ABOUT DR STEPHENSON
Dr. Peter Stephenson is SC Magazine's Technology Editor, a cyber criminologist, digital investigator and digital forensic scientist at The Center for Digital Forensic Studies, is a writer, researcher and lecturer on cyber threat analysis, cyber criminology and cyber jurisprudence. He has lectured extensively and has written, edited or contributed to 20 books and several hundred articles in major national and international trade, technical and scientific publications.
Product Reviews
AlienVault Unified Security Management USM Appliance
Verdict: Not much to say here besides that this product is SC Lab Approved and that is our highest award. This is one of the best UTMs we’ve tested and over long periods of use it has delivered very well. We make it SC Lab Approved for another year.
EventTracker SIEMphonic
Verdict: Especially for organizations with limited expertise in applying all of the things a SIEM can do to protect their enterprises, this product is a must-see. However, any size organization can benefit by considering this as part of its security stack.
Fortinet FortiSIEM
Verdict: There is a lot to getting this one up and running, but once it’s up and you have the things you want to monitor plugged in, this one of the most complete SIEMs we’ve seen.
CorreLog SIEM Correlation Server
Verdict: We like this a lot, especially for SMBs, although larger organizations certainly should not rule it out as too small. It’s not. For its value and feature set, as well as the efforts to improve and keep the product ahead of the curve, we make this our Best Buy.
McAfee Enterprise Security Manager ESM
Verdict: Since this already is SC Lab Approved, we can’t give it a higher rating. We like this well enough that we are extending its SC Lab Approved designation for another year. It continues to be our key analysis tool.
LogRhythm Threat Lifecycle Management Platform
Verdict: This is an important contender for your SOC SIEM. It will take data from just about anything you need to monitor and it includes solid third-party threat feed access. This is our Recommended product.
Sophos XG Firewall
Verdict: This demands your attention no matter what size your organization. There are models to cover most requirements.
Splunk Enterprise Security
Verdict: This is a product with which you pretty much can’t go wrong, especially since it integrates with most products that need the log management and analysis that it does. It is sort of a SIEM’s SIEM.
