What is our primary use case?
We are a small company located in Bermuda with a team of 42 people. Specializing in reinsurance, we offer a range of reinsurance products from around the world. During a recent cybersecurity gap analysis, it became apparent that we needed to enhance our network and security monitoring capabilities beyond the capacity of our current 42-person team. Within the company, only three individuals work in the IT department, making it impractical to assign someone to security log monitoring around the clock.
To address this challenge, we have implemented Netsurion Managed XDR. This product, previously familiar to me from past professional experience, aggregates logs from our various devices including workstations, servers, switches, routers, and firewalls. These logs are then centralized on our on-premise servers, which are linked to Netsurion Managed XDR's security operations center. This center is staffed with experts who analyze the collected data, providing us with valuable insights. They promptly alert us through email, phone, and text if any unusual or critical activities are detected. These activities could range from unauthorized access attempts to anomalous Internet or firewall activities.
The system also offers weekly observation reports, categorizing activities using color codes ranging from red to green. This report covers a spectrum of information such as account lockouts and Internet activity. I have also specifically requested alerts for any usage of administrative passwords. Additionally, we engage in monthly review meetings where we assess the previous month's data, including a Power BI report that delves into trends and various monitoring aspects.
Another key service we utilize from Netsurion is their vulnerability assessment scanner. This monthly assessment involves scanning all our systems within the network to identify security vulnerabilities and needed updates. It's comparable to having a simulated penetration test, ensuring our systems are robust against potential threats. The resulting report provides valuable insights into our security posture.
In essence, Netsurion Managed XDR fills the crucial role of network and security monitoring that our internal team cannot handle alone. It's akin to having a dedicated 24/7 security team constantly scrutinizing our network for threats. The system not only detects immediate issues but also assists us in enhancing our security measures for the long term. For instance, based on their recommendations, we have successfully blocked requests originating from certain countries, such as the Russian Federation, China, North Korea, and Iraq. This proactive measure has significantly reduced the unnecessary traffic targeting our network.
Our experience with Netsurion's services has been exceptional. Their expertise and support are of the highest quality. As I had worked with them at a previous company, I sought them out again for our current needs. Particularly for a smaller company lacking a dedicated security team, this solution has proven to be one of the most effective ways to bolster our cybersecurity defenses. Their capabilities align perfectly with our requirements, and their professionalism makes them an ideal partner in safeguarding our digital environment.
How has it helped my organization?
One of the primary benefits of using Netsurion for our organization is that, due to a mandate from our regulator, we are required to have robust monitoring platforms in place. We now possess our own monitoring platforms, which allow me to oversee various aspects. Moreover, we have implemented a 24/7 monitoring platform, ensuring complete compliance with regulatory standards.
Netsurion offers a flexible solution that assists us in safeguarding our entire IT environment. This has significantly enhanced its robustness over time because they have been able to identify trends. Subsequently, we can adjust settings. Initially, when we implemented the product, we noticed more issues that, with time, would turn red or become more critical. These included instances where certain activities were not being blocked or when excessive permissions were granted to users in terms of access rights and similar matters. By analyzing trends over time, we have been able to refine the network, thereby achieving a higher level of overall security based on the insights provided by their monitoring.
The way the SOC service operates is by providing us with a dedicated team. This team usually consists of around four to five individuals participating in monthly calls. Essentially, this team, which is assigned to various companies, including ours, remains consistent. The individuals we interact with are familiar with our environment, and over time, we establish a rapport with them. Their contributions are highly valuable. It's akin to having a specialized team solely dedicated to handling our security concerns. Unlike a situation where we would interact with random support personnel for each inquiry or ticket, these individuals possess a deep understanding of our company as they consistently work with us. This arrangement eliminates the need to repeatedly transfer knowledge. They are well-versed in our history, the current state of our environment, and the specifics of our network. This setup operates 24/7, ensuring that meetings and communications align with my schedule. Furthermore, we receive updates even outside of regular working hours. This SOC service is available to us, and in my opinion, it's an excellent setup. The continuity of interacting with the same group of professionals allows us to establish relationships, not only with the individuals themselves but also with the company as a whole. This dynamic significantly enhances the trust we place in their services.
