- 10 open source companies to watch
- Mythbuster busts his own tale
- $208 million petascale computer gets green light
- Sony recalls 73,000 Vaio laptops
- Chrome and Firefox and add-ons
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:App Performance | On Demand Security | Networking Solution | SOA | Value of WDS
Introduction|Are SIEM and log management the same thing?|Scorecard|How we did it|Slideshow|Test archive
Editor's note: This is a summary of our testing of this product, for a full rundown of how it fared in our testing across SIEM categories; please see our full coverage.
TriGeo's SIM platform is a collection of technologies that have historically been targeted less at the enterprise and more at small-to-midsized businesses (SMB) and the company contends it wants to keep its focus on the lower end. However, some recent additions have brought significantly more functionality to the product, making it comparable to many of the classic enterprise SIEM products we tested.
TriGeo shipped us a set of three appliances: the main SIM platform and two supporting systems that contain its InSight and InDepth add-on offerings which offer business intelligence and data parsing ties, respectively. The main TriGeo platform is an Intel-based Windows system and the supporting appliances were also both Intel-based but running Linux under the hood. The user interface is a Java applet that can be installed on a desktop system. However, for our testing we opted to simply use it from the TriGeo Windows appliance provided.
At first glance the TriGeo SIM appears to be a very basic SIEM platform: it can receive events from multiple sources; it contains a basic correlation engine; and, it presents alert and raw event views in near real-time. The correlation engine wasn't as full-featured as the Q1 Labs product and the supported device list isn't as comprehensive as other platforms tested, but the basics are in there.
Where things got a little more interesting was when we started using the InSight and InDepth add-ons. The InSight appliance takes the data received from the TriGeo SIM and provides an overlay of Business Intelligence display tools. This allows for some easier viewing and trend spotting on fixed data sets, for example, those found in a pre-selection time range. This approach is somewhat useful when we wanted to take a cursory look at trends in a single day's worth of events, but didn't find it as useful for greater time spans. Ultimately our conclusion was that while the InSight tool looked really good, we used it fairly infrequently.
In contrast, the InDepth appliance was invaluable. InDepth is essentially a bundled version of the Splunk log parsing tool that provides one of the best adhoc search capabilities on the market. The Splunk technology is like Google for log files; it makes the rapid searching for basic strings a reality. InDepth doesn't provide the functionality necessary for full-featured event monitoring, but the combination of the TriGeo SIM and InDepth makes it pretty competitive in most use cases.

Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses...
Vulnerability Management For DummiesDownload this concise book "Vulnerability Management for Dummies," to learn about the simple steps...
The ROI and TCO Benefits of Data Deduplication for Data Protection in the EnterpriseThis paper examines and quantifies the costs and benefits of backup with deduplication storage as...

Life on the edge of your WAN has changed dramatically. With the need to deliver advanced services,...
PoE Plus: Impact on the PoE MarketThe standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...
Harnessing the power of communications to increase workplace performanceDue to the convergence of IT and telecommunications technologies, the business workplace has been...

We have so many holes punched in our firewalls today that many industry insiders question the value...
The self-managed networkWe aren't there yet, but advances in network and systems management tools are making it possible to...
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comment