e-Security

When it comes to security information management or security event management products, e-Security scored well in our tests. Its extensibility makes it stand out, but the product is not very easy to use.

The installation team came in to configure the device for our lab environment and set everything up so alerts and events were being sent to their system from three initial devices in our test bed – a NetScreen firewall, a Cisco VPN Concentrator and a Cisco Catalyst switch – which all logged directly to syslog. E-Security took the longest, eight hours, but there’s a correlation between the sophistication of the product and the time it takes to install. 

In other words, the e-Security interface is complex and comprehensive, but not very intuitive or easy to use.

Several of the products also include case management functionality to track and record incidents as they are investigated. Events can be tagged and added to incidents just about anywhere in the GUI. E-Security stands out in this area for ease of use.

At the most basic level, SEM products aggregate security logs from various devices. Taking SEM to the next level, these products add correlation, which lets you create alerts for any combination of log entries. For example, you can create an alert if you see a port scan and an attempted attack (seen through IDS logs) for your Web server if the source IP address is the same. The next step, which e-Security is beginning to support, provides correlation between vulnerability assessment and IDS. You do not get an alert on an IDS log unless the targeted system is vulnerable to the attempted attack. This feature is beneficial because it can help reduce IDS false positives.

SEM products include a number of canned reports and the ability to create customized reports. These reports also can be scheduled to run daily, weekly, monthly, and e-mailed to you. Reports vary from high-level executive summary to detailed packet analysis. E-Security set up a separate system to serve as its Crystal Reports server, while all other products kept reporting functionality on the manager/console server for our review.

For the full report, go to https://www.nwfusion.com/reviews/2003/1215semrev.html