The SOC handles alert monitoring and threat hunting extremely well.
Reducing false positives is a crucial aspect of the tuning process we engage in. At the outset, we receive alerts for all activities, treating everything as a potential issue. However, we gradually refine this approach. For instance, we develop custom applications for our company. In collaboration with Netsurion, we've integrated their system to whitelist specific processes associated with our proprietary applications. To Netsurion, some of these processes might seem suspicious, such as activities involving the SQL database, potentially appearing as hacker activity. Nevertheless, this is not the case, and these actions should be permitted since they originate from our authorized service. It's highly beneficial to maintain this collaborative relationship. This allows us to fine-tune our system, minimizing the occurrence of false positives.
The SOC plays a crucial role in incident response. When issues arise, they are promptly prioritized. We have a specific prioritization process that feeds directly into our service desk. This enables us to initiate our incident response testing promptly. Additionally, the SOC identifies other potential concerns. For instance, we are currently investigating a situation involving suspicious DNS queries originating from specific IP addresses. Presently, we are actively examining this issue. While it appears suspicious at the moment, it has not been confirmed as an exploit or an actual event. Our standard procedure involves thoroughly investigating the matter and documenting all actions taken. Any actions we take become part of our response protocol. If the situation warrants, it might be escalated to the IT committee. Regardless, all actions and findings are meticulously logged in our service desk for future reference.
I appreciate that the SOC handles platform management. It's pleasant not to be directly involved with managing the tools themselves. Essentially, what we do is utilize an agent. This involves configuring an agent that is deployed universally. Additionally, they handle the configuration of SysLog services and similar tasks. Apart from these aspects, they take care of everything else. They provide the server and are responsible for updates, including those related to the internet. When it comes to integrations, they've established connections with our firewalls, antivirus, and email security gateway. This facilitates the retrieval of logs and security details, which they collaborate with us on. I'm relieved that I don't have to concern myself with updating their software. In our monthly meetings, they discuss new exploits they've come across, often with amusing names like "monkey dine," and their efforts to identify telltale traces of potential threats within systems. This proactive approach is commendable. Their management of these aspects allows us to concentrate on using the platform. For me, it's comparable to owning a car. When I buy a car, I can operate it, but I don't need to understand its engine intricacies. In the same manner, Netsurion Managed XDR has been a boon for us. It has consistently proven beneficial across the various companies I've worked with. Unlike setting up our own monitoring systems, which can be time-consuming, Netsurion Managed XDR's implementation is relatively swift. While there's an initial learning curve, within a few months, the value becomes evident. The insights provided are exceptional. Certain reports are even presented to the IT committee I report to, serving oversight purposes. These reports are also instrumental for compliance and audits. Netsurion Managed XDR is a third-party solution, impartial in its reporting. They provide compliance reports alongside their software tools. From my perspective, it's one of the essential tools. Over the course of my professional experience, there are a handful of products and services that I've found indispensable, and Netsurion Managed XDR is one of them. I used to use the Netsurion Managed XDR in my previous company, which was a relatively larger company.
The SOC has enabled us to fully concentrate on everything else that we need to do. Knowing that the segment, the monitoring, the event tracking, and the alerting are taken care of by someone else gives us the confidence that if something happens, we will be notified. This allows us to focus on tasks that are more aligned with our experience and the size of our IT departments. If an issue arises and it's critical, I will receive prompt notification. If it's not critical, I will receive an email from them the following day, or it will be included in an observation report. It will definitely be discussed in the monthly review meeting.
