Netsurion Reviews

Our IT department has limited time and resources. We are unable to create our own SOC, therefore Netsurion has helped us accomplish more security initiatives and monitors our environment.

Netsurion provides us with information that we never saw before. The solution helps us see it, capture it, bring it together, report on it, and derive analytics from it. They've provided visibility that we've always wanted but never had. When I'm speaking to the board information from Netsurion helps me provide them and senior leadership pertinent security information from within our environment. We provide a visual map of where potential bad actors are trying to connect from. We can see which applications attackers are trying to exploit. It drives dialogue that helps increase security awareness. It also enables us to justify our security budget.

Extending our detection and response through integration is something we're exploring. We have various products that we currently integrate into Netsurion. Our organization typically takes a best-of-breed approach for software selection. We will explore more integrations to see if there are efficiencies to be gained or if we can achieve quicker reporting and remediation.

Netsurion offers a flexible solution that covers our entire IT environment. They're another resource for us and act as an extension to our existing security resources. Netsurion isn't just monitoring our environment, reporting on it, and letting us take care of it. We bounce questions off them, and they help us dig deeper into incidents as they happen. 

They provide us with the necessary information to make business decisions based on some of these events. Netsurion is more than just a vendor to us—they are truly a partner that has changed how we approach security.

Their SOC is going above and beyond. They're our first MDR. Netsurion prefers to label itself as an XDR, but we've never had a managed response at that level. We had someone watching our perimeter firewall before, and we would run unannounced penetration tests against our environment. That organization was not able to detect the anomalous activity.

When we ran tests with Netsurion, their SOC investigated things and pinpointed exactly what was going on within two minutes. We've been able to verify the work they're doing. It's nice to have an organization watching my back while I'm trying to do what I need to do.

We like to investigate and find any anomalies. Whether we or Netsurion see activity taking place, they have the resources to monitor logs and do the investigations that we are too strained to perform. They can identify the activity causing the incident. By seeing the whole picture, it has helped us make decisions that reduce our false positives.

As an example, we requested specific logs from our web filter, and the response of Netsurion's SOC was above and beyond what the contract specified. Not only did they provide the data requested, but they also modified the visual presentation to our specifications.

Using Netsurion's SOC has freed me up to focus on other tasks. Initially, my role was purely focused on day-to-day security. My role has transitioned into
managing half of our IT department. I have less time to focus on day-to-day tasks. Most of that work has been transferred to the SOC. We have utilized them far more than we ever expected.

When we signed an initial contract three years ago, we wanted to see what we could get from the service. As we get ready to renew the contract this year, we're looking for more ways to utilize their services because budgets are getting tighter. We are exploring ways to take advantage of the SecOps management features.

Our time-to-detection has decreased exponentially, but I don't know how to quantify it because we weren't seeing the things that they're reporting. We knew they were there, but that level of visibility wasn't there. They notify us in under five minutes about issues we never would have known about before.

The remediation time has also improved exponentially. We can't remediate an issue unless it's known. As soon as an incident is detected, they notify us within a few minutes. We've remediated most issues in under five minutes.

What I like most about Netsurion is the level of visibility and reporting. We integrate multiple solutions and feed them into the managed services. It provides a single-pane-of-glass view. Having that data integration makes it easier.  Instead of logging into all these different solutions to find the essential things we're trying to home in on, we can log into Netsurion. We have them monitoring for specific events and activity, and they report alerts within a few minutes.

The integration is easy. We define the requirements, and they make it happen. We don't have an SLA for how quickly it needs to be integrated. You give the requirements and they make it happen. Communication is consistent and thorough. Validation testing is also done to ensure our needs have been met.

There's always room to improve because there would be no competition if they had a perfect solution. The GUI to perform searches within the product may not be intuitive to a new user. That's something that could be simplified, but I have no complaints about the product or the service they provide. They're phenomenal.

We are going into the third year of our contract with Netsurion.

At times, the agent may consume a lot of resources, but that typically happens when the agent is running on some assets that are near the end of life. 

We have not contacted technical support directly because we work strictly with our SOC. We've had relatively few issues with it outside of requests or alerts.

We had a company that did some network monitoring, but we were unsatisfied with their detections, and they were not responsive. 

The deployment couldn't have been easier and required approximately three staff on our side. After installation, Netsurion doesn't require much maintenance aside from providing the resources for the solution to run on. We go through support to request upgrades and customization. They take care of all of that. We only need to allocate resources. 

Netsurion's pricing is extremely fair and flexible. The price of their SIEM product is reasonable, and you can pay for those services you want on top of that. It wasn't cheap, but it's competitive, and we intend to renew our contract. 

We looked at Splunk, LogRhythm, and SolarWinds. We may have evaluated some other solutions, but those were the main players. We chose Netsurion after consulting with other organizations in our industry. Netsurion is a highly respected company with a good reputation. They also seemed more than willing to adjust to our environment. With some of the larger players, you have no choice in how to utilize their product. Netsurion was accommodating to all our requests. 

Obviously, pricing was a factor. They weren't the cheapest or the most expensive. Ultimately, it came down to how they could help us. It felt like they wanted to work with us to enhance our security posture and get us where we needed to be versus just selling us a service and a product. They wanted to work with us.

It's a system incident and event management platform. The typical use cases that go along with that are alerting and syslog aggregation.

Their run-and-watch service (now renamed SIEMphonic) has saved from having to hire at least one FTE. In addition, having an expert set of eyes on things and their assistance with rules has been a huge time saver. They've been a really good partner.

We are logging everything from Windows client workstations through our server stack, through important, critical web and cloud pieces, like Office 365 logs and web server logs. The latter would include IIS and Apache. All of that information is being streamed directly into, and assimilated by, the EventTracker product. It seems to be doing the job quite well. Having that visibility into the data is useful. Their interface is simple enough for us to be able to use but advanced enough that if we wanted to do some more advanced queries — which some of their competitors admittedly do a little better out-of-the-box — it hits the wheelhouse perfectly.

We're signed up for their weekly observations, so if they find something big they're going to notify us immediately. But having a management-level synopsis once a week has allowed us to not only replace the one FTE, but also streamline our prioritization of work, based off that data, as well.

Other than the log aggregation and alerting, their reports modules have come a long way. But for the most part, we stay right in the wheelhouse of the product to use it to the fullest extent.

The previous version, version 8, had a somewhat antiquated UI. The new version 9 is much easier to use and brings it into the current realm of development. It's very easy, very sleek, and designed relatively well. The version 8 to version 9 upgrade was complete night-and-day. It's significantly improved, and they're putting resources into it to make sure that they continue to stay up to date.

I like EventTracker's dashboard. I see it every time I log in because it's the first thing you get to. We have our own widgets that we use. For the sake of transparency, there are a few widgets that we look at there and then we move out from there. We're into the product looking more at the log information at that point. Among the particularly helpful widgets, the not-reporting widget is a big one. The number-of-logs-processed is also a good one. We call that log volume. They're helpful, but we try to dig in a little deeper, off the dashboard, more often than not.

In terms of advanced queries, I wouldn't say EventTracker is lagging behind its peers. The latter just make it easier to get to them. EventTracker is designed more for a small to medium type business, which is where we fit. With a competitive tool like Splunk or LogRhythm, you're not going to get what you get with these guys out-of-the-box. With EventTracker, you're going to have to build all that yourself from scratch. You're going to have to learn that markup language to do so.

I want to stress: We're very happy with not having to deal with that out-of-the-gate. If we need to, we can always call support and they can assist us in writing those more advanced queries. The functionality exists to do advanced queries, they're just not right in your face like they are in a competitive product. But for us, that's what we want.

