When I started looking for a managed SIEM, consultants looked over the specs and compared us with some of the bigger players. They addressed concerns that they had to me, then we dealt with those concerns in the early days of installing the SIEM. Knowing that I have a seal of approval from those consultants was very important to me, and Netsurion rose to the level of getting that approval from them. They seem satisfied with what they have seen in terms of our ability to meet all of our compliance requirements and general security needs.

The vendor’s assistance in the onboarding process helped with the product’s time-to-value and return on investment.

Their SOC team had a number of documentation guides. The only one that we struggled with was the Office 365 integration, given that Microsoft keeps moving a number of the admin tools around into different places. Office 365 is going through some fairly frequent adjustments, updates, and changes every couple of quarters. By the time they had published something, we had actually done some of the Office 365 integration parts. They needed to remote screen share with us to walk us through, because everything was in different places. 

Their assistance meant we weren't fighting to get stuff working.

We didn't have to do anything. Netsurion did everything. We sat down, we told them, "Here's what we feel are our key pieces of software. Here's what we've designed." They showed us how to exclude that inside of their software. I want to say that we did 30 days of just listening to the network and bringing them reports. From our side, we mostly conferred with them initially and spent time with them explaining what intellectual property we had running and what programs were essential to use on the network. It was super simple.

We did it internally. It's very simple. There was no need for a third-party or assistance. It was a really easy deploy.

It was handled internally by our IT operations.

Netsurion did the installation. We did not work with a third-party consultant.

They provided assistance and they do with that SIEMphonic piece. We purchased training from them and then worked with them directly on what we wanted configured and how to configure it. They did most of the heavy lifting of actually configuring the reports and all the alerts. If you want filtering you can ask them, or you have the ability to go in there yourself. I personally don't have a lot of time and resources to do that, so using their staff and the resources has been very beneficial.

Overall, they are very professional and good to work with. Some of their trainers were difficult to understand, as there was a language barrier. Some other staff from outside of the US, some of their training people, the technicians who provided training, were very difficult to understand. Others were not hard to understand. It was a case-by-case issue. But we did have some issues with trying to understand them during the training. We expressed our concerns and, of course, they addressed that. It was a process we worked through.