If we didn't have Netsurion Managed XDR, I would be looking at logs, and we'd be relying on antivirus and our own monitoring to see if something was untoward. We just wouldn't have the insight and visibility we have now. And I didn't have it before. We had monitoring, but nothing as in-depth as we have with Netsurion. So has it decreased the amount of time we spend on it? I would say it would have if we'd been able to do some of the stuff that they do, but we really couldn't do it. We didn't have the time. We didn't have the tools to do it. For us, it's been a total value add in terms of the capability, rather than the time saved because we were unable to do the tasks before.
What is most valuable?
The most valuable feature is definitely real-time alerting, especially in situations where someone might attempt to exploit or hack into our network. For instance, if there's an unusual activity with user accounts, like a sudden surge in login attempts, the system promptly sends notifications via email, text, and even phone calls if our initial response is lacking. This holds true regardless of the time, even if it's as late as two in the morning. This capability provides me with a sense of security. Apart from this, my colleagues and I lack the time to meticulously sift through extensive logs and data. Having someone else handle the task of comprehensively analyzing the information we generate, not only pinpointing potential risks for us to counteract but also alerting us in real-time, is immensely valuable. It's truly impressive. Our workload prevents us from achieving this level of vigilance, even if we were to hire more staff. Their performance in this regard is unparalleled.
What needs improvement?
I appreciate the recordings that Netsurion provides on Power BI for our monthly meetings. I would also like to have a dashboard that I can access anytime to review the real-time data from their website.
For how long have I used the solution?
I have been using Netsurion for almost two years.
How are customer service and support?
I have an email address for SOC. When communication originates from my domain email address and is received, it goes to the same group of individuals. Therefore, their technical support and related services are consolidated under this single email address for us. We consistently interact with this group and they manage tasks on the backend. We engage with them frequently. What I need to communicate is if we encounter anything suspicious. We have an alert in CrowdStrike, and we are seeking additional details from them regarding specific matters. They are highly responsive to our requests.
The support team is remarkably persistent in their efforts to get back to us. Even to the extent that it becomes a bit bothersome. I think they're doing a fantastic job. There's always someone available, and they conduct well-organized meetings. Everyone is very pleasant. Overall, I think they're great. The only downside and I say this because we're part of a small team, is that sometimes the persistent ones get their message across. It's a positive thing that they maintain the momentum, keep bringing up matters, and continue sending emails. So, naturally, we keep pushing it down the priority list, but it's worth dedicating those thirty minutes to it.
How would you rate customer service and support?
How was the initial setup?
The initial setup is straightforward. When it comes to configuring their servers and the main stations here, the process is fairly simple. Rolling out agents for all our intended applications is also relatively uncomplicated, as we are accustomed to deploying such items regularly. However, the true value lies in the subsequent steps, particularly in terms of integration. This integration involves working seamlessly with CrowdStrike, coordinating with firewalls, configuring routers, and setting up switches to transmit their Syslogs to the designated systems. This entire integration process remains quite straightforward due to the presence of their comprehensive knowledge base and their continuous collaboration with all products.
One of the topics under discussion today concerns a project in which my team and I are encountering a delay. This relates to our utilization of Kempflow balancers, both internally and externally. Essentially, these load balancers direct incoming traffic along various pathways based on resource availability and security parameters. Currently, these balancers are not reporting data to Netsurion Managed XDR, primarily due to its status as a specialized product and the previous lack of an integration guide. However, this has changed, and now there exists an integration guide. The delay for integration lies with us, and this process begins with an easily manageable initial deployment. However, as we expand and enhance the system, it has the potential to become complex due to its involvement in network-wide monitoring, which is our intended outcome.
Realistically, it may take a few months, approximately 90 days, to start deriving benefits from this initiative. Yet, even after this period, we are still in the process of integrating certain elements. These outstanding integrations are pending due to the involvement of my team members.
What other advice do I have?
