RSA enVision is a comprehensive security information and event management (SIEM) solution offered by RSA, a leading provider of cybersecurity solutions. It enables organizations to collect, analyze, and manage security event data from various sources, providing real-time visibility into their IT infrastructure. With RSA enVision, organizations can proactively detect and respond to security incidents, ensuring the protection of critical assets and sensitive data.
The pricing for RSA enVision is moderate. There are no additional costs, and the tool provides SIEM and SOAR services. However, if one wants to purchase the SOAR service, an extra license fee is required. Recently, similar services have been covered with SDR and other solutions, so excluding the SOAR service seems reasonable.
The solution offers a wide range of features, including log management, event correlation, threat intelligence, and compliance reporting. One of the key strengths of RSA enVision is its ability to collect and normalize data from diverse sources, such as network devices, servers, applications, and databases. This allows organizations to gain a holistic view of their security posture and identify potential threats or vulnerabilities.
The event correlation capabilities of RSA enVision enable the detection of complex attack patterns and the identification of potential security incidents. By analyzing events in real-time and correlating them with historical data, the solution can provide actionable insights and alerts to security teams, enabling them to respond quickly and effectively. RSA enVision also offers advanced threat intelligence capabilities, leveraging machine learning and behavioral analytics to identify anomalous activities and potential indicators of compromise. This helps organizations stay ahead of emerging threats and proactively mitigate risks.
RSA enVision provides comprehensive compliance reporting capabilities, helping organizations meet regulatory requirements and demonstrate adherence to industry standards. The solution offers pre-built compliance reports for various regulations, such as PCI DSS, HIPAA, and GDPR, simplifying the audit process and reducing compliance-related costs. In summary, RSA enVision is a powerful SIEM solution that enables organizations to effectively manage their security events, detect and respond to threats, and meet compliance requirements.
With its robust features and capabilities, it provides organizations with the necessary tools to enhance their cybersecurity posture and protect their critical assets.
BPS (SUISSE), Hypovereinsbank Germany, MAX Hamburgers, Infoplex, Neotel, Telus
We use it to monitor different types of networks. We specialize in manufacturing companies, so we monitor the network and the machines.
In manufacturing, you have industrial machines connected to the network, and different technologies are used. RSA has the ability to monitor different kind of technologies. For us, this is helpful because if we can only monitor Windows environments and not Linux, it's not a total solution. RSA enVision is easy to adapt to different technologies.
RSA enVision adapted to the evolving security landscape over time in my experience. We did maintenance every two months, and each time, they had a new option. The option was always very relevant. So, for me, it's a very good product. The engineer I work with shares the same opinion about RSA.
It's a very good product. We developed around this solution and received excellent support from the company. Here in Quebec, it's important that we have a French version, and they support both French and English, which is important for us.
Licensing could be improved to be more oriented towards Managed Service Providers (MSPs).
Perhaps offering different types of licensing would be beneficial, as it can be expensive for industries with many customers and clients. Currently, they don't seem prepared to support MSPs effectively.
We have had RSA enVision (SIEM solution) for maybe ten years. We have very good and fast support from them. We stretched the monitoring capabilities of the solution by coding different printouts for logs of various network activities. They helped us develop that. It's a really good product.
When we call, the customer service and support are there. They always answer. When it counts, they're always there.
Positive
You need a skilled engineer to deploy it because you can do anything with this tool. You can see everything on the network. A good engineer will be surprised and have fun using this tool because it's very powerful.
Deployment process:
You need to build a recipe/layout when you want to deploy something. Once the recipe is done, you just have to copy it. So you really need a good engineer at first, but then any other technician can copy the recipe. You don't need to be an expert once the recipe is finalized.
So, once you have it set up, it's easy to deploy. But you need a good engineer to deploy it correctly. You will get alerts from the system, but if you want to fully explore and maximize the tool, the engineering needs are different.
Just one person can do the work. Maintenance is needed maybe twice a year, so it's not a big deal.
It was high for us because we packaged the product with the service. We supplied everything: hardware, software, maintenance, and people to verify the alerts daily. We reviewed the package with the customer every three months. It was a good package, easy to sell, and the ROI was good for both the clients and us.
It's competitive, but they need to adapt to MSPs. Maybe that's not their target market, though.
Overall, I would rate it a nine out of ten.
I recommend using it, but it also depends on the needs and the budget. If I still had my company, I think we would continue using RSA enVision. However, my company now uses another solution and may prefer it because it's easier and automatically sends reports every month, requiring less maintenance effort.
RSA enVision is different. It requires a different approach because you have to know exactly what you want to see in the logs and information. It's more oriented towards engineers who need to understand the product well and proactively find and predict attacks. The other approach, with the newer product, is more automated. The system does it by itself.
Personally, I'm torn between both approaches. You should utilize automated systems but not fully trust them. You have to verify because I've learned from past experiences where systems have failed.
