Netsurion Reviews

We use Netsurion to find out what's going on in our environment. It lets us know if we have strange actions acting out. It's a deny-all policy, so there's an access list on each machine. It was effortless to tune it for our software because we have four pieces of intellectual property used in-house, and that was super easy to get up and running compared to some of the other solutions I've seen. For the most part, it's set-it-and-forget-it protection.

We've been under attack since the day we opened. Our company has a web base that hosts more than 100 different websites, and we're constantly facing attacks — our mail servers too. Of course, we knew we were under attack, but Netsurion provides excellent visibility into how often it's happening and what services they were using. We had a relatively decent idea of that ahead of time, but it solidified a lot of issues we thought we had and allowed us to tailor some solutions to mitigate those issues a little bit easier than it had been when we didn't have all the actionable intelligence.

You can't protect against what you don't know. My instincts told me certain issues were happening. There were a couple of records of it here and there, but it's easier to zero in on what you need to do if you can see what attacks are occurring and how often. It helps you identify gaps you may not be aware of. Netsurion helped shore up our security posture by verifying that some of the initial steps I had taken to protect us against some of these outside attacks were correct. I don't want to go into it too deeply, but it also showed us the usefulness of some best practices out there that many people aren't following. 

It also gave me some insight into what the attacker is going through. When I looked at the thousands of logins we get a day, and I was surprised to see the different languages attackers were using. I thought that was kind of interesting, but for the most part, it showed that many of the early countermeasures we put in place 20 years ago were still protecting us effectively versus a lot of the threats out there. 

We've been able to consolidate cybersecurity technology for our endpoint security. It's a deny-all policy. We reinforce it with other products behind it to ensure that nothing's getting through, but it was still a paradigm shift for us. Instead of just using signature-based threat protection methodology, it allowed us to really get a better grip on what was running inside of our network. That includes some attacks that aren't even nefarious, but just some chatty stuff. We were able to clean up our network a little bit based on some of the things we had seen.

It helps that everything's in one pane of glass by limiting the number of dashboards we have to look at. Consolidating services really helped us gain C-level buy-in. This wasn't just to monitor logs and check for some malicious entries — it was a complete solution that allowed us to recoup monies in other areas because we could consolidate everything in one product.

Neturion's managed security didn't reduce the amount of time we had to devote to everything else, but it supplemented our visibility, giving us the ability to see more than we could on our own. They also got us up and running in a week, whereas we would've probably spent months trying to get this running with the resources we had at the time. Even if I were fully staffed, this would have been a difficult task for us to pull off on our own. So while I won't say that it freed up my staff to do other tasks, it saved me from having to assign staff or take staff away from current projects they were working on to get this implemented and keep it running. I know it would've taken a lot of my time — at least two to three weeks — plus the time of my techs.

It's good to have the SOC team analyzing, monitoring, and getting reports that have actionable items. We were a small shop, to begin with, and when the pandemic hit, we lost 60 percent of our workforce, including my department and the other technology services departments here. We needed something actionable to get an assessment of our threats, what we needed to do, and where our vulnerabilities were. It exposed us to issues we knew, but it could give us accounts.

The threat detection and response are excellent. It shows you exactly where you're vulnerable, and it helped us get some of our early PCI compliance laid out, too. We're doing internal PCI scans now based on what we originally discovered with this product, and it's a necessary piece of our overall threat protection landscape. I had known for years about specific surface attacks I wanted to limit or certain servers I tried to get rid of because I felt like it was exposing us to too much liability or possible liability on the internet. This just pointed me in the right direction to show me that my instincts were correct in what I was seeing. It gave me something actionable I could take back to the VP or my CFO and say, "Listen, this is exactly what we need to do."

I also like that the monitoring is 24/7. It never stops. Netsurion helps with the MITRE ATT&CK framework. It gives us a lot of that. It doesn't scan inside and give us reports like my other PCI compliance scanning tools do, but it gives us a base idea of what's going on in those machines and where our surface attack vector could be. The embedded MITRE ATT&CK framework helps us pinpoint exactly what we should be looking at. It's nice to have a vehicle that drives you to where you need to be, and you don't have to find a map to get things settled up at the last minute. 

I would like to see more communication with the SOC. I believe they are communicating quite a bit, but I think that relationship could be better. There was maybe one person, and I don't know if they can afford the time. We get a report generated on a particular day of the week and we go through it, trying to mitigate problems and make sure we're seeing everything that's happening. It would be helpful if the SOC spent a little more time with us going through some of those reports.

We have been using Netsurion for around 18 months.

I've never known Netsurion to go down.

We haven't had to scale up. We needed to scale down, but I haven't seen problems scaling this. If we could afford to expand our usage of Netsurion's products, we would. There's another product they offered us called Deep Instinct. It just didn't fit into our budget, but I would love to have it. There's more I'd like to do with Netsurion once our budgets get back intact.

I give Netsurion's support an eight out of 10. I never give a 10, so eight is a relatively high mark for me because I always think there's room for improvement no matter what you're doing. They're great. It may take 24 hours to get a response on something we need, but they do respond and they take care of problems rather quickly. We're working with a team in India, so there is a large time difference. My team probably should be working overnight when we're working, but I'm always wondering if we kind of cross over where they're leaving early in the morning when we're coming in, or maybe we're coming in, and they're on a skeleton crew when we're on. That'd be the only thing is sometimes it does take a little bit of time to get an answer, but I would say we're getting answers quickly enough 90 percent of the time.

The SOC component is crucial. It's nice to know that I can reach back out to them if there's something we don't quite understand or something we're not getting. We know we have a team we can contact and get help to ensure we're mitigating things correctly. In the time we've been working together, I've found that I do like the SOC team. They're a good bunch of folks to work with. 

Additionally, we do quarterly follow-ups and everything, too. I think the SOC is an essential part of it, and I believe the Symphonic portion is equally important. You can have the SOC, but if you're getting a bunch of noise, the SOC isn't going to be able to do much. The fact that the SOC then takes the time to filter out a lot of the noise and then gives you that directed report is beneficial.

The SOC understands the peculiarities of our environment. They are an active partner whether they agree with our idiosyncrasies. We're getting a lot better at working with them to manage threats now that we've been doing it for a couple of years, but at least initially there was a lot to go through. The SOC was also instrumental in helping us with the onboarding process. We worked with them to get some agents installed, and they had us up and running fast.

They showed us how to make sure that we were only listening for things initially and not blocking anything. It was super helpful. Again, it was a two-hour call compared to three to four weeks of our time and then on top of it, another six months of monitoring beyond that. At least they have the knowledge of the tool that they know initially where they need to start quieting it down, where we wouldn't have had that knowledge to start off with.

It's not much of a problem for us that the SOC is located outside of the United States. I would say that's life nowadays. Maybe pre-pandemic, that would've been a big concern. I have a friend that owns a US-based SOC that I also work with, and he is having a hard time staffing it. It's hard to find technicians in the United States. You're going to have to make some trade-offs in the number of people who can help you work your solution and maybe some coverage because of the lack of technicians available if you're really concerned about keeping things inside of the US.

Positive

We were collecting event logs into our RMM product that we used to patch and maintain our systems, so we received alerts that way. However, it was all emails, and we'd have to sift through it to decide where the problems were and what was happening. It was more reactive compared to what we're doing today with Neturion. We can be more proactive because we know where the patterns have been in the past. We know what we're seeing, we have a better idea of where to place our assets strategically, and we know how to protect those assets.