There's always room for improvement in terms of performance and alerting options. It would be great if they had a client for phones by which they could push a notification to us, as opposed to via email. But those are all things that they'll grow into over time.

We've been using EventTracker for just a smidge over three years.

It has been extremely stable. Very rarely do we even realize that it's still running, and that's good.

We did have a few concerns with the scalability in the beginning. Our initial concerns were about scaling it and, if we blew it out, were we going to run into performance issues with their agent piece using too many resources on the client or running out of space on the server? But those concerns proved to be unfounded. We have 700 or 800 endpoints streaming data into it without any noticeable performance or any other issues.

We're using it almost to its full extent at this point. We're in that 90 percent range. We currently don't have any plans to move away from it. We're utilizing the features that pertain to us. Anytime that there's a patch or release, we look at the new features to see if they're applicable for us.

The EventTracker team itself has been great. We can call them for pretty much anything related to their product. They will offer suggestions, advice, and best practices on ways to do things. It's like having another team member here at our disposal, working with their product. I believe that is their standard tech support.

We're paying for the run-and-watch (SIEMphonic) so we're getting an extra set of eyes on things, but when we call in, their support is top-notch. I would give their support team a 10 out of 10. That is a given. Of all the products and vendors that we've used, I've never had a more positive experience with a support team than with EventTracker's support team.

We did not have a previous solution. We do annual audits, and the lack of a SIEM showed up in one of our audits as a piece that we needed to start investigating, four or five years ago. We knew that issue was coming. We were too busy dealing with some other things, but when it showed up in the audit, we pushed it up the priority food-chain. We weren't really having any issues by not having a SIEM, but having all the logs in one place sure makes troubleshooting a whole lot easier. if there was an Achilles heel, that was it.

We were looking for an easy-to-manage SIEM that provided the functionality that we needed. Since we're a relatively small IT staff, the part that really made EventTracker stand out to us was the run-and-watch service (SIEMphonic), where they are an active partner, reviewing the data that we get, so we don't miss anything. They're acting as a backstop to us.

The initial setup was completely painless. They gave us a spec sheet for the on-premise server. We built a VM that matched that spec, and they then installed their software and got it up and running. We could be as involved or as uninvolved as we wanted to be; that was our choice. When it came to deploying the client pieces, they worked with us to identify which machine should get it and when. They took care of the pushing of that information out. When we started getting the data in, and it came time to start tweaking the rules, they took the lead on that as well. It really, truly was a painless process.

The deployment took less than a week. We had an analyst at that time who was running point on it. I wasn't even involved. I didn't need to be involved in it at that level. One of our entry-level analysts was able to work with them to get everything caught up.

I and one analyst are involved in the day-to-day maintenance of the application. Our entire IT staff, nine people, uses it for log review and incident correlation. We try to put the information out there for the rest of our team members to use.

We have been able to save at least one full FTE. The amount we would have to pay that FTE, including benefits, is way more than what we're paying EventTracker for the annual maintenance. It had a positive return on investment almost immediately for us.

Our cost is significantly less than what it would have been for one of the competitor's products, and that includes the run-and-watch service (SIEMphonic). You can go with one-, two-, or three-year agreements. We pay annually for maintenance on the product.

When we acquired EventTracker, we went through an assessment process, reviewing five or six different manufacturers of SIEMs. The frontrunners were the typical players: Splunk and LogRhythm. There were a couple of freeware options out there, but what really set EventTracker apart was their SIEMphonic. That was the big differentiator. We were able to get much more value for our money, and it met all the requirements that we had set out when we started the research.

There weren't really major differences between EventTracker and the other players. Ultimately, SIEMs do the same things. They collect logs, they index those logs, and they make them searchable. There's not really a difference on the surface.

The biggest lesson really isn't an EventTracker lesson, it's more of a SIEM lesson. And that lesson is: It's a lot of data. When you have a lot of data, it's going to take a while to study and learn that data, so you can react appropriately. Not all data is actionable.

Be prepared for the data. Be prepared to know what you didn't know before. And be prepared to weed out the noise from the actual data. That's where EventTracker's SIEMphonic becomes very helpful. My advice would be, if you're going to go with EventTracker, to go with the SIEMphonic service and leverage their support team to get your knowledge up to speed. So far, our experience with their support has been top-notch.

In terms of how we view EventTracker, we're typically just in a browser, so it's on whatever our standard is. I've got a couple of 20-inch monitors on my desk. It's sleek enough that it will work on a normal 15-inch laptop screen too. I have not looked at it on mobile yet, given the fact that it's an on-premise service. If I'm in the building, getting VPN'ed in across my phone is a little tough. But that would be the next iteration of the product, if we would decide to push up towards the cloud instead of being on-prem. We would definitely be looking for some sort of a mobile or a tablet-based mobile interface.

We have not integrated EventTracker with other products. Our service-desk tool is a tool called Samanage, which was recently acquired by SolarWinds and has been renamed Solar Winds Service Desk. We have not integrated anything with that since SolarWinds acquired it, because we wanted to see what SolarWinds was going to do with it. Integrating it into EventTracker is on the list. We'll do it if it makes sense.

I never rate anything a 10 out of 10, because nothing is ever perfect. But this solution would be at the upper end of that range. This partnership with EventTracker has been one of our better ones.

I use it for security events and incident management. It's a fantastic product. Netsurion Managed XDR is a really good product. It is hosted, and they do a lot of the analysis. They get great reporting. It covers all my highly valuable assets and offers a really low impact on my systems. I check a regulatory box as well as a cybersecurity box, so it covers a lot of bases for us.

The great upside is compliance and regulatory satisfaction. If we say we're using this product and someone wants to report, that's it. There's no question about the legitimacy of the product. They're large enough in the marketplace. Our regulatory bodies know about them and understand what the product is like. That's the number one pro for me. 

It gives me a really good piece of mind. I have a couple of products. This one is not cheap. However, it doesn't have to be. I pay a premium and they give me peace of mind that I don't get with any others.

A SEIM is an SIEM. They all do the same thing. What's valuable about the Netsurion Managed XDR product is the analysis that it brings to the table. They do a really good job of filtering out; it generates a tremendous amount of data. They filter out what's needed and give me what I need to pay attention to. That's hard to do in a lot of the other products.

The product provides us with a flexible solution that helps protect our entire IT environment. I only take advantage of it on the server side. I don't need it for my desktops, however, certainly, they offer that. Overall, it is quite flexible as evidenced by the fact that when it's first tuned, you get a large amount of data, and they're able to fine-tune that over time. To me, that's really important.

We operate with their SOC. They are really nice guys. Great to work with.

In terms of the SOC when it comes to alert monitoring and threat hunting, they do a great job. The fact that they're able to tune it for me over time and build a relationship is helpful. Some of those guys have been there for ten years. Is really important to us. They know what's valuable to us and what we want to see. We have the SOC provide a regular meeting. It's quarterly. We all get together, and I let my engineers do it over the phone. They'll let us know: "We're seeing this. This isn't important." They voluntarily call things to our attention and so on. It's a real value add working with them.

The SOC is helpful for eliminating false positives. It filters out unneeded and unnecessary alerts and calls my attention to what's really important and what I need to pay attention to.

Expediting incident response is really great. What's really nice is I haven't had to use it. So I don't have any examples. That said, they're really quick to respond. Again, that comes back to the SOC. They're there all the time. So they are looking at our stuff 24/7. We pay for that, yet it's a really valuable aspect of the service.

Using the SOC affected our ability to focus on, for example, any other tasks. They've taken a whole bunch of work off my team and made it easier for them to do other important aspects of what we do every day in our bank.