I would rate Netsurion a ten out of ten. I have been managing networks and IT departments for 25 years, and there are a few services that I find both wonderful and absolutely essential. Among these, Netsurion Managed XDR holds the highest importance for me. Without it, I wouldn't be able to gain the insights into our network that I currently can. There's no economically or technically viable way to achieve this. Despite being a relatively small company with a workforce of 42 individuals, I essentially possess my own security team consisting of five or six people and the array of tools they have at their disposal. Outsourcing this function or hiring personnel for it isn't feasible. While I am a security professional myself, the value brought by this service is unmatched even if I were to engage a consultant. The level of value it provides is truly remarkable. For example, we allocate approximately $65,000 dollars annually for this service, and I firmly believe that the investment is completely justified for us.
We make use of Netsurion SIEM services to collate logs from all our devices. These logs are forwarded and integrated into a local system. Netsurion also offers managed security services, including protection against malware. Although they do provide such services, I personally do not utilize them. My usage of Netsurion focuses on their SIEM package, specifically Netsurion Managed XDR. I also use their vulnerability assessment service.
On the flip side, we've worked with Netsurion to meet compliance requirements. Given our small team of only three people, adhering to strict duty segregation, as larger companies might, is challenging. To address this, we've established a practice where I request logs. For instance, when my team handles administrative tasks like unlocking users or managing access permissions, these activities are logged by a third-party system called Netsurion Managed XDR. I receive daily and weekly reports summarizing these activities. Netsurion has demonstrated impressive flexibility in accommodating our needs. They are open to tailoring their services based on our unique requirements. In cases where certain actions are less critical, they consolidate alerts into monthly or weekly reports instead of inundating us with numerous daily emails. This practical approach is highly valued. Our experience with Netsurion is unlike other monitoring software we've used, even after my extensive career, including the use of SolarWinds. At present, we are self-monitoring. The complexity of configuring these tools is significant. However, working with Netsurion feels like an extension of our team. It's far more efficient than purchasing software and struggling to configure it. Interacting with them is seamless. I can simply request tasks, like generating administrator activity reports. After a few questions and adjustments, they delivered the final report. This approach is in stark contrast to grappling with software configurations, where flexibility is often lacking. We've successfully fine-tuned Netsurion's services to suit our needs. I recently scheduled a monthly review meeting, which previously took an hour or more. Now, with Netsurion's support, the meeting takes about twenty minutes. They present data through Power BI, allowing for detailed analysis. They provide this along with supplementary Excel documentation. With their expertise, we've transitioned from red or orange indicators to green, or in some cases, even removed certain issues entirely. I am genuinely pleased with their assistance. I've worked with Netsurion in previous roles and introduced them to our current network. I secured budgets for their services upon joining this company due to the significant value they add. Considering our circumstances, I can't envision an alternative approach that would be as effective. Even hiring additional security personnel wouldn't provide the same economies of scale and expertise as Netsurion does.
Netsurion Managed XDR now offers an expanded range of services. Among these is a vulnerability assessment service that is now available. The quality of their recording has significantly improved, becoming more standardized and polished. It seems that their scope of reporting has also broadened. This expansion is facilitated by the advantages of being part of a larger company like Netsurion, which provides access to a greater array of tools. These tools can be integrated into their products and subsequently shared with customers. In terms of the core services, such as daily reporting, alerting, weekly observation reports, and monthly meetings, there hasn't been a substantial change; these aspects remain largely similar to what they were. The notable addition is the availability of the vulnerability assessment service, which was not part of the service package previously.
One aspect of Netsurion Managed XDR that I appreciate is the tenacity of its people. This becomes evident because, at times, my team serves as the bottleneck in accomplishing tasks. For example, concerning the integration, we've been attempting to integrate with our email system. The individuals from Netsurion Managed XDR persistently inquire about the progress of this integration. However, due to the substantial workload we have, we continuously postpone it. Consequently, it is difficult for me to think of an area of improvement. This sentiment holds particularly true following the acquisition of the vulnerability assessment service, which has proven to be highly beneficial for us.
In a former organization, we attempted a task akin to what Netsurion does using Syslogs and SolarWinds, but the results were incomparable to what we achieve with Netsurion.
*Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