Netsurion was easy to deploy. I have worked with other systems that were a little less complex, but they weren't quite as easy to deploy. It's on every machine we have in the enterprise, so technically, every person I have in this company is using the software, whether they realize it or not. My entire team is involved in going through reports and remediating. 

We didn't have to do anything. Netsurion did everything. We sat down, we told them, "Here's what we feel are our key pieces of software. Here's what we've designed." They showed us how to exclude that inside of their software. I want to say that we did 30 days of just listening to the network and bringing them reports. From our side, we mostly conferred with them initially and spent time with them explaining what intellectual property we had running and what programs were essential to use on the network. It was super simple.

If we were to do this on our own, we would need at least one full-time person in a high salary range, so $80,000 to $150,000. That would be a security analyst at minimum. 

Any security solution won't be cheap, but I think Netsurion is well placed to make it affordable on any enterprise's budget.

We looked at other solutions, but nobody had a comprehensive SOC and fine-tuning like Netsurion. I had even used some other solutions before this in some trials when we were getting ready for a tool like this. As far as I know, I may have found one or two later after we implemented this that offer some of the same features, but I still think this is the best solution for the money.

I'd rate Netsurion nine out of 10. It's not a fancy product, and I don't mean to say that it's not comprehensive or it doesn't do what it needs to do. I guess what I'm trying to say is it's like driving an old Chevy Nova. It's easy to work on. If something goes wrong, it's easy to fix, and it gets you down the road. Netsurion does a good job, and it's reliable. I haven't known it to ever go out on us. 

If someone is wondering why they should implement Netsurion, I would say, you don't know what you don't know. That's what it comes down to, and it's a matter of whether you want to sleep easy at night thinking you've done enough. You know how bad it is out there and that these attacks never stop. We get thousands of attacks daily, and we're not a big company. We're a US-based company that isn't in a volatile field. Our significant lines of business are restaurants, health clubs, and travel. You wouldn't think that is a huge target, but we had almost a quarter of a billion attacks against us last week.

A lot is happening out there, and it's nice to get some affirmation from the executives that everything you've done is working and keeping you safe. It's also giving you some benefits you may not be thinking about, so you know where you might have to apply some of these new things or come up with some new best practices that will work out better for you going forward.

Your SIM is only as effective as the reports you get out of it and the actual items you can get from it. While you can spend a lot of time and energy doing this yourself, it helps to have a professional team on your side walking through this. Maybe after three years, we won't need the entire SOC, but I can't see that happening. It's better to have them generating these reports for me than one of my teammates having to go through this and spend all week doing this as their job. We have to wear too many hats here to be able to commit to a person like that.

It's a managed SIEM. It collects our log information, events from different systems. That information gets analyzed to alert us to any problems that are typically security-related issues. We use that database to do our own research as well. For instance, it's handy for figuring out why somebody keeps getting locked out.

The 24/7 monitoring and alerting is definitely a positive because we don't have to have it in-house. These days, finding security people and keeping them is even more of a challenge than it was two years ago.

Netsurion also provides us with actionable threat intelligence. If an endpoint visits a site that tries to do a download, a "drive-by" type of situation where it tries to run an obfuscated URL through a PowerShell or the like, we'll get an alert from the SOC so we can take remediation actions for that particular endpoint.

Our detection time is shorter than it was, and they're well within the SLA for both detection time and remediation. Since MITRE was added in, we haven't seen anything take longer than it's supposed to. The detection times are short, and alerting times are also very short. And while the addition of MITRE hasn't increased remediation accuracy, remediation accuracy has always been good with Netsurion. When it's already good, if it only gets a little bit better, it's hard to measure that.

In addition, the fact that this is a managed security solution has definitely freed up my time to work on other responsibilities. If we didn't have the managed component, I would probably have to spend most of my day in the SIEM, personally. Now, I only have to turn to it once in a while. It has freed up most of my time to work on other projects instead of managing the SIEM. It saves close to 75 percent of an FTE in our existing staff and we also haven't had to add staff. To get 24/7 monitoring, we'd have to have at least three people with no vacations for those people. That would add up to a whole bunch of FTEs.

The fact that it's a managed solution is very valuable to us, having their SOC do 24/7 analysis and alerting. The SOC is a very important component of the solution. They are responsive when we have questions or when we want something to be analyzed further. We also have periodic reviews with our primary liaison of the state of the solution and the offerings of the SOC.

When it comes to threat detection and response, it does a very good job detecting and blocking on its own. And the SOC is a nice added value because they're doing analysis on things that aren't as obvious, on things that you can't just detect with a signature or behavior. Also, any SIEM will come with a lot of noise, so having them do a lot of the initial analysis to find out what's critical and what issues are false alarms is very good.

An important feature that is more specific to the product itself is the EDR component. We get analysis, blocking, and remediation for endpoints. It also does known and unknown malware blocking on its own. It's nice to have another layer of analysis and security from the agent as well.

Everything that I've wanted has been added in. EDR was added, and MITRE was added. Those were two big ones that we didn't even have to push for. 

I've been using Netsurion Managed Threat Protection for four years.

Other than updates, there has been no downtime. It is very stable.

I'm not concerned about its scalability. It's very scalable. We could grow greatly in size, and it would just continue to work for us. It's now used everywhere, throughout our organization. There are some additional paid features that we don't have, but we're using everything that we have licensed.

Our account representatives within Netsurion, and the handful of people I deal with in the SOC on a regular basis, are familiar with our company and our previous issues. I talk to the same people all the time. Obviously, there has been some turnover throughout the years and people get promoted, but our account manager became a manager in general, and I still talk to him. He still reaches out to me to see how things are going. It's not just a bunch of different names being thrown at you every time.

Positive

Using Netsurion has not meant we have consolidated cybersecurity technologies. We haven't eliminated anything. We added Netsurion into the environment, because nothing catches everything. We were not even looking for something that would replace everything else we had. We wanted the enhancements that we would get from a managed SIEM, versus keeping everything in-house.

Additional layers and different technologies are looking for different things. Netsurion deploys a technology and algorithms that we didn't already have. And the 24/7 monitoring with the SOC was another reason to add it to our environment.

The setup was pretty straightforward. They needed to learn about our environment and I needed to provide a fair amount of information for that. We set up a system for them, and they did the configurations, primarily, and have continued to maintain them. We had an account rep, not a sales rep, but an actual Netsurion manager, who worked with us and their SOC and did the project management on their end. He worked directly with me and we had a number of web meetings and phone calls until it was up and going. Anytime there's a new version or new features, I'm still talking to the same guy.

Their assistance in the onboarding process certainly helped with the product's time to value. It would have taken a lot more time to set it up if we were doing it by ourselves. The setup required about 20 hours of my time and we had data coming in and being analyzed within a week, maybe a little longer, of the beginning of the project. It didn't take very long to get the core system up and going. After that, it was a matter of configuring all the systems in our environment to start reporting to it.

They maintain the system itself, but we have to make sure that clients are reporting to it. You get a report, and depending on the service level, a report you can run yourself, anytime you want. It's very easy to run, and you get a list of non-reporting systems. For example, we can see that Bob has been on vacation for two weeks, so it makes sense that his computer hasn't reported in in two weeks. But Joe has been working every day from the office for the same two weeks, and his computer hasn't reported for the last three days, so something probably needs to be looked at on Joe's computer.

