviewer praised the unified SIEM/XDR/SOAR design, pre-ingestion correlation, fewer false positives, no-code compliance builders and AWS/Azure integrations.Read 15 Oct 2026 · g2.com
Praise: ease and value
A G2 reviewer described setup as easy, the free edition as feature-complete, the interface as intuitive, integrations as broad and VM performance as stable.Read 15 Oct 2026 · g2.com
Praise: incident operations
The Software Advice reviewer praised straightforward detection, triage, containment, reporting and 24/7 support for a HIPAA-oriented SOC.Read 15 Oct 2026 · softwareadvice.com
Product scope
UTMStack is an open-source unified threat management platform combining SIEM and XDR.Read 1 Oct 2026 · github.com
Rating on G2
4.4 out of 5 from 9 reviewsRead 15 Oct 2026 · g2.com
Rating on Software Advice
5.0 out of 5 from 1 reviewRead 15 Oct 2026 · softwareadvice.com
Rating on TrustRadius
0 out of 10 from 0 reviewsRead 15 Oct 2026 · trustradius.com
Scaling limit
Deployments above 500 data sources or devices require adding secondary worker nodes for horizontal scaling.Read 1 Oct 2026 · docs.utmstack.com
Security controls
The project states that dependencies are reviewed daily, penetration tests run yearly and after major releases, transport uses TLS, credentials are encrypted, and 2FA and fail2ban are used.Read 15 Oct 2026 · github.com
Security modules
UTMStack lists vulnerability management, access-rights auditing, automated incident response, endpoint protection, dark-web monitoring, and file tracking among its stack modules.Read 1 Oct 2026 · utmstack.com
Self-hosting
Community edition can run free on customer hardware, while Enterprise licensing adds features such as AI agents, extra compliance frameworks, SSO and 24/7 support.Read 15 Oct 2026 · utmstack.com
Supported operating systems
The v11 installation guide is designed for Ubuntu 24.04 LTS and says UTMStack also supports Red Hat systems.Read 1 Oct 2026 · docs.utmstack.com
System requirements
UTMStack v11 recommends Ubuntu 24.04 LTS or a Red Hat-compatible distribution; a small deployment example uses 4 CPU cores, 16 GB RAM and 150 GB SSD.Read 15 Oct 2026 · docs.utmstack.com
Target customers
UTMStack says most of its clients specialize in healthcare, insurance, financial, and energy industries.Read 1 Oct 2026 · utmstack.com
Threat intelligence
UTMStack says its detection uses more than 30 billion IOC elements from live threat-intelligence platforms.Read 1 Oct 2026 · utmstack.com

Plans and prices

UTMStack v11 Free Trial Free 25–50 devices · 4 cores · 16 GB RAM · 125 GB hot storage · SOC AI · premium support Read 15 Oct 2026 · portal.utmstack.com
UTMStack v11 Essential $238.80 a month Monthly 25–50 devices · 4 cores · 16 GB RAM · 150 GB hot storage Read 15 Oct 2026 · portal.utmstack.com
UTMStack v11 Standard $444 a month Monthly 50–100 devices · 6 cores · 20 GB RAM · 250 GB hot storage Read 15 Oct 2026 · portal.utmstack.com
UTMStack v11 Premium $630 a month Monthly 100–150 devices · 8 cores · 32 GB RAM · 480 GB hot storage Read 15 Oct 2026 · portal.utmstack.com
UTMStack v11 Advanced $1,140 a month Monthly 300 devices · 12 cores · 48 GB RAM · 750 GB hot storage Read 15 Oct 2026 · portal.utmstack.com
UTMStack v11 Ultimate $1,908 a month Monthly Up to 500 devices · 12 cores · 64 GB RAM · 960 GB hot storage Read 15 Oct 2026 · portal.utmstack.com

Every UTMStack plan and price →

Strong points and limits

Strong points

  • Combines SIEM and XDR capabilities
  • Lists controls or reports for seven compliance frameworks
  • Supports multiple deployment approaches
  • Alert deduplication, enrichment, routing, and suppression

Limits

  • Paid Essential costs $238.80 a month
  • Deployments above 500 sources or devices need worker nodes
  • Essential supports 25–50 devices on average

Who it suits

UTMStack may suit security teams looking for SIEM and XDR capabilities, compliance reporting, and multiple deployment options. Its listed client industries include healthcare, insurance, finance, and energy.

Verdict

UTMStack brings log correlation, threat response, and compliance capabilities into one platform. Check device and storage allowances against deployment needs, and note that larger deployments require additional worker nodes.

Where Specifiction places it

Alternatives to UTMStackAll alternatives →

MISP From €0.61/mo · Free plan 9.0 Visit