April 01, 2013
$48,400, including license and first-year maintenance.
- Ease of Use:
- Value for Money:
- Overall Rating:
- Strengths: Highly intelligent SIEM analysis capabilities.
- Weaknesses: High cost for a software only product.
- Verdict: Strong product, but quite pricey for software only.
Sentinel from NetIQ offers a lot of robust SIEM features and functions. This product features log collection, aggregation, correlation and analysis and reporting - all from one single point that is easy to use and manage. Administrators and security personnel can use this tool to gain a great amount of insight into security events, as well as prevent threats that may be unseen without the use of Sentinel's powerful log correlation engine.
We found this solution to be of average difficulty to set up and deploy. The product comes as a software package that can be installed on either a Microsoft Windows or Enterprise Linux server. NetIQ recommends the Linux deployment, so that is the one we had for evaluation. Overall, we found the installation to go pretty smoothly. It required minimal Linux experience. After installation was complete, we were able to manage the entire product from a web-based management interface. Included in this interface is the Sentinel Control Center, which provides a centralized interface to manage data and analysis of events.
Once we became comfortable navigating around the various dashboards and menus of the appliance interface, we found this product to include a wide variety of reporting and analysis capabilities. This tool includes a fair amount of automation and remediation capabilities as well. Once configured, Sentinel will be able to detect anomalies in the network and event baseline and provide remediation and threat information automatically. Aside from threat monitoring and event management, this product also integrates with identity management platforms to help create a more specific picture of an event by tying in user information and logging. Sentinel also can correlate information from intrusion prevention systems (IPS)/intrusion detection system (IDS) sensors against known vulnerabilities to help identify possible threats before they become a problem.
Documentation included many PDF guides and manuals, including installation and administration guides. Other materials included a quick-start and a user guide. We found all to be nicely organized and to include many step-by-step instructions, along with screen shots. We also found overlap in the manuals, which made finding information on specific configurations easy.
NetIQ offers both 12/5 and 24/7 product support levels to customers as part of an agreement. This includes phone- and email-based technical aid along with access to product and software updates and upgrades. Customers also can access an area on the website at no cost. This includes a knowledge base and other resources. Furthermore, users also can access a full user forum that features many custom-built connectors and helpful information from product users.
At a price of about $48,400 for the software and one year of support, this product is quite costly for a software-only product. We find NetIQ Sentinel to be a slightly above average value for the money. While this tool does carry a monstrous price tag, it also includes a great amount of intelligent features and functions that give it solid SIEM capability, which helps make it worth the overall cost.
Sign up to our newsletters
SC Magazine Articles
- Popular adult website XTube compromised, delivers malware
- Android vulnerability leaves apps open to malicious overwriting
- One in three of the top million websites are 'risky,' researchers find
- Orgs predict $53M risk, on average, from crypto key, digital cert attacks
- Hanjuan Exploit Kit leveraged in malvertising campaign
- Report: 71 percent of orgs were successfully attacked in 2014
- Self-deleting malware targets home routers to gather information
- 'PoSeidon' point-of-sale malware targets payment card information
- Amedisys notifies nearly 7,000 individuals of potential breach
- Report: More than 15,000 vulnerabilities in nearly 4,000 applications reported in 2014
- British Airways says rewards accounts hacked, locked down
- Documents on NSA's zero-day policy provide little insight, EFF says
- GitHub on DDoS alert, efforts to curb its largest attack continue
- Shadow data: The monster that isn't just under your bed
- Puush urges users to change passwords after cyber attack