We haven't been hit by any surprises when it comes to pricing and licensing. You are paying for different levels, especially as far as the monitoring goes and how often you review it with the team. The other factor that figures in is how many nodes are on your network, such as clients, network equipment, servers, etc. There are some additional pieces on top of that, but it's laid out pretty simply, as far as how much you're going to pay for a node. And if you want an additional feature, they tell you how much you pay per node to add that on.

We looked at a few solutions but we narrowed it down quickly to Netsurion. The features offered by the various solutions were pretty close in parity, but Netsurion, at least at that time, had an edge on pricing, and we liked the initial conversations that we had with them.

Netsurion didn't integrate the MITRE ATT&CK Framework when we brought it on, but it was added afterward. But as MITRE solidified into a pretty important framework, I reached out to Netsurion and asked when it was coming, and it was coming in the next release. They were on top of it. 

As for someone being concerned that the solution's SOC is outside of the US, it hasn't been a concern for us. It's 24/7. If the concern is more national or regulatory, you have to follow what your rules are. But if you don't have any regulations or laws restricting you, I wouldn't hesitate just because the SOC isn't in the US.

If a colleague at another company said he's not sure that they need managed services, part of that conversation would be about what kind of staffing levels they already have and if they already have 24/7 in-house security monitoring. If not, do they think the bad guys only work from 8:00 to 5:00 Eastern?

It's reliable. It works. With the managed component, we get that personal attention and that consistent team to deal with. To some extent, it's like they're part of our IT team. They're not in our buildings or working with us directly day-to-day, but in some respects, it's close to that.

We use it for security incident and event management, and we use Netsurion's hosted SOC service, meaning their SOC team also assesses our events.

The solution is on-premises. We have the agent running on our Windows systems, and we have the Linux systems pumping the syslog data to the Netsurion server.

The 24/7 monitoring and alerting have positively affected our security maturity because now we have people with eyes on our security events 24/7. They are monitoring our security incidents and alerting us to any incidents that need action on our end. Overall, the SOC component of the Netsurion solution is very important because without it we would need to hire more people internally to do that work. With the hosted SOC, we don't need to have a large team on our side. While their SOC doesn't know our company and what is unique about our environment entirely at this time, they are learning it now.

All the features are valuable, so far. Some examples are the detailed responses that you find within the searches. The alerts are also valuable because they're concise and not overwhelming. The dashboard layout is also a feature I like, because it's very clear. It's not cumbersome.

When it comes to threat detection and response, Netsurion is very good. They're good at incident detection and responses. For example, they found some tools that are used by hackers, tools that were running on a system, and they immediately alerted us to that fact. We investigated it and it turned out it was an administrator using that tool. But it was a good process.

Managed Threat Protection also provides actionable threat intelligence. For example, when there was a vulnerability in the Exchange platform, they alerted us that this new threat had become known, and we were able to take action by patching our Exchange servers to secure them.

We have also integrated our endpoint security into the Netsurion SIEM. That's important because we have all the events in one place; we don't have to manage them in multiple places.

In addition, the embedded MITRE ATT&CK Framework was paramount in our decision to choose Managed Threat Protection because the MITRE Framework is the industry standard for threats. While it hasn't yet helped to identify threats we might have missed without it, we're still early on in our deployment, but eventually, once we are more mature, it will. And I believe it has helped with the time it takes Netsurion's SOC to identify and understand sophisticated threats.

The weekly reporting could use some improvement. For example, when we handed them our landscape document, it took longer than I would have liked for those details to become noticeable within the reports.

I have been using Netsurion Managed Threat Protection for about 10 months.

It is very stable.

Scaling it would be slightly complex because you would need to consciously keep track of the ports where the logs are being ingested. Scalability is not as straightforward as it could have been.

We are using it to monitor about 2,500 endpoints and we have two analysts within our organization's security department who work with the solution.

Some of the technical forethought for the deployment was not as good as I would have expected. Some of the technical blocks that can exist in an organization of our size, issues that needed to be thought about, were not taken into account at their end. That required more input on our side, so that is why I would rate their support at eight out of 10 overall. But regarding the product itself, their technical skills are a 10. It was more when it came to the difficulties in a more complex environment that they were slightly lacking.

Positive

We did not have a previous solution.

The initial setup was straightforward. They provided us concise instructions on how to deploy the agents. They provided us packages that we could then deploy within our package deployment mechanisms, and they supplied us with the necessary tools to be able to deploy the agents quickly and easily.

Netsurion's support during our deployment process was very good. They were very helpful and attentive to us as customers. Their assistance in the onboarding process certainly helped with the product's time-to-value because we were able to deploy the agents in a short period of time and to start getting actionable intelligence pretty quickly.

Within a couple of weeks of their providing us the packages, we started deploying agents and, within a couple of months, we already had enough logs being ingested to have at least some initial, actionable intelligence.

The implementation strategy was, first of all, to have enough collectors around our network to ingest the logs from the sources, and enough log source ports to be able to handle the quantity of log sources coming in. After that came the preparation of the agents and the mechanism through which the agents were to be deployed. This strategy helped to make the deployment faster and easier.

It was handled internally by our IT operations.

We have seen ROI in the fact that we had actionable intelligence within six months of deployment.

The amount we pay for the service that we get is good. If it were to be much more expensive, it would not have the same value for the money.

We evaluated McAfee Managed Detection and Response, Splunk, and Rapid7 against Netsurion Managed Threat Protection. The biggest difference was the cost.

If you're concerned about Netsurion's SOC being located outside of the US, I would say that location of the SOC is irrelevant. Rather, you should evaluate the skills of the SOC and the SOC management.

And if someone at another company said they are not sure that they need managed services, I would say to them that they had better make sure they have enough money to have their own internal team.

My other advice would be to make sure that Netsurion gives you a good deal compared to the other vendors.

We use Netsurion to meet our HIPAA and PCI compliance requirements and to implement best security practices. Before we implemented Netsurion, our company had no visibility into the environment. We use it to alert us about unusual processes that may be executed. After an investigation, we whitelist or blacklist those processes. It also helps us manage our asset inventory and respond to threats as they arrive. 

Netsurion's 24/7 monitoring has enhanced the overall security of the company. They have someone looking at the data 24/7 who will call us as needed. If their team spots a malicious process after hours, they notify the appropriate person by phone. We get a lot of actionable threat intelligence from Netsurion. For example, if a user clicks on a malicious link in a web page and starts an unusual process that isn't on the white-list, Netsurion's team can detect it and prevent it from executing. Afterward, they'll notify us by telephone, so we can respond and clean up whatever damage has occurred.

With Netsurion, we've also consolidated a lot of our cybersecurity technology. Case in point, Netsurion can aggregate the log files from a Meraki wireless access point, which correlates that data, so that minimizes the time necessary to investigate. They have already taken care of the heavy work. With Netsurion, I take their data, and I know where to start.

Any security professional will agree that if you don't have a solid understanding of your inventory of assets, it's going to haunt you. In this case, it provided me the opportunity to see what's out there. This is especially crucial given that we have some BYOD devices that are not allowed onto the network. I was able to spot those devices and enable conditional access through our Azure Active Directory.

It has reduced the amount of time it takes to identify and respond to constantly evolving threats. We don't know everything. So we could have something that we've never seen before and it requires research on my part, which can be very time-consuming. I like to have the reference readily available.

