Netsurion EventTracker

What do you like best?

EventTracker brings together all our Windows, Linux, network, security appliance and other sources of log data, along with IDS and vulnerability scanning. Timely alert emails to critical situations mean we don't have to stare at the system all day. Extremely powerful search capability through all the collected data, that received a significant performance boost with version 9's Elastic search.

They also have the managed SIEMphonic service, which provides periodic analysis and recommendations. Part of the flexibility comes from the custom integrations they will create, in the event you have a system type with which they have not already integrated.

What do you dislike?

Search is extremely powerful, but lacks the simplicity of a general Web search system, e.g., Bing or Google. if you master Lucene query or the older filter criteria search, there shouldn't be much you can't quickly find.

Recommendations to others considering the product:

Having SIEMphonic, at least for the first year, takes a lot of the load off an internal team. They are very easy to work with, when it comes to integrating new/additional systems, monitoring for systems that have stopped reporting in, and keeping you on track with periodic reminders if there's anything your team needs to be doing to resolve a case, finish an integration, or other similar tasks.

What problems are you solving with the product? What benefits have you realized?

Single point of visibility for all log sources, with alerting for critical situations, and configurable retention for trend analysis.

The Windows agent provides an additional layer of endpoint security, augmenting existing remote, perimeter, and endpoint security systems.