Monitoring helped to boost your SecOps productivity. It's decreasing the tedious SecOps management tasks.

The time it's saved us per week is an FTE equivalent or more. That's easily 40 to 60 hours a week. It's saving my team. There's no doubt in my mind. It's probably more than that, however, I could confidently say it's 40 to 60 hours a week.

The product has reduced the time to detection in my estimation. I haven't had any, however, it's clear to me that they would help. When we have had something that's been sort of fishy, they definitely chime in, and we get a notification from them almost immediately.

There is one area that needs improvement and that is with the agents and the server that's on-site. The system requirements are very, very high. So I need a pretty powerful server to run. If they could lighten that load so that the on-premise part of their product didn't impact my systems as much that would be ideal. My understanding is that's something they already know and are working on. If they could do that, I'd be even happier with them. 

I've used the solution since 2014. I've used it for around nine years. I'm a happy client. 

I don't have any stability issues. 

The scalability comes down to the server that is on-prem. That would be a problem if you have to pivot scalability. The agents on the servers are not a problem at all. I could deploy more systems. However, the server that gathers the data can be a hog. It would be ideal if they could take that piece out and take everything to the cloud to analyze there. 

We talk to technical support all the time. My team doesn't have any problems with them. Sometimes there may be language barriers, however, in general, they are all good to work with. They are responsive and make good decisions. 

Neutral

I did not previously use a different solution. I jumped to this product right off the bat.

I was involved in the initial deployment. 

It was relatively straightforward as I recall. It's just deploying an agent. You need a server. We built that form, and they did most of the work for us.

We needed maybe one and a half people to handle the deployment. 

It doesn't really require much maintenance. During quarterly meetings, they will push updates to us; those are pretty low-impact.

We have a hybrid setup. They have a cloud-based component, and that's where the SOC sits. Then, there's an on-premise server that feeds to their cloud.

Since it is a regulatory requirement for us, I don't even track ROI. That said, if I am saving one FTE a week, about 40 hours, if I had to pay somebody 40 hours a week, after a year, this more than covers that cost. In that sense, it's almost a 100% return on investment just for the dollars saved on labor.

Their pricing is high. I don't know if it's a barrier. The quality speaks to the price. The price is the price. They provide what they promise. From a purchasing perspective, I just have to come back and say, well is that function that important to me? And so far, every year, that function has been that important to me.

I did evaluate other solutions, however, I cannot recall which ones as so much time has passed. Many may not be on the market anymore. 

At this time, I do not use the additional data source integrations offered to help protect our environment.

I'd rate the solution eight out of ten. It's one of my favorite products. 

They should be well-known. I've had zero issues with them. It's expensive, yet you get what you pay for. 

New users need to understand that it is kind of hands-off. You aren't going to have to put much into it once it is up and running. The time savings and the peace of mind make it worth it at the end of the day. 

We use it for logging all of our Active Directory activities, including authentication, alterations, and modifications to the AD controls and privileges. We use it for events coming off of both the servers and the desktops. And we also roll in the logs from our various security controls and devices, such as our antivirus tools, backup service, firewalls, the IPS, etc. Those are all rolled back into the EventTracker system. The goal is to eventually start taking advantage of the ability of EventTracker to correlate activity and alert on something that looks a bit unusual that we should then pay attention to.

We get a daily report that they've built, which summarizes all of the activity across all of those areas, on a daily basis for us. The types of log data we import into it include firewalls, server event logs, user workstation event logs, all of the Active Directory activity and authentications, and all of our antivirus logs and our patching service logs.

It's in the cloud. We use their console and we take advantage of their storage. We have them manage our logs and our archivals. 

The result of the reports on activity and the archiving for research has been that the operational teams are more consistent in the usage of standard practice which, from an efficiency perspective, has removed the need for the information security team to investigate issues that are out-of-norm activities. We are no longer doing an internal incident three or four times a week. We may do three or four in a month. That saved us significantly on the incident investigation side. We have pulled back 10 hours a week, on average, just from the security team. I would contend that it's probably also saved time that I'm not able to measure from the operations team because now they're not remediating things that we're pushing to them, and the user community is getting a more consistent experience from the support teams as a result.

There's this downstream value that I don't think people really think of when they look at products like this: What is the cause and the effect that it has on operations? In our case, it was to improve the efficiency and the consistency of the operations which, in turn, resulted in the user community getting a better experience. It's really hard to measure the user community improving its view and opinion of the IT support teams.

The report, each day, of the activities that have happened and the ability to archive and go back and research have been extremely advantageous for us. Examples would be a user having either inappropriately touched a file, or an administrator of the infrastructure altering rights or privileges for a user outside of an approved change-control or approved ticket. We have found that, over time, we've been able to mature the discipline of our operational teams by having the ability to see activity that might have occurred outside of standard practice.

In terms of the log data importing, our data went in very easily. That was one of the things that was appealing to us because the product set we use here for antivirus, single sign-on, the authentication services, and the patching services were all in the supported-product suite. So adding them in was simply getting them pointed over there and getting through the change-control windows.

There are a couple of widgets that I use. One is titled "A Possible Compromise" or "Potential Compromise." I use that because it is generally giving me feedback on the login velocity. I can see people who have authenticated to a system but, geographically, have authenticated to another system, and it's not possible to have done that within the time window that those authentications occurred. I find that it's generally a result of them authenticating to their mobile phones, because you don't necessarily egress the carrier's network from the cell tower you're associated to. In our case, we're in Boston. If you happen to be on an AT&T phone, you actually egress either out of Wisconsin or out of New Jersey. So if you log into your laptop and then you pull up email on your phone, it looks like you logged in from one of those two locations as well. We can dismiss those because we're getting used to what that looks like. 

As a result of that, we have picked up two or three folks who have shared passwords, usually with their administrators. They're traveling, they log in from someplace like Japan or Germany, and their admin happens to log in to help take care of an expense report. We tell them, "You have to stop that." We've picked up a few of those types of events. These are the kinds of things that we look forward to the product giving us more and more of as our usage of it matures.

I like the UI, overall. I like the main page and there are aspects of the search page that I like. When you bring it up, on the left-hand side of the page, as you look at the events, the ability to simply hit and click the plus/minus to pull events in and out of the overall view is well done and is very effective from a threat-hunting and an analysis perspective. I like the detail it shows. It gives some hints.

Occasionally, I'll use EventTracker on my phone because I got a phone call or an alert, but generally, it's on my large panel displays. All of the team has the same setup: multiple, large displays driving off of a laptop.

I tend to like more flexible and detail-structured interfaces. As an example, I don't like to manage my firewalls through the graphical interface. I like to use the command line because it's more granular and it lets me do things a little more quickly. EventTracker has done a nice job in providing both that graphical dashboard and Elasticsearch capabilities. As far as the direct command line goes, I would like there to be a little bit better help in that space. But the fact that they've got both in place is a bonus for the product. As I've learned more about how to do Elasticsearch, it's been beneficial. It's just taking a long time to educate.

I like the dashboard. Where there is an opportunity for improvement is in the interface used for performing the searches. You have to understand Elasticsearch search too well for the security team to be able to take really full advantage of that part of the product. It's not as intuitive as I would like it to be for new staff coming in. The general query capability is a little bit challenging.

Once I expand an event I can usually cut and paste out of there into the Elasticsearch side of it to get a broader view. But it's a multi-step process. I'd would like to see them add something that lets me right-click and immediately search to it, instead of having to walk through a couple of windows. When you're doing research on events, that kind of stuff adds up in your day. It's two or three clicks, but when you're driving through a bunch of analyses, that can start to add up quickly. When it's an event that you've got going on and you need to find out what's truly happening, time is of the essence. Anything that can shorten that would be beneficial.