The managed security solution has freed up IT staff time to work on other things. Our IT team is tiny. I am the only security person in a company with more than 5,000 employees. I don't have to focus on security 24/7, which frees up a lot of time and lets me have a work-life balance. It's equivalent to saving us the cost of three full-time employees at 40 hours a week. The SOC is an essential component. It's crucial to have those individuals correlating and reporting on alerts or taking care of events that don't need to be reported. That's a lot of manual work.

I'm new to the company and the environment, so it's valuable for me to see what is deployed and what processes are being executed in the environment to ensure that nobody is running something that may have malware or infections. Netsurion's log aggregation feature is something I use heavily. They use Elastic as their SIM tool. I'm able to take the numbers that they provide and correlate events.

Netsurion also integrates the MITRE ATT&CK framework. Every alert includes a reference to the MITRE number that you can research yourself. I have experience with the MITRE framework, so this is valuable to me. The company did not previously have an understanding of MITRE, so it's essential to me as the security person responsible. This framework has definitely helped us identify threats that we might have missed otherwise. With the MITRE ATT&CK number, I can research in the right direction.

Netsurion's threat detection and response aren't quite mature. I would expect a little more. Instead of an Excel spreadsheet with a log output, I would rather have a web portal that I could log into and see the event live. In all fairness, they may have that, but they have not provided that to us. They send me an Excel spreadsheet, and I have to aggregate the data manually to find out what I want to look at. It would be better to have a web portal where the data is already aggregated, and I can see where the hotspots are. They could do something like Arctic Wolf, which has a web portal or page we can log into.

I have been using Netsurion since approximately June of 2020.

Stability has been okay. We've only had one instance where specific endpoints were not reporting in. During the discovery, we found that devices were pointed to the wrong collector on the Netsurion side, and they fixed that.

With Netsurion, we're covering more than 5,000 endpoints without any real difficulties, and I think we could grow even further with that, so I don't have any concerns with scalability. However, I don't know how far they can go.

I would give Netsurion support a nine out of 10. Their technical support has been outstanding. There have been some challenges on the administrative side getting the phone tree updated. That's an area where they need a little bit of work. But I have no complaints on the technical support side. They've been accommodating. Their SOC is also excellent. They're working on a mature model, and I think they're going to raise the bar. We also have five other managed service providers that the SOC needs to work with across different time zones. Everybody just needed to get on the same page and align the timing. After that, it went fine.

Positive

I joined the company while they were in the middle of deploying Netsurion, and I actually led the last phase of implementation, which was getting the agents installed through the endpoint. In my opinion, it was pretty straightforward, and the deployment took about 90 days. The only issue was getting their agent to work on some of the Apple products. The developers had to go back and tweak the agent to get it running on these systems. Netsurion's SOC helped walk us through the onboarding process. Without their support, we would've probably been extremely frustrated and unhappy. 

I would rate Netsurion eight out of 10. While there is room for improvement and maturity, I have no complaints about their services. To anyone thinking about adopting Netsurion, I would advise them to research and get references. You should also do a cost-benefit analysis of a managed solution. Doing this work in-house is extremely expensive compared to offshoring it to someone already established who can do the work you need. 

If someone is concerned about Netsurion's SOC being outside the United States, I would say that this hasn't been a problem for us, given the compliance spectrum we're working with. Some companies may have another view of that, but I work with that team and trust them. They meet all my expectations. I'm pretty satisfied with their service and how it was managed during implementation.

Since we can't have 24/7 operations for our SOC, we hire out for that and have it as a managed service. This makes much more sense and allows us to focus on the day-to-day activities of the company.

Since it is a managed service, they take care of everything for us and just reach out when they have a question, there is an incident, or an important alert. That is the most important part for me because that allows me to focus elsewhere.

It allows us to avoid needing to employ people to stay during evening hours, which is a positive.

The solution provides an embedded MITRE ATT&CK framework. The framework is relatively new. I like that it is a curated knowledge base now. It is very important because it lets everyone know what is going on and being observed in the real world. It definitely helps in the analysis of whatever threat is found. Remediation is already built into the framework.

Their SOC team manages vulnerability management and IOC reviews. They stop bad processes when they happen. The best thing is their weekly reviews of what has been going on in the infrastructure as well as the things that they see and what we should look out for.

We haven't had any incidents, which is a good thing. It is a valuable product.

The solution provides actionable threat intelligence. It is not a passive service. They go in and perform mitigations on whatever they find. It is timely. They provide context, so it is understood by anyone who receives these reports.

It is important that Netsurion Managed Threat Protection has enabled us to consolidate cybersecurity technology, including SIEM, network traffic analysis, and endpoint security.

I would like faster responses when things are found. For example, when they inform me, it is usually when they begin to respond.

The MITRE ATT&CK framework could be faster when identifying and understanding sophisticated threats. Whenever something happens, we usually get notified a couple hours later.

Their SOC team can't understand our network because they haven't worked in the actual company. This does negatively affect security posture, e.g., if you don't have knowledge about the network, then you will miss things.

Personally, I would have deployed it on its own independent server. It uses a lot of IOPS and resources. Now, we have contention between our other servers on the same cluster.

I have been using it for at least three years. It was installed at the company before I joined.

It scales fine.

It is being used throughout all our systems non-stop, so we don't have plans to increase the usage or utilize it in different ways.

One person can maintain and work with the solution.

The SOC component is the most important part of the solution. I know who the SOC team is, so it is not someone different every time. I have seen changes in the team. However, for the most part, the team is usually steady. They are professionals in this and do a good job. 

They could improve by having faster communications. They always get back to us on the same day, but it is usually a few hours later. It would be nice if it was within an hour.

Neutral

We have seen time and cost savings. It prevents us from having to hire specialized people for this type of work. We would need to hire six staff members to accommodate the same service.

If you are not going to go for their managed service, then you will need to hire a SOC team, and if you are not going to hire a SOC team, then you are messing up.

I am sure that other companies have their own SOC teams instead of having a SOC-managed service, but this solution makes it cost effective for us.

I would rate it as a six out of 10.

We use it for real-time alerts for things like domain admins being added. And we have the managed services provide weekly reports for us for VPN logins, after hours logins and several other similar alerts. 

And of course, at any time I can do individual investigations and searches on interesting traffic that might be reported to me by Netsurion or that we find on our own.

The solution saves me at least half an FTE, some 20 hours a week. If I didn't have the managed services, I would have to have another half an FTE just to do the work that they do for us.

Netsurion has assisted our server administration team as well. If they're having software problems or access problems or the like, they have the ability, with all the logs now centralized in one place, to go to one place and do those searches, rather than to go individually, server by server by server, and try to figure it out. 

It's also tied into our enterprise firewall, which is Palo Alto. It really helps them in their troubleshooting time if they're having an issue. 

There are 3 aspects that Netsurion is very helpful to our organization.  One side is the information security side where it helps us quickly investigate an incident including false-positives. A second aspect is operational efficiency.  It would really take a lot of time to try to figure it out server by server but with Netsurion they can go to one place which has all those server logs. The third aspect is log archives. Once it makes it to Netsurion, they can keep local log storage space pretty low and don't have to burn a lot disk space on the local servers.

