SolarWinds Security Event Manager Review

Can be used across many platforms and has a user-friendly GUI

What is our primary use case?

Our installation is on-premises at the moment. We are a consultant group so we implement multiple solutions for different customers using a variety of different products. Some clients are in the Cloud, some on a WAN network and some are on-premises. SolarWinds LEM is one of the products we use for certain purposes and often recommend.  

I'm very technical. I work as a network and security technical architect. At the same time, I also own the company, so I'm the director. I still remain very technically involved with the solutions and the architecture for solutions, based on networks and security. SolarWinds is one of the products that I use, amongst many others to fit the needs of our customers which includes their budget, size, and industry.  

What is most valuable?

I like the graphical user interface because it is very user-friendly. I like the fact that SolarWinds is a hybrid solution so you can use it across many platforms.  

What needs improvement?

I think the product can use some improvement on the reporting side. The reporting could be easier and more robust. I also think the NetFlow Analyzer component can be improved substantially in the way it is integrated with SolarWinds and with Orion. In my opinion, you are not able to drill down enough into traffic flows. It can be a lot more granular and that will make it a lot more useful in comparison to how it is incorporated at the moment.  

I think that incorporating a security management platform would also be good. This would be a solution like a dashboard or control panel where you can just snap-in modules. A global dashboard where you can snap in all the different types of solutions or the different types of services and products that you will leverage would be a great step forward in ease-of-use by making integration easier.  

For how long have I used the solution?

I've been using SolarWinds LEM since its inception, so that would be for close to 10 years.  

What do I think about the stability of the solution?

This product is quite stable and I don't have any issues with it on that level. I think one other thing that could be improved is that the Syslog Server should be integrated as a system startup service. Right now you have to bring it up and take it down manually. This isn't entirely a stability issue but it might be an improvement. It would be valuable especially in the security environment.  

What do I think about the scalability of the solution?

I think that the scalability of the solution is good enough. I don't think there are any issues with that.  

How are customer service and technical support?

I have not actually had to use technical support very much. I can not even count more than five instances in the span of 10 years where I had to call in with an issue. As I have not really had the need to actually go that route much, it is hard to give constructive feedback in that regard. But it may say something positive about the quality of the product.  

How was the initial setup?

The initial setup is pretty straight forward. In the standalone small business solution, we are using Microsoft SQL Express which is already integrated with the solution. I think they could make it easier to move from the Express version to the SQL Server version to give the user more flexibility.  

What's my experience with pricing, setup cost, and licensing?

As far as pricing, we always want it to be less expensive or more cost-effective as a consumer, especially when you take into consideration that SolarWinds has got a very broad spectrum of services that can be integrated easily but need to be licensed separately. I think they can come up with a way of putting bundles together which would encourage customers to use a wider array of their products and it could be a better way of increasing sales. People would show a lot more interest in a package deal instead of having to buy the products separately. Bundling might reduce instances where customers look at other solutions for comparisons. For example, I've got some clients that use the Web Help Desk solution, and some users that use the NetFlow Analyzer and SolarWinds. If these solutions could be bundled together in a more cost-effective package when they are purchased together, I'm sure that SolarWinds would realize a lot more sales of peripheral products and increase their total market share.  

The renewals are currently priced so attractively that they are much cheaper and more cost-effective than when you buy a solution brand new. This helps retain clients over time. My comments on cost mainly refer to the initial purchase of solutions where you are deploying a product and purchasing it for the first-time.  

What other advice do I have?

On a scale from one to ten where one is the worst and ten is the best, I would rate SolarWinds LEM as somewhere between eight and ten, so let's say nine. To make it a ten they would have to make improvements in pricing, reporting, and product integration. These facets of the solution are not so bad now but they can be improved.  

The advice I would give people considering network event management would be to go with the product that appeals to me the most. The advice that I would like to give would be to go with NPM (Network Performance Monitor) which is a different, more sophisticated SolarWinds product. As far as I'm concerned, that is a product that can challenge any competing product out there on the market. If anyone is looking to do any type of network performance monitoring at a high level, I would definitely recommend Network Performance Monitor Orion — the Orion version of the product of SolarWinds is the one to go for. As far as NetFlow Analyzer, I like it and it fits some company's needs very well, but I've used better products. That is why I mention making improvements in its feature set.  

From a security perspective, which is a lot of work that I do, the Syslog Server needs to be completely integrated as a system service. That is one of my biggest wishes for the improvement of the LEM product at the moment because the product itself is a good product. The only trouble is that when server engineers work on the servers and they perform some type of updates to get the operating systems back on par, or need to do something with security updates and so on, the servers get stopped. When the servers are rebooted, the Syslog Server does not automatically restart. That is a major problem, especially from an auditing perspective.  

Which deployment model are you using for this solution?

**Disclosure: I am a real user, and this review is based on my own experience and opinions.
More SolarWinds Security Event Manager reviews from users
...who work at a Financial Services Firm
...who compared it with IBM QRadar
Add a Comment