We've been using it for just under a year.

The only stability issue we've run across would be the log forwarding off of the devices occasionally hanging up. I don't know if that's the EventTracker agent or the server itself, because there are a lot of applications running on those servers. But the console itself, I don't think it's ever been down, other than his patch which we just experienced.

We've done searches going back in the archives all the way to February when we first started, and it surprised me as far as the performance goes. We're not enormous. We're taking in about 3 million events a day. We're about 3,000 employees, worldwide. I don't know that I can give a good analysis on scaling.

It's meeting our needs really well from a scale perspective. We haven't seen a performance issue associated with the volumes we're running with, and we're almost fully deployed. Of the 300 servers, there are only about 10 now that don't have it. All of the 2,500 end-stations have it. It's taking all of that. We're 90 percent where we want it to be with the log sources and it hasn't changed its performance or behavior at all. It has scaled very well so far for us.

Our plans to increase usage are only as we grow. The company has growth plans associated with it, and as new staff comes on and the machines get provisioned, it continues to increase the systems that are feeding to it. We don't have any plans at this point to be putting in any other log sources, other than those we've already identified. I'm thinking of either homegrown applications or unique applications that might generate log files. We don't have anything on the roadmap today for that.

The support team was really good. They've got a very good support organization. Everybody we worked with on the phone, as we were doing the initial setup, and even as we've done different support calls or requests for help, has done a lot of work for us, which is terrific as a company. We'll need to figure something out or we'll need help to investigate a problem. We'll put a ticket in and they'll call us right back. They'll help run queries for us, they'll run reports for us for a specific incident. They're a very responsive support team, and that's their standard tech support.

It's a "wow." It's nice to see a company that does things the way they used to be done. I think it's because they feel they've got a good product. The support team is terrific. I've been doing this a long time and it's one of the better support organizations I've run across in the last 15 years.

We did not have a solution in place prior to EventTracker. Prior to this, in a company I had been at just before I got here, we used IBM's QRadar and, although we did look at that product here, I found that EventTracker was more appropriate for us.

I don't think that QRadar offered the same robust integration opportunities with logs and it did not offer the same correlation capabilities that EventTracker does. Also, we get a much better licensing structure and pricing structure. It's a much better value for the dollar with this product.

The initial setup was very straightforward. They stood it up, we started pointing log sources to it, and away it went.

They built the infrastructure, the receiving side of things, within a week. We were up and shipping logs within two weeks of the contract being signed.

In our particular case, and it's not a product issue but an operational issue, it took us until June or July of this year to get the logs rolled out or captured from the systems, after we started using it in February. The effective time window is that we've probably only had it for about three months. That was not because of the product. It took us that long to get the logs forwarded over to them.

The reason it took us so long was that we were, at the time, a pre-stage pharma. We didn't have product on the market yet. Just as we were bringing EventTracker into production here, we got approval for our first medication, which changed the nature of our operations from a research community to a fully controlled FDA manufacturing firm, as well. Change-control became a much stricter event. We missed the window to be able to push this out quickly, but it's nice to be commercial.

In terms of our deployment strategy, we had built a timeline or a set of change-controls that went through those several months to start rolling out. At the time we were doing this, we were getting to roll out Windows 10. So one of the first things we did was to build the logging into the core golden image. As Windows 10 boxes rolled out, they automatically started logging. We rolled out doing upgrades from Windows 2008 Servers. We did the same thing and put that into the image. On Active Directory it was pretty straightforward. The servers that were part of production, as far as manufacturing goes, those had to go in very specific windows based on production protocols. 

Overall, we built a project plan out such that every week and every month, from a production perspective, we would have windows where we could start to deploy. That's why it took so long.

We did it internally. It's very simple. There was no need for a third-party or assistance. It was a really easy deploy.

The value of a SIEM comes when you are able to detect something and avoid a problem. It is part of that larger "insurance policy"-type function. You never see a return on investment on an insurance policy until it comes time to use it. But we get value from it every day. Do I think that the investment in the product is giving us value for the dollars we're spending? Absolutely.

I look at it this way: If I need a truck to do my job every day, and my job is to haul two-by-fours back and forth between two job sites, do I need the Cadillac pickup truck or do I need the truck with the roll-up windows? They both do the job and they both do it really well, but the value is in the one that has the roll-up windows. It's doing what it's supposed to do. It's doing it well and it lets me retain dollars for other purposes. EventTracker is exactly that. It's giving me all of the features and functions that we need to do our jobs, and at a price point that's incredibly attractive. It allows me to save money and put money into other services to help reduce risk.

It's a simple product. It's a lot easier to implement and deploy than the other SIEMs I've used throughout my career. The advice would be that using it is a good decision. There's no reason to shy away from the product.

From an event-alert perspective, we haven't used them for that purpose yet. That's largely because the current security services we have in place from our vendors, CrowdStrike in particular, provide us a managed event system from the AV side. They proactively manage our antivirus that's on all of our machines and they also proactively remediate the machines. So we haven't felt the need, yet, to take part in EventTracker's alerting of detected cross-events. That will come in this upcoming calendar year. Our program here is only two years old. The security program itself was only in existence for about nine months before we started to engage with EventTracker, and deployment was earlier this year. We're still really in deployment mode.

We haven't integrated EventTracker with any other solutions. We use ServiceNow but we have not made any effort to integrate it. Our roadmap for ServiceNow is to do exactly that and take advantage of that integration capability and have it issue either alert tickets or work requests into ServiceNow for us, so that we don't have to do those manual steps. We are probably a year away from that.

There are two others besides me using it in our organization. They're both security analysts. There really isn't any maintenance. We've occasionally had servers that stopped talking for whatever reason but a reboot took care of that. Generally, what we're finding is it's due to an application memory leak on that server. But it's just working. There is no effort there.

I would rate it a 10 out of 10. The ease of deployment, the support that we receive from them, the dashboard console which I find to be very helpful, are all part of that rating. I would like to see some more assistance in the way that searches are built, but as I've learned how to search, it's getting easier and easier. Overall, it's a well-priced and functionally appropriate SIEM.

We are using it to centralize all of our logs and have alerting on security issues. 

We primarily import Windows systems and Windows Server logs (2012 and 2016). We also import Cisco ASA logs, then Cisco router and switch logs. The import works well. 

We send the Snort IDS alerts to EventTracker, e.g., high level ones like Ransomware and data leak type alerts, we are sending the Snort alerts to EventTracker. For things like ransomware, data leaks, and data exfiltration, we have higher incident reports created, so then it also gets sent to our email and phone. As an example, this Saturday night around four o'clock, we were alerted to an incident from EventTracker. They got a Snort alert about a data leakage or data exfiltration. It was a false positive, and that is good. But, this is just one way we use EventTracker.

It is fairly easy to use. I am mainly just a one man shop. I look at EventTracker about once a day as far as different incidents and stuff goes. I don't have enough time to be tweaking all types of different things. It is a fairly easy to use as far as the UI goes.

If I were to look at logs manually, there's no way I could do that. As an example, they are 48 million logs processed a day. There is no way I could look at all 48 million of those. So, it gives me a good structure to be able to look at the different incidents which are created and do different searches.

The solution's dashboard is okay. The one thing that we ran into are issues when we upgraded to the newer version. It uses Elasticsearch for the different dashboard entries. So, we were running on spinning disks, and Elasticsearch didn't work that well. A number of the different dashboards, like my dashboard or different things like that, pull from Elasticsearch. Since Elasticsearch really wasn't working, we were having some issues with that, but we just migrated. We just got a new fan, which is all-flash. Last week, the server was migrated from spinning disks to the new flash. Now, we have moved from hard drives to SSDs, and Elasticsearch is working a lot faster.