I also feel that Netsurion has better integration. Almost any product could integrate with just about anything else, given enough time and resources. But that's part of the managed services that we contract with Netsurion. We have integrations into Sophos (for antivirus), Office 365 (for email) and for our enterprise firewall (Palo Alto), and our Cisco networking equipment. So we've got all the critical infrastructure pieces integrated and all of those were integrations out-of-the-box-that I probably could have figured out if I had enough time. But I tell them what I'm trying to do and either they have a white paper which gives me one, two, three steps to do it, or they actually take over. I give them a service account. They take over, they do it, we do some testing and we go live with it.

Everything we have is a real-time feed. We don't have anything that is just batch and then it reads it in later. Especially on those real-time alerts that I mentioned, I know about each of those literally within minutes after it happens, because it's a real-time feed. The alert fires and sends me an email or a text, whichever I have set up.

We're also very impressed with Netsurion SIEMphonic. That's what they've renamed their SIEM tool. We use it quite a bit now. They've got something called potential insider threats that we look daily. Those are things like account creations and the like. A SIEM tool doesn't necessarily know, just because an account is created, whether it should have been created or if somebody created it to try to hide their tracks. Also, seeing things like logs being cleared on servers has been very helpful to us. We would have no other good way to get visibility into those types of things. An extension of that is the alerts that we talked about. It's really been really invaluable for us to get insight into our environment. There'd be no other way for us to really get that without either SIEMphonic or one of its competitors.

Really, all of the features are valuable. Probably the most valuable are the real-time alerts and the weekly reports. They would like to send me the reports daily, but because I'm a one-person shop, I just don't have the time to pour through them. Those weekly reports really give me a view of the landscape and of things that might have slipped through the cracks.

The real-time alerting for things such as people getting dropped into a VPN group or the domain admin group — things like that which really shouldn't happen without proper change management, but we all know the reality, that they do from time to time — gives me real-time visibility into what's going on.

I do like, with version 9, that they have what they call Elasticsearch which is very quick, although that's only available for the last seven days' worth of data. It used to be that, if I wanted to do a search from three days ago, it might take me 10 to 15 minutes because it had to actually unzip some archive files. So I really like that feature. It's almost instantaneous for anything within the last seven days. I can go back as far as I have archived, which for us is a set of six months. It all depends on how much you want to store. We store one semester's worth of data. That real-time, very quick access is very helpful for our workflow and the ability to investigate things.

Also with version 9, the overall UI is much better. It's more like Splunk, which is one of their competitors. It has more of that kind of look and feel. You literally drag and drop different fields and elements that you want in your reporting. And with that Elasticsearch, where it's almost instantaneous, it's so much more helpful. Their old query tool was okay, but it had the old look and feel. You picked the field you need and you chose an operator like "equals," etc. This new look and feel really is drag-and-drop. It's so much more modern and very useful. It makes it very efficient if you're looking for something.

With version 9 there are so many areas where they changed the look and feel and it is so much easier. I really don't have anything that is a pain point or that I have to work around or that I would like to be a little better or easier.

With version 8, there are quite a few things. The query tool was one of the big ones, and the query speed was one of the big ones, but they've made some great strides between versions 8 and 9.

There were also issues in version 8 around the ability to get the data back out. It's one thing to collect data, but it's a whole other thing to be able to present it or run it in a timely manner. The old tool, depending on how far back I was looking, might even time out and I would have to run it again. 

We don't have any of those issues with version 9, as long as we're staying within that seven-day window. You get outside the seven-day window and it still performs the same sort of way. And it's not Netsurion or SIEMphonic's fault; it's just the way they store the data and have to be able to open the data back up. But the look and feel of the query tool is still exactly the same as it was. It's just a matter of whether you are looking at that real-time, very quick access, or you are looking at more of an archive-type.

I've been using Netsurion for about four years.

The stability has been really great.

On the older version — and this might have even been with version 7 — we had one or two instances where we had a problem logging in with our Active Directory account. We never really got a lot of details, but I can tell you that in less than 15 minutes they had it corrected. They have VPN capability as part of the managed services to be able to get in anytime they want. That VPN capability has two-factor authentication on it. We opened a ticket with them, told them what was going on, and they came in via VPN and corrected the situation.

We did have this issue twice, about nine months apart. But we have not had that problem in version 8 or 9. I don't know if it was something within the server configuration or something else. Other than that, we've never had any stability problems. 

The query timeouts, again, were just due to the sheer volume of data that we were trying to extract out of the thing. It was something we were able to work around. We could do a couple of extractions and bring them back together. It wasn't anything that was a big pain for us. It was a little bit of a learning curve and understanding.

In the early days of it we were really trying to get everything. But they were really great and said, "Well, that's great, but after you get everything, then you've got to pare it down anyway. So why don't you just build your query in a way that is smart enough to get only what you really want to begin with. So when you do get your extract, it's ready to work on." That was part of a learning curve for us and their suggestion really helped out a lot.

We haven't had any big problem with scalability.

When I got here, we were keeping a year's worth of data. The reason we're now only keeping six months instead of a year is our own backup speeds and/or how much disk space it's taking up. We talked to our CIO and several senior leaders. Everyone was comfortable, as long as we could go back and investigate within the same semester. We felt that reducing from a year to six months was acceptable. That also fixed our backup times which were taking so long and how much total disk it was taking up. It had zero to do with the product. It was strictly a matter that storing so much data was taking that much space and that long to back up.

Today, in our organization, it's used as needed. We may have five security incidents a month. The server admins use it for operational needs once a month or every other month. So we don't have super-heavy use here. Most of my investigations come out of those weekly reports or things that come up within the environment in real-time. There's not a tremendous need to be able to use it more often, because of the real-time alerting and those timely, weekly reports. A lot of those were custom reports that we asked them to build for us. We really get visibility right into what we want to see all the time. So we're able to address situations very quickly and not have to hunt around and figure things out.

Their technical support is really good. We've got a dedicated service manager.

The only thing — and it's not a problem, but I do like to mention it — is because they are in a different time zone, it's not that they won't respond, but it depends on how severe the ticket is that I open. If it's anything much past noon or 1:00 p.m., I know because of the time difference that it's going to be the next day before they get back to me, unless it's something that's really hot.

They do have 24/7 coverage, but unless it's something that's really down or a real issue, if it can wait till the next day, you won't necessarily be able to get somebody on the phone that afternoon. The great thing is, I start at 7:00 a.m. Central anyway, so there is overlap for five hours of my time and that's been sufficient.

They have U.S. sales, but not necessarily U.S. support, but that's okay. It hasn't been a problem.

It's not hard to escalate when necessary. If I send a second ticket or ask for some kind of update, that dedicated service manager responds pretty quickly. Most of the time, he'll actually be calling me and seeing what else they can do. They've been really great about turnaround speed and communication.

Netsurion's SOC team is who I report my issues to if I want to open a ticket. It's part of the managed services but it's not the only piece of that service.

When I got here, the CISO before me was retiring, and he was about 75 percent of the way through the implementation. I did about the last 25 percent of the agents. So I can't really speak to the setup.

But I can speak to upgrades, and those have gone seamlessly. That is part of the managed services that we contract with them. They do all the upgrades for us and make sure they perform correctly and make sure all the agent endpoints upgrade correctly. And if they don't upgrade correctly, they have to take whatever actions are necessary.

But I don't see why the initial setup wouldn't have been fairly straightforward, because of everything else I've seen in the tool. They seem to have really good documentation and they definitely have really good support staff, if I've got any kind of questions or problems at all.

