TriGeo's SIM is upgraded with higher-end features

Editor's note: This is a summary of our testing of this product, for a full rundown of how it fared in our testing across SIEM categories; please see our full coverage.

TriGeo's SIM platform is a collection of technologies that have historically been targeted less at the enterprise and more at small-to-midsized businesses (SMB) and the company contends it wants to keep its focus on the lower end. However, some recent additions have brought significantly more functionality to the product, making it comparable to many of the classic enterprise SIEM products we tested.

TriGeo shipped us a set of three appliances: the main SIM platform and two supporting systems that contain its InSight and InDepth add-on offerings which offer business intelligence and data parsing ties, respectively. The main TriGeo platform is an Intel-based Windows system and the supporting appliances were also both Intel-based but running Linux under the hood. The user interface is a Java applet that can be installed on a desktop system. However, for our testing we opted to simply use it from the TriGeo Windows appliance provided.

At first glance the TriGeo SIM appears to be a very basic SIEM platform: it can receive events from multiple sources; it contains a basic correlation engine; and, it presents alert and raw event views in near real-time. The correlation engine wasn't as full-featured as the Q1 Labs product and the supported device list isn't as comprehensive as other platforms tested, but the basics are in there.

Where things got a little more interesting was when we started using the InSight and InDepth add-ons. The InSight appliance takes the data received from the TriGeo SIM and provides an overlay of Business Intelligence display tools. This allows for some easier viewing and trend spotting on fixed data sets, for example, those found in a pre-selection time range. This approach is somewhat useful when we wanted to take a cursory look at trends in a single day's worth of events, but didn't find it as useful for greater time spans. Ultimately our conclusion was that while the InSight tool looked really good, we used it fairly infrequently.

In contrast, the InDepth appliance was invaluable. InDepth is essentially a bundled version of the Splunk log parsing tool that provides one of the best adhoc search capabilities on the market. The Splunk technology is like Google for log files; it makes the rapid searching for basic strings a reality. InDepth doesn't provide the functionality necessary for full-featured event monitoring, but the combination of the TriGeo SIM and InDepth makes it pretty competitive in most use cases.

There are also a couple of unique features in the TriGeo SIM that are worth noting for smaller organizations. One is the inclusion of the open-source version of the Snort network IDS that can be run from the main appliance. Organizations can certainly deploy their own versions of Snort, but this bundle is convenient. The other unique feature is the Windows Agent that includes the "USB Defender": a mechanism that can monitor, detect and block USB-related activities. Just as there are plenty of stand-alone network IDS/IPS products on the market there are also plenty of host-based USB preventative tools, but for small businesses on a tight budget bundled offerings have their place. Inversely, we don't see enterprise customers being too interested in these additional options.

The product does struggle in a few areas, however. For starters, without the addition of InSight and InDepth, the reporting and adhoc query mechanisms are almost non-existent. This might not be an issue for a lot of small businesses, but we wouldn't recommend larger companies consider the product without the InDepth addition. It also struggled a bit with device support as it had problems with parsing our open source software events and we initially had problems with it parsing events from our Snort appliance, too.

The stock user interface is also fairly basic in its sorting and presentation capabilities. For example, we couldn't easily re-sort an event set based on specific columns – a feature that existed in every other product we tested.

TriGeo has been successful in the SMB space because it provides a sound foundation for event monitoring and a functional SIEM tool at an affordable price. However, with entry-level units now shipping from Q1 Labs and High Tower, we can envision TriGeo seeing some increased competition in the SMB space. Likewise, with the inclusion of InSight and InDepth, TriGeo's products are starting to contain features that were normally limited to the enterprise SIEM space. An eventual collision is probably inevitable.

< Return to main test: SIEM tools come up short >

Learn more about this topic

 
Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.

Copyright © 2008 IDG Communications, Inc.

IT Salary Survey 2021: The results are in