EventTracker's UI is okay. There are some issues that I have ran into. Some stuff doesn't display on different browsers, which you think would. You think you are missing something, and you actually are. If you use a different browser at work, it works differently. That is sort of frustrating. The big thing is they have a newer version or something out other than a new update to version 9. I don't know if they're on version 9.1 or 10 (or whatever). We weren't going to update until we could try to get the Elasticsearch capability (which we now have) and migrate over to the new SAN thing. 

There are a couple things that we had to tweak. One of the other things is we are getting DNS and DHCP logs from servers, which we thought required a different Microsoft hotfix, but it didn't. EventTracker's documentation wasn't current. So, it took a little while to get the DNS and DHCP logging figured out. Once we finally got it figured out, we got those set.

The searching capability has room for improvement. I know they are working on it. They have Microsoft SQL, then Elasticsearch, and it's hard to determine when I am searching what exactly it's searching through, as there is the Elasticsearch archive thing, RAID and the Microsoft SQL searching, and some like cache search things. So, there are about three different searches, and sometimes it takes a bit of trial and error to figure out what information I am actually getting.

Users need to be on SSDs in order for Elasticsearch to work well.

We have been using EventTracker for about five or six years now.

I use it on a desktop machine with a wide screen, like 20-inch monitor.

It's okay for what it does. They're trying to add more different capabilities. One thing that I will be interested in, when and if we upgrade to a new version, would be the different types of alerts offered. They do have some different type of prebuilt alerts. The big thing is it's hard to know what things EventTracker may not be alerting on. They do have the behavior correlation part, but when I looked at that, it was using Elasticsearch. Since our Elasticsearch wasn't working that well, this was sort of problematic as there are a bunch of different false positives and stuff.

We sort of knew there would be issues when we did the upgrade because of Elasticsearch and our spinning disks. The searching isn't as easy as it could be, as far as the three different search things that you can do. 

This is same with the different dashboards, as related to Elasticsearch. If we were to implement a brand new version and didn't have the hardware already, we would say, "Okay, we'll wait until we get the SSDs." But, we sort of earmarked a server. The hardware was on the old EventTracker. So, when we did the upgrade, we knew it was going to be an issue, but we didn't know how big of an issue it was going to be.

I know it's been working well for all the different log sources and stuff that we've been throwing at it. The big thing is we just have it on one big virtualized box. So, we haven't really had any instance or need to scale it beyond that.

I'm mainly the only user. My boss will occasionally use it when I'm out of the office, or something like that, but it's either going to be him or me.

We have it pretty much on all of our servers, firewalls, and routers. The big thing is we have a 500 license count. So, we have a number of different other switches and stuff which would be nice to be able to get logs and stuff from. At the same time, we are getting close to hitting up our 500 license count. Therefore, we're trying to figure out where we need to go as far as what systems are a must-have and what systems are a nice-to-have type of thing.

I find EventTracker support to be quite helpful. They have been quite responsive whenever I've had any issues. For the most part, they have been good to work with. There have been a couple times where there have been some issues that have taken a bit of time to try to get resolved and figured out. However, that is sort of par for the course for different products.

Before EventTracker, we did use another solution. I think it was a Symantec SIEM, but they discontinued it. So, we were looking for a different solution. 

The initial setup was several years ago, so I don't remember too much about it. The one thing that I do remember is there was like a database account that needed to be created, and there was some back and forth on that aspect. So, it took a little while to set up and get going.

Initially, we got it up and running, then we were going to deploy the agents on some noncritical servers to make sure that the EventTracker agent on the servers worked properly with collecting logs. 

In the security space, it's hard to quantify your return on investment. So, I don't. We spend about $40,000 a year and so. It's hard to say if the SIEM saved that much money.

When we first got the EventTracker product, we were using SIEM Simplified. At the time they didn't call it that, but it was more of a service thing. So, there was a bit more hand-holding and getting stuff set up, along with failure reports, that they did during the first one to two years. Then, we decided that the the additional money to have someone do these daily reports wasn't terribly useful, so we discontinued that service.

Licensing is interesting. By doing it by device, in some aspects, that can work to your advantage, and in some aspects, it can't. 

There are different licensing models. Back in the day, it used to be events per second and trying to figure out the number of events per second during the year that all of your devices are generating. If you didn't necessarily have a solution in place to begin with, this was a little frustrating. You might add another device and all of a sudden your events per second shoot up quite a bit. With a number of system-based licenses, it's been good. The big thing is is when you get up on that license account, do you continue to add additional licenses or start removing some systems that may be not as critical as others? Like, do we need to be getting logs from different Windows test servers out there? Ideally, yes. But it all depends on the pricing.

EventTracker's subscription-based model is interesting as far as yearly license type stuff. It's nice because you know what it's going to be next year. We haven't really looked at any other solutions. The pricing at the time compared to the other solutions was a lot less. A couple of years ago, we actually looked at Splunk. The amount in Splunk's licensing model is based on 20 gigs a day, or something like that. Based on our number of logs and stuff that we were already generating, the costs would be substantially more for the amount of logs that we would be getting.

We looked at a handful of different solutions out there. When we were looking at SIEM solutions out there, we were looking to replace Symantec. We were looking at Arctic Wolf, EiQ Networks, Secureworks, and Trustwave.

The primary reason we went with EventTracker and the SIEM Simplified service was the CIO wanted something that was a 24/7 monitoring type of thing. That's why we went with that service. But, when we found out at the time it really wasn't 24/7, and we wanted 24/7 monitoring from more of a SOC/NOC type of thing. The EventTracker support said, "We do have that." However, that wasn't necessarily the case. It was primarily an eight to five type of thing. Supposedly, in the last couple of years, they have changed it, and it is more of a SOC/NOC type of thing. 

This was one of the reasons: We were looking for a hybrid approach. Basically a SIEM that we could have on-premise where we could have someone else monitor when I was not in the office. EventTracker was able to create the different alerts and stuff like that. So, when I'm not in the office, I get alerts generated. However, we wanted some more active monitoring type stuff.

I would rate the product as a seven (out of 10). 

We don't use the dashboard widgets, but we are planning on it.

We were struggling at the event level, like a lot of people do, in terms of centralized event management and notifications. We just did not have a single pane of glass where we could see events, potential issues, all on a fine thread of a timeline to compare across our enterprise. We needed to know: Is there anything else going on at the same time?

We use it extensively. Every product that we have on our network is tied into it. That's been huge for us. The thought process was, "If we're going to put it in place, we want every end-point out there to be cycling through logs or have syslogs pulled into EventTracker. Otherwise, it just didn't make sense. We wanted to have eyes on every device out there.

It's come in tremendously handy. We've had small incidents crop up that we've been able to isolate immediately or dig further into because of this. Without that "full-glass" look at everything we've got going on in our environment at a particular time, we would be chasing our tail a little bit: "What's happening here? Do I need to go look here? Do I need to go look there?" The ability to pull those logs in from not only all of our desktops, all of our servers, all of our appliances, but from anything else that could be logging an event, has been tremendous for us.

It has limited the time that I've had to spend combing through any device and syslogs. For example, firewalls: I'd be looking through events to try to find out if anything looks abnormal. EventTracker not only does centralized tracking, but it does a fair amount of behavioral analysis as well. It tells us: "Hey, here are events we haven't seen before." It even calls to my attention processes that are new, including unsigned processes that we need to be aware of in our environment. We also utilize their Snort plugin on the front-end. It indicates traffic that's coming in that we might want to be aware of.