The time an upgrade takes depends on if it's a major or a minor. If it's a minor upgrade, like a 0.1-type of upgrade, those usually take place overnight. Their headquarters are in Europe, so by the time I get into work at 7:00 a.m. Central, the smaller ones will often be done. Otherwise, they'll give us the outage window, and it depends. The 8.0 to 9.0 was almost like a forklift. It was almost like a whole new product. That one took six to eight hours.

But the great thing, the way their product is designed, is if the endpoints can't deliver their logs, they will just keep on collecting them locally. As soon as the server comes back online, they deliver them. I never lose anything. It's just I didn't have the ability to query during the upgrade period. That's another thing that's wonderful. It's not like I have some little moment in time that I sure hope something hasn't happened, because I don't have visibility. I do have visibility. It's just a matter of whether it is actually in the query tool yet or not.

When I first got here, we had some problems pushing out some updates and we never did really resolve it. It was something within our environment. They don't have that problem in other customers' environments. But they came up with a workaround. They're responsible for doing those, and it's been flawless.

We didn't have a competing product. This solution was just slowly pushed out to the various things that we wanted to collect data from. Initially, all of our on-prem servers had agents installed, including various versions of Windows, Unix, and Linux-type hosts, as well as to our networking equipment and our firewall. Some of those things collect syslogs, while the Windows boxes, for example, have a real agent on them.

The process was that the console was stood up and we slowly we went after our prioritized endpoints. Things like our domain controllers were first. We slowly moved down the priority list until we got to the low-value assets. Those were the ones that I implemented. So the critical components were already in place when I got here.

We feel that we're getting a real ROI. Between having the managed services and having the product on-premise, we feel like we're almost getting the managed services for free. They've given us a very good price.

Based on industry standards, it's saving me at least $25,000 to $30,000 a year.

If you look at competing products, Netsurion is less than 50 percent more expensive, and I pick up all those managed services. I pick up half an FTE without having to pay benefits.

I don't know the reasons why they put this in right away, because we were in a three-year contract — but at the end of that three years the price was going up. I don't know that we had done the math on it before, and we thought, "Whoa, wait a minute."

So I actually did look at AlienVault, which was a good competitor technically, but I could never find anybody who could give me any decent price to help with that managed service. So either I was going to have to pay a lot more, and sometimes upwards of double what I'm paying Netsurion, or I was going to have to hire an FTE to do it. There's no way that that would work out financially. When they heard that we were shopping other products, we negotiated with them and they came back and agreed to put a cap on the price. We've been thrilled with that. It's worked out really well.

Compared to others, Netsurion also has even more services. We have bi-monthly calls, reviews of what happened in the last 2 months, including things that might still be outstanding. They've reported things to us and we'll say, "Hey, we need an update on this." Or, "Are we closing this issue?" They bring those things up every other month. There are a lot more things that we could license if we could afford it. We would love to license all of our workstations. It's not that they're trying to price-gouge, it's just the size of the environment. And you have to determine what other tools, besides a SIEMphonic-type tool, you want. We've been pretty happy with what we've been able to deliver.

One thing that differentiates Netsurion is that they have the total package, or as much as you want. They can run the thing for you, as they do for us. They can offer all kinds of different services beyond just the SIEMphonic services. They're also a much more robust company and one that offers a lot more than somebody who's competing for just any single item that they offer.

When we were negotiating the price, we had bought more licenses than we really needed for our servers. But you can slice and dice and change things up. Even within the managed services, they can run the weekly reports for you or not. They can do the upgrades for you or not. They can do the bi-monthly calls or not. There are all kinds of different things they can do. So we right-sized those services and "trued-up" our licenses to what we really needed, with a little bit extra for growth. We came to a good agreement. It was a bit of a win for them. We gave up a few things that we didn't really need anyway and we were able to maintain our level of service that we had had and had come to expect.

My advice is to get your PO out and make a purchase. I have referred several other companies. I'm involved in several security organizations and it really is one of these diamonds in the rough. I know they have US sales but I think they're a lot stronger over in Europe. I think they're a little-known, hidden secret in the U.S. I know they're in the industry review reports, but I don't think they get the press and the prestige that they should, because they have a really excellent product.

Of course, certain government organizations can't do business with support overseas; there can be limitations. But I'm definitely an evangelist for them. We really like their product and plan to keep it for a long time, provided, pricing-wise, it doesn't get out of hand. But I think we've reached a good agreement that we can all live with. We definitely feel like we're getting value for it. We have no problem writing the check every year.

This is the first time I've really worked, on a regular basis, with an overseas-support vendor. The biggest thing was getting our support hours lined up. I don't want to sound like I'm dissing them, that if we were in a world of hurt and had something that really had to be taken care of that they wouldn't respond to that. But we had to adjust our workflows knowing that, if we really need to get them on the phone, our morning is the best time to do that.

Other than that, the convenience of it, being able to think of how else we can use it and what other kinds of data we could send to Netsurion to help us out, has been instructive. For example, we have a mail product called Proofpoint that actually front ends our email and pulls out spam emails and those sorts of things. We were able to send the over the logs from that and look for any emails that were going to more than a hundred recipients. And Netsurion could give us real-time alerts and that would often tell us if an account was compromised. So there are unique ways like that to think about using it. What are some of the data of things we're trying to track down that we could send over to Netsurion and have them alert us in real-time so we don't have to run a rapport or figure out, three days later, that something went on? We can find out right in the heat of the battle what we need to do.

Netsurion's dashboard is probably good. I don't log into the console every day and I don't use it operationally, in the way some people would if they didn't have those managed services. So dashboard-wise, I don't use it as much. I do use their intrusions worldwide map from time-to-time, but beyond that, because I don't get into the console on a regular basis, it's not as useful to me. But I feel like the console would be very powerful with the widgets they can add to it. They've demoed it for me but it's just not the way my workflow is.

I usually view Netsurion on just a single, 23-inch Windows screen. I don't have any real-time thing running all the time. I strictly use it on a desktop.

In terms of deployment and maintenance of the solution, we don't have anybody additional here. There was a CISO that I replaced and everything else was from the managed service side. We do have one system engineer here who maintains the box, the virtual server that it runs on. But that is a part-time responsibility. He really hasn't had to get involved since I've been here. So there has really been no additional staff. It was just an additional tool that was put into the environment and one that is a tremendous asset for us. There are four individuals besides me who use it and they're all in the server admin group.

Version 9 was a tremendous step forward for them. I don't know how long they developed that one, but they really took the right direction with the product. 

Overall, we're really thrilled with them. If I didn't have the managed services — and it wouldn't be the product's fault — I wouldn't be as thrilled with them. But that service really takes a lot off my plate and frees me up to be able to do the other things I need to do in the organization.

EventTracker analyzes all of the different types of security events, it both aggregates and correlates. They send us a daily report of things like servers that aren't responding that normally respond and any kind of events that they see from the day before. If there is a serious perceived security event, they will call. I have two folks at InfoSec, so they will call directly and say, "Hey, we're seeing something here." Then between the two of them, they'll try and identify whether it is a true event or not, and then monthly, we sit down with them on a call where we talk about what's going on and if there are opportunities for improvement.

If there was an event that we felt they shouldn't have escalated to us then we'll let them know and we'll talk about how it could have been avoided or vice versa or if there was an event that we didn't get escalated but it should have been. We don't get a lot of those, mostly it's about, "Hey, we're adding this new device, we want to make sure it's on the list, so it's getting monitored", and things like that.

