- FBI warns Hit Man e-mail scammer back
- 20 tech habits to improve your life
- Industry mourns slain Cisco exec
- 10 Firefox add-ons for better browsing
- Wireless LANs face scaling challenges
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:App Performance | On Demand Security | Networking Solution | SOA | Value of WDS
Introduction|Are SIEM and log management the same thing?|Scorecard|How we did it|Slideshow|Test archive
Editor's note: This is a summary of our testing of this product, for a full rundown of how it fared in our testing across SIEM categories; please see our full coverage.
The strength of High Tower's Cinxi SIEM lies in its simplicity. It isn't as feature-rich as other products on the market, but much of what it does do, it does fairly well.
The product is delivered as an appliance that is Intel-based, includes a crypto accelerator in hardware (for high-volume event signing) and runs Linux under the hood. The user interface is Java-based and requires also running client applet that is delivered via a standard Web browser. Cinxi's user interface was by far the easiest to use, which we attribute to good design and a simple layout.
High Tower's product is also the simplest to deploy because of its auto identification of devices, which it calls "candidates". Cinxi was up and collecting data in literally minutes, and when we brought new systems online in our environment it was a snap to get them properly identified.
Cinxi comes with a set of about 70 predefined correlation rules that help with event reduction. We found them to be pretty useful, but overall not as effective as the rules in Q1 Labs' QRadar product, and a number of them we eventually decided to disable outright because of false-positive problems. The rule language is also not as advanced or as granular as other products tested. For example, you can create rules such as "if an event in category X occurs and an event in category Y occurs within a six-minute period, generate an alert" but you couldn't do anything as sexy as "if you see a successful login from Madagascar send an e-mail to network administrator Z."
Cinxi also includes an event handling ticketing system that allows you to easily create and assign cases to individuals. The "add to case" right-click option on any alert was a nice touch. Again, Cinxi shined when it came to easy-to-use tools and drill-down options.
Cinxi's biggest shortcomings are related to its reporting and adhoc querying mechanisms. On the reporting front Cinxi has a minimal set of pre-canned reports and the delivery format is limited to CSV files and occasional PDF support. High Tower recommended that we install the Crystal Reports Viewer to make these reports a little more digestible, and while that did help in their overall presentation, the reporting mechanism remains limited in functionality. The adhoc query mechanism was far worse. Like NetIQ's Security Manager, Cinxi doesn't distinguish between adhoc queries such as "Show me everywhere userX has logged in from" and a run-of-the-mill reports. You have to fill out a form and submit everything as a report request – the concept of a quick lookup needed by most in-depth investigative efforts is non-existent. Complicating matters, when we did submit some adhoc queries searching for specific usernames and IP addresses our reports often took minutes – sometimes 10 or more – to return. Response times like these are not going to be acceptable for organizations that plan on doing a heavy load of investigations.

Aging network systems and old habits have dictated how businesses spend their IT budgets. As a...
Implementing HA at the Enterprise Data Center Edge to Connect to a Large Number of Branch OfficesThis paper reviews the problem of creating a network where the dynamic availability of services is...
Enterprise Data Center Network Reference ArchitectureUsing a High Performance Network Backbone to Meet the Requirements of the Modern Enterprise Data...

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...
Harnessing the power of communications to increase workplace performanceDue to the convergence of IT and telecommunications technologies, the business workplace has been...
Stay out of the headlines: Detecting and preventing network intrusionsHow do YOU stay out of the headlines? There is no denying that risk exists in our computer-driven...

We have so many holes punched in our firewalls today that many industry insiders question the value...
IP address management in 2008 - six things to knowRead this Network World Special Brief to learn how Enterprise IT managers must update their...
The self-managed networkWe aren't there yet, but advances in network and systems management tools are making it possible to...
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask to prospective vendors to get the right endpoint solution.
Download the white paper.
Unauthorized applications: Taking back control
Employees installing and using unauthorized applications like IM, VoIP, games and peer-to-peer file-sharing applications cause many businesses serious concern. How do you control these applications?
Download the white paper.
Comment