We tend to start blacklisting and block-listing a tremendous amount of external IPs based upon things that the solution sees on the outside. Those could just be events hitting our firewall, but unless I'm sitting there watching my firewall on a continuous basis, I'm probably going to miss a lot of them. EventTracker is collecting that and pulling it all into a quick and easy notification. On a daily basis, I get that report to rehash: "Did you see these things? Are these acceptable? Here's behavior that we haven't seen before from this particular user." It makes me aware of things so that I can validate. It gives me a good check and balance on what we have going on in the environment and what they're seeing through a collection of event logs.

Because we've been using it for so long in our environment, I've pushed my daily duties onto other things. I've moved into other areas since I don't have to constantly monitor this equipment or the logs or check back on things. It's probably cut down 50 percent of my workload, in terms of tracking and watching and trying to play a little bit of triage after the fact. It's giving me heads-up notifications immediately. Then, as we hash back through things, either on a daily or monthly basis, we're looking at what it's finding and what we are missing. Are there things that are still cropping up that haven't been taken care of that maybe slipped through the cracks? It's not only cut down a ton of my time but even our staff time which used to be spent watching and maintaining logs on various products.

The solution is on-prem and we also utilize them for fairly full, managed services. They do tend to babysit it quite a bit. We get daily reports that they piece together for us which walk through everything that they're finding and seeing. And we sit together in a monthly service call to walk through what they found over the course of the month, just to compare notes. We backtrack and check to make sure that nothing stood out and that we didn't miss anything or to hear if they've got any concerns or questions. They're putting in the time on a daily basis for us on that. 

Another valuable feature is that we've tied it into pretty much everything that we have. We've got it tied into our Office 365 and it's helping us monitor even the spam garbage there, the consistencies or the abnormalities on the spam. We've got it tied into our firewalls and into just about every appliance we have as a front-line or an in-between, including VPN and the authentication that is coming through there. It's also tied into anything that's cloud-based. We might tie into IIS logs, our antivirus logs. It's huge that it gives us that single dashboard overview of events happening, all at one time. It's been, tremendous for us.

I really appreciate the fact that the dashboard breaks everything down into a pretty easy view for me. I can pass it along, not only my boss, but to senior management, if needed. I can show them what activity is being monitored, what types of incidents there are and the type of risk, if there is one. It shows what changes are happening to privileged user accounts, access and identity, what's cropping up. It shows application activity and whether we've got system resources that aren't online and being found anymore. It's a pretty simple, easy, quick hit and there are the supporting logs behind it. If I need to drill down further, I can do that quickly. It's very effective.

I just want to know what's going on on the end-points. If anything gets flagged, if anything's out of order, chances are pretty good we're going to get it flagged on a couple of systems, whether it's a desktop for a firewall or an outbound request. It might get flagged on our AV, but at least I'm seeing it across all of those systems at a given time. So I really appreciate having that single location to look for any event that might be something which warrants a little bit more work.

I don't play around too much with the dashboard widgets, the stuff that's built-in. I get a daily report and, based on that, if I need to, I'll dig into it. So I don't customize things too much. I go back through things on a monthly basis as well. The dashboard is an easy enough layout and I've gotten used to using it or digging down deeper so I don't really change much in there.

In terms of log importing, I've never really had any problems with it. Everything that's a syslog is a pretty easy tie-in and pull-through. Anything else that's agent-based, like a desktop, we've had very few problems with. Microsoft's Direct Access, their direct-access, always-on VPN product was a little bit of a tough one that we had to work through to get those to pull across. But overall, the agents seem to be pretty stable, pretty efficient. They're pulling through everything that we need at this point. Anytime we've pulled in, whether it's an antivirus product - we've gone through a couple of them - various appliances, even Office 365, it has been very well-versed on all the major brands out there. If we want to pull those in or pull in the syslogs or pull in those events, we've never had an issue.

They haven't had to fixed much, but we have come back to them with requests for very specialized reporting. Something that's not canned. We might be looking at a particular functional area where we want to track specific data or specific login times. If I were to put in the time it be easy to do or it might take me a little while. But these guys can roll it back to me so quickly that I don't think twice about throwing them at them and asking for a report or a particular search. Probably the biggest thing is just: Can I search for this and what's the best way to do it? If I'm looking for two events versus a singular event, I just throw it back at them. They're the experts on it.

Right now I simply can't think of anything that we're lacking. I don't have much to throw back at them at this point. 

That could change as everybody's continuing to move towards a cloud product or with the cloud products themselves, all the services which we're slowly moving toward on the cloud. We're an Office 365 tenant right now, but I can see that over the next three to five years that's going to continue to increase. I'm excited to see how they can continue to structure their product to help us take advantage of the viewing, the monitoring, and the tracking of those products. Until we get to that point, I just don't know whether they've got everything we need, or if there will be things we will need to ask for that we simply didn't require in the past.

The stability has been very good. 

The only time we might have had downtime was based on our requirements where we were moving to new hardware. That doesn't happen much now because we're virtualized. But we tend to archive a lot of the data so we've moved that backend data store a couple of times. They'll either walk us through it, or they'll just take care of it if we don't have time for it.

In fact, later this afternoon we're doing exactly that. We're moving off of an older SAN to a newer SAN. We'll disconnect the old SAN, validate that all the data is flowing the way it should be in the searches and that the search capability against the archive database is still valid. Overall, it's really pretty simple.

We're small. I'm assuming that the scalability would be no problem given all the other feature sets. When we've brought things on board, we've never had an issue. I don't know how large this scales or of any limitations to it. The backend data might be just what you have available. I've never been too concerned with it because we don't scale up really large. We're pretty stable as far as the number of devices goes, internally for us. I don't see that really changing much.

Most of the devices or products that we've talked to folks out there about have syslogs of some sort that we can point back. That's what we plan to do. I don't even know where that's going to go at this point, but I know that as we move into the cloud space, but I want to continue to tie that into EventTracker. I want to make sure I've got eyes on everything that we're communicating with.

The support group is tremendous about asking me if there is anything else I want, is there anything more they can do and, and I'm left a little bit speechless. I've asked for various reports or can we have something else tracked individually. That's usually a pretty quick turnaround. Their support has been very good. We've got a great relationship. They do a great job of checking back to make sure there's nothing we're missing.

I'll email their main group. I have some individual contacts and I'll reach out to them occasionally, if I need to. Typically, I try and go through their main security operations center. I get the daily email from them, and that's who I would reply back to.

If I've got a request, for example, if we're shuffling around some backend databases, something we've got to move off of a backend SAN to a new SAN, I'll just reach out to them. "Hey, we're looking to do this." Response time from them is pretty quick. We have had emails back and forth within 15 to 20 minutes.

They're very easy to get ahold of. Their security center might be maybe in a different time zone, but I've never had a problem, here in the Central Standard Time zone. Anytime I've reached out to them, I've always gotten a response pretty quickly.

We did not have a previous SIEM. That was a very big push for us. We realized how little we had in the way of eyes on all of our products, unless we did a manual, individual triage. And even then, it was pretty limited. We knew we had a huge blind spot by not putting in a SIEM. It's been phenomenal for some of the small incidents that we've had crop up. It's been fantastic.

The setup was actually quite easy as are the upgrades and the patches that we go through. The initial setup was a pretty simple walkthrough on their part. We bundled that in as part of the product when we purchased it. The agreement was that they'd do the setup themselves but we wanted a walkthrough as well so that we had some knowledge here. We didn't want them to just set it up and do a hand-over-the-keys deal. So we stepped through it together, which really means I did a lot of watching as they were doing a lot of the setup. 

