What is most valuable?
* Quick search
* Ability to define reports based on SQL query, especially when you have complex report criteria.
* Stream audit data to 2 collectors simultaneously.
* GIM passive install. You can connect GIM from Colletor or CM when GIM is running in listening mode.
How has it helped my organization?
Can't tell as I did POC only.
What needs improvement?
* First of all. GUI and user experience needs to be reworked from scratch. Product management console look like from 90's.
* Deployment process is very complicated as you need to now all advanced parameters. Almost not possible to figure out for yourself.
* Central Manager (CM) needs rework to. Some configuration params still needs to be done on collectors locally.
* Agent statistics is not available by default. You have to make a report and still you will not see all information like data interface activity.
* Dynamic datasets is rocket science. To make it work you have to build several additional procedure, which make it extremely fragile.
* Audit data is a single block. if you have several policies you can't purge data for specific policy.
* Collectors requires enormous amounts of resources comparing to other products available on the market.
For how long have I used the solution?
a month only to evaluate this product
What was my experience with deployment of the solution?
Yes, during the deployment you get nothing out of the box. You have to manually configure everything. Tune parameters for agent, collectors. Agent deployment is very complicated.
What do I think about the stability of the solution?
Yes, scaling the product might be a tricky task as you have to configure parameters locally or collectors or agents.
What do I think about the scalability of the solution?
Product looks easily scalable.
How are customer service and technical support?
SMEs that were together with me during the POC were very technical and did understand their product. Technical Support
n/a for POC
Which solution did I use previously and why did I switch?
Yes we use Imperva SecureSphere, and still use it as Guardium has failed POC. We were not able to replicate our current deployment and some major issues, Guardium had, prevented us from selecting this product.
How was the initial setup?
It was extremely complex. Without IBM support it would take years for you to setup infrastructure.
What about the implementation team?
Throught the vendor team. These guys were very technical and helped me to understand each steps during the POC
What was our ROI?
What's my experience with pricing, setup cost, and licensing?
We haven't talked much about pricing and licencing. But it is not cheap for sure
Which other solutions did I evaluate?
We haven't chosen this product.
What other advice do I have?
If you have complicated report requirements which involves very specific filtering and/or aggregation. And you have lots of resources in your virtual platform. Then give it a try.
Also I suggest you take a look at other top grade product like Imperva SecureShere. the reduction in resource requirements is 3 times less and it have plenty of nice features out of the box.