TriGeo's SIM is upgraded with higher-end features

Editor's note: This is a summary of our testing of this product, for a full rundown of how it fared in our testing across SIEM categories; please see our full coverage.

TriGeo's SIM platform is a collection of technologies that have historically been targeted less at the enterprise and more at small-to-midsized businesses (SMB) and the company contends it wants to keep its focus on the lower end. However, some recent additions have brought significantly more functionality to the product, making it comparable to many of the classic enterprise SIEM products we tested.

TriGeo shipped us a set of three appliances: the main SIM platform and two supporting systems that contain its InSight and InDepth add-on offerings which offer business intelligence and data parsing ties, respectively. The main TriGeo platform is an Intel-based Windows system and the supporting appliances were also both Intel-based but running Linux under the hood. The user interface is a Java applet that can be installed on a desktop system. However, for our testing we opted to simply use it from the TriGeo Windows appliance provided.

At first glance the TriGeo SIM appears to be a very basic SIEM platform: it can receive events from multiple sources; it contains a basic correlation engine; and, it presents alert and raw event views in near real-time. The correlation engine wasn't as full-featured as the Q1 Labs product and the supported device list isn't as comprehensive as other platforms tested, but the basics are in there.

Where things got a little more interesting was when we started using the InSight and InDepth add-ons. The InSight appliance takes the data received from the TriGeo SIM and provides an overlay of Business Intelligence display tools. This allows for some easier viewing and trend spotting on fixed data sets, for example, those found in a pre-selection time range. This approach is somewhat useful when we wanted to take a cursory look at trends in a single day's worth of events, but didn't find it as useful for greater time spans. Ultimately our conclusion was that while the InSight tool looked really good, we used it fairly infrequently.

In contrast, the InDepth appliance was invaluable. InDepth is essentially a bundled version of the Splunk log parsing tool that provides one of the best adhoc search capabilities on the market. The Splunk technology is like Google for log files; it makes the rapid searching for basic strings a reality. InDepth doesn't provide the functionality necessary for full-featured event monitoring, but the combination of the TriGeo SIM and InDepth makes it pretty competitive in most use cases.

There are also a couple of unique features in the TriGeo SIM that are worth noting for smaller organizations. One is the inclusion of the open-source version of the Snort network IDS that can be run from the main appliance. Organizations can certainly deploy their own versions of Snort, but this bundle is convenient. The other unique feature is the Windows Agent that includes the "USB Defender": a mechanism that can monitor, detect and block USB-related activities. Just as there are plenty of stand-alone network IDS/IPS products on the market there are also plenty of host-based USB preventative tools, but for small businesses on a tight budget bundled offerings have their place. Inversely, we don't see enterprise customers being too interested in these additional options.