We walked through it through a WebEx. I had the server side set up on our side. At that point it was just a matter of them leading: "We're going to go here. Where's your data storage? Tie that in, install." 

Out-of-the-box it was pretty straightforward and easy to use. We started pulling in all the clients as we pushed out the agents to the desktops; that was pretty easy. It was non-intrusive to our users, which is a big deal. We didn't want it to intrude on anybody. In fact, when we push out agent updates to desktops - it doesn't happen that often, maybe once or twice a year - those agent updates are seamless. Nobody's aware that that has even taken place. 

If you want to do it, they'll certainly help you through it. If you want them to do it, they'll allow you to just watch what their process is in case you want to do it the next time.

Our company has about 225 end-users. We obviously have more devices than that, but not more than about double that. In terms of deployment, it was just me involved from our side. 

We had things up and running within half a day, when we started doing a little bit of discovery and collecting. After a couple of days of letting it run through the system and doing discovery we found, "Those are the pieces that we've missed. Yeah, we're going to add this or that in." Now, we tend to roll through one-third or one-fourth of our desktops on an annual basis. We'll do the discovery - the agent installs pull those in. It requires very limited staff time on our part. Our helpdesk now installs the agent as they roll out a desktop, which is pretty easy. We pull it in, I validate. There's not a lot to it.

It has its value, especially when I can say that it's taken over what I was spending about 50 percent of my time on. Not only has it eliminated the need for me to spend time there, but I can put that time to use elsewhere. It's absolutely well worth it.

I'm not really the money guy or the budget guy, so I couldn't tell you from a dollars and cents standpoint, but return on investment just for my time alone over the last five years has been tremendous. I no longer spend that daily time - I don't want to say "wasted time" - but it used to take me a tremendous amount of time to sit there and try and play catch up on logs, looking for events and trying to track things on my own. That's been massive. That's been tremendous, not only for me but for the company. It's been well worth the money so I can put my time somewhere else.

I don't know if the pricing is by the seat but we're paying about $20,000 to 25,000 a year. On top of that, we pay for the managed support services. That runs us about another $35,000 or $40,000 a year.

At the time, EventTracker was one of the few that did a bit of that behavioral analysis. There was another one, the name escapes me right now. But it was the only other product that I felt was in the same quadrant, as far as feature sets and the behavioral analysis go. We did not evaluate very many.

They are a fantastic team. I would stack them up against anybody. If anybody asks us what we're using for a SIEM, I'd say that this is what we're using. I highly recommend them.

Stack it up against some of the other products out there. At the very least, know what you're looking for. Or, if you don't, throw it back at EventTracker and say, "We're looking to do this, can your product do it?" Let them know what you're looking to gain from this.

We started out in the same boat: "Well, why would we use you guys versus somebody else?" We had a defined requirement, that we wanted to have centralized event and incident management, and that's exactly what we got.

You need to find out if it's going to match all of the various appliances and the OS you have. Is it going to be able to pull in the syslogs? What type of products do you have in your environment? Are you pulling in Cisco devices? Whatever your firewalls are, make sure that they're matching up. I had no doubt in my mind that they were going to match up to everything in our environment, right upfront, as we gave them the list and we did that self-discovery. I think that's part of it was the workbook process. What are your devices? How many are there? What are you using for mail? What are you using for backend storage? What do you have for databases? What are the products on your network? Make sure it matches up.

I have no doubt that they'll match up well with everything out there but make sure that whatever is on your network that you want to monitor, that those specific vendors and those devices match what they can track and log events against.

Every month, when we do an assessment they ask what more they can do. Until something crops up that leaves us a little bit blind or unsure, I really don't know what they're not giving us at this point. We haven't started looking at any other products to fill any gap. I don't have a laundry list of anything I'm waiting for them to come back with, whether it's a fix or a feature.

I'll do a lot of event searches myself, more out of curiosity than anything. I might chase something down if we get a flag or notification and look for what else is taking place around that event, to get a clear picture of why it was flagged. Was this something that we brought into the environment? Were we installing something at the same time that something was flagged? What was going on? So I tend to go into the event searches a lot and the managed devices, looking for non-reportings. Those are probably my two biggest hits.

When it went from version 8 to 9, the UI changed up a little bit, so it took a little bit of getting used to. They did provide not only some on-call support to walk through things as I was asking them questions: "Nope, that's here," or, "Give this a try." They also had some pretty easy tutorials to walk through. I've done that a couple of times just to refresh myself as far as where things are. But, like I said, because we tend to lean on them for a lot of the managed side, I don't dig into it as much as I used to when we first got started with it. It's been huge just to have them a phone call away or at arm's length to say, "Can you guys take a look at this, or do this, or verify this for me?"

Typically it's just on my desktop at work. If I'm taking a look at the dashboard, I might pull up user devices - what's not reporting in. That's a biggie for us, especially as we roll out new devices and we're getting agents out on those devices. I want to make sure that they're being pulled in correctly and that I'm seeing logs. I may take a look through some of the threats, but again, their support does such a great job of combing through all the threats and kicking out any notifications to me that I don't spend a lot of time in there.

In terms of integrating it, we haven't tied EventTracker back into anybody else. At this stage, we're tying everybody into EventTracker. As we start to move into more of the cloud space, there may be some of those cloud-authority services that this may tie into. We haven't gotten to that point yet.

The biggest lesson I've learned from using it is that I think we'd take a huge step backward if we ended up losing EventTracker; whether it's EventTracker or a SIEM product of that caliber. We're part of critical infrastructure and the threats against that infrastructure have increased a tremendous amount over the last five to seven years, whether it's on the network side or the OT side.

Having the eyes and ears to be able to manage and monitor those types of events against us, in our industry, is massive. Being under a constant threat, like everybody else out there, we want to know what we have, what's in our system; we want to know where the abnormalities are. We want to see the events on a daily basis. You have to track them. You have to be proactive. You have to take some action on those things on a daily basis. Having this in place gives us the ability to see what's going on, on a daily basis, on all of our systems across the enterprise. That's massive to me.

I would absolutely rate EventTracker a ten out of ten. I love it.

We use it for security incident and event management, and we use Netsurion's hosted SOC service, meaning their SOC team also assesses our events.

The solution is on-premises. We have the agent running on our Windows systems, and we have the Linux systems pumping the syslog data to the Netsurion server.

The 24/7 monitoring and alerting have positively affected our security maturity because now we have people with eyes on our security events 24/7. They are monitoring our security incidents and alerting us to any incidents that need action on our end. Overall, the SOC component of the Netsurion solution is very important because without it we would need to hire more people internally to do that work. With the hosted SOC, we don't need to have a large team on our side. While their SOC doesn't know our company and what is unique about our environment entirely at this time, they are learning it now.

All the features are valuable, so far. Some examples are the detailed responses that you find within the searches. The alerts are also valuable because they're concise and not overwhelming. The dashboard layout is also a feature I like, because it's very clear. It's not cumbersome.

When it comes to threat detection and response, Netsurion is very good. They're good at incident detection and responses. For example, they found some tools that are used by hackers, tools that were running on a system, and they immediately alerted us to that fact. We investigated it and it turned out it was an administrator using that tool. But it was a good process.

Managed Threat Protection also provides actionable threat intelligence. For example, when there was a vulnerability in the Exchange platform, they alerted us that this new threat had become known, and we were able to take action by patching our Exchange servers to secure them.

We have also integrated our endpoint security into the Netsurion SIEM. That's important because we have all the events in one place; we don't have to manage them in multiple places.