EventTracker enables us to keep on top of our work. We're a hospital, so we're 24/7. We don't have enough staff to do that, so they're able to monitor things off-hours, and then even during hours I get two people from InfoSec. They can't be sitting there staring at a screen all the time, they have to go out and do other things and attend meetings, etc. and so they're able to rely on the tool to correlate and then notify them either via pager or phone call if something comes up that is deemed to be important enough to be notified. That's huge for us because we don't have the budget from a staffing standpoint to have people on-site 24/7.

Back in the day, I used to work for Intel and we had a whole room full of people who just sat there and stared at the screen for events. It was in their data center group. We don't have that kind of staff. The only people half staring at a screen all day long are the call center, and they're the ones who take tickets and talk to end-users but they don't have the time to sit there and monitor the event logs and all of the other things. That's the value the tool gives us. I can have people doing real work and then things that need to be escalated are escalated. It saves us roughly two full-time employees. It cuts my team in half. 

EventTracker also helps us with compliance mandates. The tool helps us document that we're following best practice, that we're identifying issues and tracking them, and that we have logs of what issues were identified. That allows us to be able to show a lot of the documentation that we are really doing best practice. I just don't physically have enough team members to do that. This allows me to be able to provide that 24/7.

It's not just a tool, it's a service. The secret sauce is not the tool. I could buy a tool from a dozen vendors. I have a tool to be able to aggregate and correlate all of these events and send something to a screen. But if I still have to have somebody sitting there staring at a screen all day long, that's valuable but not as valuable as someone that has a team, that is an essential SOC, that is aware of what's going on in the world and is saying "I'm seeing this in seven places, including El Centro, let's get ahold of El Centro so they can start taking action on it."

There's nobody that's dedicated to internal incident management. I have two information security folks and they do everything from internal incident management to designing new implementations, to reviews of existing annual information, and security audits. They do all of that, but they don't sit there all day long, staring at a screen, looking at incidents, and trying to figure out what to do. That's the value that we get out of it. That's the extra value.

Monitoring our environment and reporting out different events is important. They perform a suite of services. They monitor all of our servers, all of our key infrastructure, like our DNS, our switches, all that stuff. They aggregate and correlate that quarterly. They'll tell us if we're getting a lot of login failures and something is going on or if something's weird.

I like the dashboard. Our security folks look at it all the time. They have it running, they have a big screen monitor in one of their offices and it's up all the time.

I don't use the UI very much but from what I've been told by the security team, it's very easy to use. Compared to other products, the team found it pretty easy to use. We've got the dashboards published on a large screen TV so they can look at it all the time, and then they typically have it on their desk. It is also available on smartphones.

We import log data into EventTracker. It feeds the overall picture of giving us a good quality view of what's going on in our environment.

Communication is always something that can be improved, but I feel that any time we've had a communication issue, it's quickly addressed when we bring those up at the monthly meetings. Usually, it's an individual that wasn't clear in the communication, it's not the process per se. You always have to be able to segregate if the process didn't work or an individual either didn't say the right thing or my people didn't understand what they were being told. So far, I have not understood or heard of any issues that were more process or tool-related, it's individual-related. 

The industry is changing. The landscape is changing all the time and they seem to do a pretty good job of keeping up with that. That's a challenge in information security. That's a target that doesn't just move. It moves from room to room, to room, not just a few inches, one way or the other. You're constantly changing. You're chasing a moving target that's really moving. It boils it down to here's what we think is going on versus our people. If all they did was keep track of what was going on in the industry, that's all they'd do because I only have two people.

I have been using EventTracker since I have been at my company for the past year but it's been at my company for several years. 

It is as stable as a rock. I have not heard of a single outage on it.

We haven't scaled it out to anything other than what we had. They've done a pretty good job of implementing it. Since I've been here, we've had a virtual server primarily here and there, but we have not done a lot of scaling out. There hasn't been a discussion about what limitations there would be.

It monitors all of our infrastructure, all of our servers. It's being very extensively used. As we grow those, we're getting ready to open a new building early next year, all of the equipment that goes into that building will be added to it.

We fully implemented it so I don't know that there's a lot other than organic growth that would need to be done.

My InfoSec team talks to support occasionally. There have been a few cases where they saw something they didn't quite understand, so they would call and ask for information, but it's been few and far between. I have not heard of any issues with support. I heard that their experience with them has been good. 

At a previous company, we used a different tool. It was a much more encompassing tool that does a bunch of different event monitoring, correlation, and aggregation. It was a management suite that did things like backups as well. I know when we implemented it at Intel, it was atrocious. The problem was the process. We had tens of thousands of servers and we implemented the tool and we turned everything on. Events scrolled by the screen so fast, you couldn't even see them. We had to say, "Well, wait a minute. Let's dial this back a little bit." They also didn't do a good job of aggregating or correlating. 

The main difference between that tool and EventTracker is the ease of use. That tool was all CLI based. Everything was command-line based. The syntax that you had to use with that CLI was very challenging and very specific. If you thought you were doing the right thing but something did work and it wouldn't warn you that you didn't do it right.

I have not been told that there were any issues when it was implemented. We have not done any major upgrades since I've been here. We've done incremental patch-type things but I don't know of any issues.

I did hear it was relatively labor-intensive, but that's because of all of the processes around the communication, like what gets communicated and what doesn't. That's to be expected anytime you're doing a lot of workflow work, that takes time.

There's daily maintenance in that they're responding to events or they're working on the tool. There is very little done as far as trying to make changes to the tool itself. Our information security team does respond to events. It's a chunk of their time. We don't have to spend a lot of time at all tweaking the tool. I wouldn't say we spend even an hour a day.

I have two people in InfoSc and a couple of people in my network team that reviews it. My help desk people will review it but they don't really use it per se. They'll see events and that's it. Most of the time that really goes to the information security team.

Our ROI is $160,000 a year before overhead, then adding in the overhead of 30 to 40% with benefits and everything else, it's easily over $200,000 a year.

They've been very fair. I think that we've had to push back a little bit here and there on pricing. 

The biggest lesson I have learned is that the outsourcing of this service has a dramatic impact on the organization. We can't just keep throwing bodies at it internally, we have to leverage somebody else's knowledge.

Some people don't trust outsourcing. I'm not a big outsourcing guy. But I really don't treat them as an outsource, I treat them more as a partner. You're going to have to do this one way or the other, or are you going to get nailed at some point. That's just the way it is. If you're not following these things, you're going to get nailed. If you trust them and you realize that they're doing things that you should be doing or are doing, you're going to save a lot of money out. It's going to be cost-effective for you. It won't just save money, it will be cost-effective.

I would rate EventTracker a ten out of ten. 

Having dealt with a lot of vendors and their sales, they are probably one of the more low-keyed. They're not out there constantly trying to sell me stuff. I don't know if it's because we have everything so there's nothing left to sell or not, but they've been very easy to deal with. Their leadership and their sales organization have been very easy to deal with.

It's a system incident and event management platform. The typical use cases that go along with that are alerting and syslog aggregation.

Their run-and-watch service (now renamed SIEMphonic) has saved from having to hire at least one FTE. In addition, having an expert set of eyes on things and their assistance with rules has been a huge time saver. They've been a really good partner.

