ArcSight's flexibility and interface helps it lead the pack of security data organizers

Firewalls, intrusion detection, vulnerability assessment tools - oh my! These are just a few of the devices that generate megabytes (and sometimes gigabytes) of daily logs of interest to security professionals. And that's before you count the piles of log data generated by anti-virus applications, operating systems, Web servers, file integrity programs and routers/switches .

The data is overwhelming at best, and analyzing it accurately without assistance is impossible.

Enter security information management (SIM), security event management (SEM) and/or enterprise security management . Whatever your naming preference, the goal is the same: to make sense of the data your security infrastructure provides.

The term SEM seems to best describe the task these products perform. Devices generate alerts or logs on security events, such as blocked packets, failed logons or attempted exploits. Managing these events is the next step in the evolution of the corporate security infrastructure.

ArcSight, e-Security, netForensics, Network Intelligence and Tenable Network Security agreed to participate in this review, while Consul, GuardedNet, Intellitactics, NetIQ, Open Service and Tivoli declined.

ArcSight 2.5 wins our Blue Ribbon Award based on its ease of use, flexibility and administration interface. E-Security v4 was not far behind. Its extensibility makes it stand out, but the product is not very easy to use.

Network Intelligence's HA Series comes in a close third. It is the only product sold as an appliance, and it is easy to set up and use. NetForensics 3.1 has a lot of potential, but the user interface, SIM Desktop, could be improved.

Tenable's Lightning 2.0 only focuses on vulnerability assessment and intrusion-detection system (IDS ) logs. This product is an excellent investment for small organizations getting started in SEM. It is less expensive than the other, more complex products and much easier to set up.

Implementing SEM

SEM implementations require careful planning and analysis, even before you decide which product to purchase. You need to fully understand what systems you want logged, how you want those logs gathered and how many logs each system generates on average and during peak times, such as worm outbreaks.

A further consideration new to most corporate security departments is data management. Enterprise SEM products use beefy database backends - usually Oracle or Sybase. Most corporate security teams do not have a database administrator on staff, so they try to work with the corporate database team or look at hiring some help. Hand in hand with database management and maintenance is data retention policy. Data retention policies can have a large effect on your SEM implementation because they mandate some of your hardware requirements.

The products we tested all handle SEM differently. One major difference is how they are sold. Network Intelligence is the only product sold as an appliance with hardware and software included. All other products are software only, so factor in the cost of hardware purchases in your budget. If you need to purchase anywhere near the same systems provided for our testing (see How we did it ), your hardware budget will be significant.

It all depends on the number of systems you plan to monitor, the number of daily events you expect to process and how long you need to retain the data on your system for analysis. Systems that vendors provided for this review typically included a multi-CPU system with 2G to 4G bytes of RAM.