In addition, the embedded MITRE ATT&CK Framework was paramount in our decision to choose Managed Threat Protection because the MITRE Framework is the industry standard for threats. While it hasn't yet helped to identify threats we might have missed without it, we're still early on in our deployment, but eventually, once we are more mature, it will. And I believe it has helped with the time it takes Netsurion's SOC to identify and understand sophisticated threats.

The weekly reporting could use some improvement. For example, when we handed them our landscape document, it took longer than I would have liked for those details to become noticeable within the reports.

I have been using Netsurion Managed Threat Protection for about 10 months.

It is very stable.

Scaling it would be slightly complex because you would need to consciously keep track of the ports where the logs are being ingested. Scalability is not as straightforward as it could have been.

We are using it to monitor about 2,500 endpoints and we have two analysts within our organization's security department who work with the solution.

Some of the technical forethought for the deployment was not as good as I would have expected. Some of the technical blocks that can exist in an organization of our size, issues that needed to be thought about, were not taken into account at their end. That required more input on our side, so that is why I would rate their support at eight out of 10 overall. But regarding the product itself, their technical skills are a 10. It was more when it came to the difficulties in a more complex environment that they were slightly lacking.

Positive

We did not have a previous solution.

The initial setup was straightforward. They provided us concise instructions on how to deploy the agents. They provided us packages that we could then deploy within our package deployment mechanisms, and they supplied us with the necessary tools to be able to deploy the agents quickly and easily.

Netsurion's support during our deployment process was very good. They were very helpful and attentive to us as customers. Their assistance in the onboarding process certainly helped with the product's time-to-value because we were able to deploy the agents in a short period of time and to start getting actionable intelligence pretty quickly.

Within a couple of weeks of their providing us the packages, we started deploying agents and, within a couple of months, we already had enough logs being ingested to have at least some initial, actionable intelligence.

The implementation strategy was, first of all, to have enough collectors around our network to ingest the logs from the sources, and enough log source ports to be able to handle the quantity of log sources coming in. After that came the preparation of the agents and the mechanism through which the agents were to be deployed. This strategy helped to make the deployment faster and easier.

It was handled internally by our IT operations.

We have seen ROI in the fact that we had actionable intelligence within six months of deployment.

The amount we pay for the service that we get is good. If it were to be much more expensive, it would not have the same value for the money.

We evaluated McAfee Managed Detection and Response, Splunk, and Rapid7 against Netsurion Managed Threat Protection. The biggest difference was the cost.

If you're concerned about Netsurion's SOC being located outside of the US, I would say that location of the SOC is irrelevant. Rather, you should evaluate the skills of the SOC and the SOC management.

And if someone at another company said they are not sure that they need managed services, I would say to them that they had better make sure they have enough money to have their own internal team.

My other advice would be to make sure that Netsurion gives you a good deal compared to the other vendors.

We use Netsurion to meet our HIPAA and PCI compliance requirements and to implement best security practices. Before we implemented Netsurion, our company had no visibility into the environment. We use it to alert us about unusual processes that may be executed. After an investigation, we whitelist or blacklist those processes. It also helps us manage our asset inventory and respond to threats as they arrive. 

Netsurion's 24/7 monitoring has enhanced the overall security of the company. They have someone looking at the data 24/7 who will call us as needed. If their team spots a malicious process after hours, they notify the appropriate person by phone. We get a lot of actionable threat intelligence from Netsurion. For example, if a user clicks on a malicious link in a web page and starts an unusual process that isn't on the white-list, Netsurion's team can detect it and prevent it from executing. Afterward, they'll notify us by telephone, so we can respond and clean up whatever damage has occurred.

With Netsurion, we've also consolidated a lot of our cybersecurity technology. Case in point, Netsurion can aggregate the log files from a Meraki wireless access point, which correlates that data, so that minimizes the time necessary to investigate. They have already taken care of the heavy work. With Netsurion, I take their data, and I know where to start.

Any security professional will agree that if you don't have a solid understanding of your inventory of assets, it's going to haunt you. In this case, it provided me the opportunity to see what's out there. This is especially crucial given that we have some BYOD devices that are not allowed onto the network. I was able to spot those devices and enable conditional access through our Azure Active Directory.

It has reduced the amount of time it takes to identify and respond to constantly evolving threats. We don't know everything. So we could have something that we've never seen before and it requires research on my part, which can be very time-consuming. I like to have the reference readily available.

The managed security solution has freed up IT staff time to work on other things. Our IT team is tiny. I am the only security person in a company with more than 5,000 employees. I don't have to focus on security 24/7, which frees up a lot of time and lets me have a work-life balance. It's equivalent to saving us the cost of three full-time employees at 40 hours a week. The SOC is an essential component. It's crucial to have those individuals correlating and reporting on alerts or taking care of events that don't need to be reported. That's a lot of manual work.

I'm new to the company and the environment, so it's valuable for me to see what is deployed and what processes are being executed in the environment to ensure that nobody is running something that may have malware or infections. Netsurion's log aggregation feature is something I use heavily. They use Elastic as their SIM tool. I'm able to take the numbers that they provide and correlate events.

Netsurion also integrates the MITRE ATT&CK framework. Every alert includes a reference to the MITRE number that you can research yourself. I have experience with the MITRE framework, so this is valuable to me. The company did not previously have an understanding of MITRE, so it's essential to me as the security person responsible. This framework has definitely helped us identify threats that we might have missed otherwise. With the MITRE ATT&CK number, I can research in the right direction.

Netsurion's threat detection and response aren't quite mature. I would expect a little more. Instead of an Excel spreadsheet with a log output, I would rather have a web portal that I could log into and see the event live. In all fairness, they may have that, but they have not provided that to us. They send me an Excel spreadsheet, and I have to aggregate the data manually to find out what I want to look at. It would be better to have a web portal where the data is already aggregated, and I can see where the hotspots are. They could do something like Arctic Wolf, which has a web portal or page we can log into.

I have been using Netsurion since approximately June of 2020.

Stability has been okay. We've only had one instance where specific endpoints were not reporting in. During the discovery, we found that devices were pointed to the wrong collector on the Netsurion side, and they fixed that.

With Netsurion, we're covering more than 5,000 endpoints without any real difficulties, and I think we could grow even further with that, so I don't have any concerns with scalability. However, I don't know how far they can go.

I would give Netsurion support a nine out of 10. Their technical support has been outstanding. There have been some challenges on the administrative side getting the phone tree updated. That's an area where they need a little bit of work. But I have no complaints on the technical support side. They've been accommodating. Their SOC is also excellent. They're working on a mature model, and I think they're going to raise the bar. We also have five other managed service providers that the SOC needs to work with across different time zones. Everybody just needed to get on the same page and align the timing. After that, it went fine.

Positive

I joined the company while they were in the middle of deploying Netsurion, and I actually led the last phase of implementation, which was getting the agents installed through the endpoint. In my opinion, it was pretty straightforward, and the deployment took about 90 days. The only issue was getting their agent to work on some of the Apple products. The developers had to go back and tweak the agent to get it running on these systems. Netsurion's SOC helped walk us through the onboarding process. Without their support, we would've probably been extremely frustrated and unhappy. 

I would rate Netsurion eight out of 10. While there is room for improvement and maturity, I have no complaints about their services. To anyone thinking about adopting Netsurion, I would advise them to research and get references. You should also do a cost-benefit analysis of a managed solution. Doing this work in-house is extremely expensive compared to offshoring it to someone already established who can do the work you need. 

If someone is concerned about Netsurion's SOC being outside the United States, I would say that this hasn't been a problem for us, given the compliance spectrum we're working with. Some companies may have another view of that, but I work with that team and trust them. They meet all my expectations. I'm pretty satisfied with their service and how it was managed during implementation.