We are logging everything from Windows client workstations through our server stack, through important, critical web and cloud pieces, like Office 365 logs and web server logs. The latter would include IIS and Apache. All of that information is being streamed directly into, and assimilated by, the EventTracker product. It seems to be doing the job quite well. Having that visibility into the data is useful. Their interface is simple enough for us to be able to use but advanced enough that if we wanted to do some more advanced queries — which some of their competitors admittedly do a little better out-of-the-box — it hits the wheelhouse perfectly.

We're signed up for their weekly observations, so if they find something big they're going to notify us immediately. But having a management-level synopsis once a week has allowed us to not only replace the one FTE, but also streamline our prioritization of work, based off that data, as well.

Other than the log aggregation and alerting, their reports modules have come a long way. But for the most part, we stay right in the wheelhouse of the product to use it to the fullest extent.

The previous version, version 8, had a somewhat antiquated UI. The new version 9 is much easier to use and brings it into the current realm of development. It's very easy, very sleek, and designed relatively well. The version 8 to version 9 upgrade was complete night-and-day. It's significantly improved, and they're putting resources into it to make sure that they continue to stay up to date.

I like EventTracker's dashboard. I see it every time I log in because it's the first thing you get to. We have our own widgets that we use. For the sake of transparency, there are a few widgets that we look at there and then we move out from there. We're into the product looking more at the log information at that point. Among the particularly helpful widgets, the not-reporting widget is a big one. The number-of-logs-processed is also a good one. We call that log volume. They're helpful, but we try to dig in a little deeper, off the dashboard, more often than not.

In terms of advanced queries, I wouldn't say EventTracker is lagging behind its peers. The latter just make it easier to get to them. EventTracker is designed more for a small to medium type business, which is where we fit. With a competitive tool like Splunk or LogRhythm, you're not going to get what you get with these guys out-of-the-box. With EventTracker, you're going to have to build all that yourself from scratch. You're going to have to learn that markup language to do so.

I want to stress: We're very happy with not having to deal with that out-of-the-gate. If we need to, we can always call support and they can assist us in writing those more advanced queries. The functionality exists to do advanced queries, they're just not right in your face like they are in a competitive product. But for us, that's what we want.

There's always room for improvement in terms of performance and alerting options. It would be great if they had a client for phones by which they could push a notification to us, as opposed to via email. But those are all things that they'll grow into over time.

We've been using EventTracker for just a smidge over three years.

It has been extremely stable. Very rarely do we even realize that it's still running, and that's good.

We did have a few concerns with the scalability in the beginning. Our initial concerns were about scaling it and, if we blew it out, were we going to run into performance issues with their agent piece using too many resources on the client or running out of space on the server? But those concerns proved to be unfounded. We have 700 or 800 endpoints streaming data into it without any noticeable performance or any other issues.

We're using it almost to its full extent at this point. We're in that 90 percent range. We currently don't have any plans to move away from it. We're utilizing the features that pertain to us. Anytime that there's a patch or release, we look at the new features to see if they're applicable for us.

The EventTracker team itself has been great. We can call them for pretty much anything related to their product. They will offer suggestions, advice, and best practices on ways to do things. It's like having another team member here at our disposal, working with their product. I believe that is their standard tech support.

We're paying for the run-and-watch (SIEMphonic) so we're getting an extra set of eyes on things, but when we call in, their support is top-notch. I would give their support team a 10 out of 10. That is a given. Of all the products and vendors that we've used, I've never had a more positive experience with a support team than with EventTracker's support team.

We did not have a previous solution. We do annual audits, and the lack of a SIEM showed up in one of our audits as a piece that we needed to start investigating, four or five years ago. We knew that issue was coming. We were too busy dealing with some other things, but when it showed up in the audit, we pushed it up the priority food-chain. We weren't really having any issues by not having a SIEM, but having all the logs in one place sure makes troubleshooting a whole lot easier. if there was an Achilles heel, that was it.

We were looking for an easy-to-manage SIEM that provided the functionality that we needed. Since we're a relatively small IT staff, the part that really made EventTracker stand out to us was the run-and-watch service (SIEMphonic), where they are an active partner, reviewing the data that we get, so we don't miss anything. They're acting as a backstop to us.

The initial setup was completely painless. They gave us a spec sheet for the on-premise server. We built a VM that matched that spec, and they then installed their software and got it up and running. We could be as involved or as uninvolved as we wanted to be; that was our choice. When it came to deploying the client pieces, they worked with us to identify which machine should get it and when. They took care of the pushing of that information out. When we started getting the data in, and it came time to start tweaking the rules, they took the lead on that as well. It really, truly was a painless process.

The deployment took less than a week. We had an analyst at that time who was running point on it. I wasn't even involved. I didn't need to be involved in it at that level. One of our entry-level analysts was able to work with them to get everything caught up.

I and one analyst are involved in the day-to-day maintenance of the application. Our entire IT staff, nine people, uses it for log review and incident correlation. We try to put the information out there for the rest of our team members to use.

We have been able to save at least one full FTE. The amount we would have to pay that FTE, including benefits, is way more than what we're paying EventTracker for the annual maintenance. It had a positive return on investment almost immediately for us.

Our cost is significantly less than what it would have been for one of the competitor's products, and that includes the run-and-watch service (SIEMphonic). You can go with one-, two-, or three-year agreements. We pay annually for maintenance on the product.

When we acquired EventTracker, we went through an assessment process, reviewing five or six different manufacturers of SIEMs. The frontrunners were the typical players: Splunk and LogRhythm. There were a couple of freeware options out there, but what really set EventTracker apart was their SIEMphonic. That was the big differentiator. We were able to get much more value for our money, and it met all the requirements that we had set out when we started the research.

There weren't really major differences between EventTracker and the other players. Ultimately, SIEMs do the same things. They collect logs, they index those logs, and they make them searchable. There's not really a difference on the surface.

The biggest lesson really isn't an EventTracker lesson, it's more of a SIEM lesson. And that lesson is: It's a lot of data. When you have a lot of data, it's going to take a while to study and learn that data, so you can react appropriately. Not all data is actionable.

Be prepared for the data. Be prepared to know what you didn't know before. And be prepared to weed out the noise from the actual data. That's where EventTracker's SIEMphonic becomes very helpful. My advice would be, if you're going to go with EventTracker, to go with the SIEMphonic service and leverage their support team to get your knowledge up to speed. So far, our experience with their support has been top-notch.

In terms of how we view EventTracker, we're typically just in a browser, so it's on whatever our standard is. I've got a couple of 20-inch monitors on my desk. It's sleek enough that it will work on a normal 15-inch laptop screen too. I have not looked at it on mobile yet, given the fact that it's an on-premise service. If I'm in the building, getting VPN'ed in across my phone is a little tough. But that would be the next iteration of the product, if we would decide to push up towards the cloud instead of being on-prem. We would definitely be looking for some sort of a mobile or a tablet-based mobile interface.

We have not integrated EventTracker with other products. Our service-desk tool is a tool called Samanage, which was recently acquired by SolarWinds and has been renamed Solar Winds Service Desk. We have not integrated anything with that since SolarWinds acquired it, because we wanted to see what SolarWinds was going to do with it. Integrating it into EventTracker is on the list. We'll do it if it makes sense.

I never rate anything a 10 out of 10, because nothing is ever perfect. But this solution would be at the upper end of that range. This partnership with EventTracker has been one of our better ones.