EventTracker Other Advice

Richard Teegarden
Network Manager at a energy/utilities company with 51-200 employees
They are a fantastic team. I would stack them up against anybody. If anybody asks us what we're using for a SIEM, I'd say that this is what we're using. I highly recommend them. Stack it up against some of the other products out there. At the very least, know what you're looking for. Or, if you don't, throw it back at EventTracker and say, "We're looking to do this, can your product do it?" Let them know what you're looking to gain from this. We started out in the same boat: "Well, why would we use you guys versus somebody else?" We had a defined requirement, that we wanted to have centralized event and incident management, and that's exactly what we got. You need to find out if it's going to match all of the various appliances and the OS you have. Is it going to be able to pull in the syslogs? What type of products do you have in your environment? Are you pulling in Cisco devices? Whatever your firewalls are, make sure that they're matching up. I had no doubt in my mind that they were going to match up to everything in our environment, right upfront, as we gave them the list and we did that self-discovery. I think that's part of it was the workbook process. What are your devices? How many are there? What are you using for mail? What are you using for backend storage? What do you have for databases? What are the products on your network? Make sure it matches up. I have no doubt that they'll match up well with everything out there but make sure that whatever is on your network that you want to monitor, that those specific vendors and those devices match what they can track and log events against. Every month, when we do an assessment they ask what more they can do. Until something crops up that leaves us a little bit blind or unsure, I really don't know what they're not giving us at this point. We haven't started looking at any other products to fill any gap. I don't have a laundry list of anything I'm waiting for them to come back with, whether it's a fix or a feature. I'll do a lot of event searches myself, more out of curiosity than anything. I might chase something down if we get a flag or notification and look for what else is taking place around that event, to get a clear picture of why it was flagged. Was this something that we brought into the environment? Were we installing something at the same time that something was flagged? What was going on? So I tend to go into the event searches a lot and the managed devices, looking for non-reportings. Those are probably my two biggest hits. When it went from version 8 to 9, the UI changed up a little bit, so it took a little bit of getting used to. They did provide not only some on-call support to walk through things as I was asking them questions: "Nope, that's here," or, "Give this a try." They also had some pretty easy tutorials to walk through. I've done that a couple of times just to refresh myself as far as where things are. But, like I said, because we tend to lean on them for a lot of the managed side, I don't dig into it as much as I used to when we first got started with it. It's been huge just to have them a phone call away or at arm's length to say, "Can you guys take a look at this, or do this, or verify this for me?" Typically it's just on my desktop at work. If I'm taking a look at the dashboard, I might pull up user devices - what's not reporting in. That's a biggie for us, especially as we roll out new devices and we're getting agents out on those devices. I want to make sure that they're being pulled in correctly and that I'm seeing logs. I may take a look through some of the threats, but again, their support does such a great job of combing through all the threats and kicking out any notifications to me that I don't spend a lot of time in there. In terms of integrating it, we haven't tied EventTracker back into anybody else. At this stage, we're tying everybody into EventTracker. As we start to move into more of the cloud space, there may be some of those cloud-authority services that this may tie into. We haven't gotten to that point yet. The biggest lesson I've learned from using it is that I think we'd take a huge step backward if we ended up losing EventTracker; whether it's EventTracker or a SIEM product of that caliber. We're part of critical infrastructure and the threats against that infrastructure have increased a tremendous amount over the last five to seven years, whether it's on the network side or the OT side. Having the eyes and ears to be able to manage and monitor those types of events against us, in our industry, is massive. Being under a constant threat, like everybody else out there, we want to know what we have, what's in our system; we want to know where the abnormalities are. We want to see the events on a daily basis. You have to track them. You have to be proactive. You have to take some action on those things on a daily basis. Having this in place gives us the ability to see what's going on, on a daily basis, on all of our systems across the enterprise. That's massive to me. I would absolutely rate EventTracker a ten out of ten. I love it. View full review »
Geremy Farmer
Information Technology Coordinator at Magnolia Bank, Incorporated
If it's your first SIEM event-correlation system, be prepared for a long process. That's not just because it's EventTracker. That seems like that's what that process takes. Again, it really depends on what data you want to capture and how much data you want to capture and how you want to review that data. That configuration process can be very time-consuming. We're on EventTracker 8, but we're getting ready to upgrade to the most recent version of nine, but we have not upgraded yet. I don't typically use the dashboard widgets. I have everything configured in daily, weekly, and monthly reports. We have real-time alerts configured as well. So I'm not really utilizing the dashboard widgets. I know it has a lot of features and options but I manage the system from the reports and real-time alerts. In terms of the screens we use to view the solution, we mostly use the Excel reports that are generated daily and weekly. I access them, as well as the real-time alerts, from all devices. You can view them and see the details from any type of device. But I'm looking at the alerts through my email client on whatever device I'm on. We have logs coming from our firewall configured to auto import log data, but we are not manually importing any log data. Currently there are only two users in EventTracker: myself, as the information security officer and another gentleman here at the bank who is the backup information security officer. He functions more as a backup, but he's never had to step into that role and use the system. He received the training, but I handle the whole system. I'm the only one deploying and maintaining the system. We have internal staff resources for internal incident management but we do not use the EventTracker SOC team. We handle the incidents internally, leveraging the reports and alerts. We don't have any plans to increase usage, unless we add one or two offices as we do naturally in our mortgage division. The difficulty with the language barrier at times with their training and technical support staff is a problem. That's why I'd rate it an eight out of ten. View full review »
Bryan Caporlette
Chief Technology Officer at G&G Outfitters Inc
The solution has been everything that I've asked for from a service standpoint, software standpoint, and support. I have no complaints. My advice would be to engage them to do the installation. The managed service is great value which saves you a full-time employee on your staff by being able to outsource it to EventTracker to review all the logs and cull through the data to make recommendations and identify threats, then how to remediate them. They provide it to you in your weekly or daily report, depending on how frequently you want to have them do it, which is based on your compliance. If you have compliance requirements for HIPAA, PCI, etc., it is a great benefit to help an organization meet their compliance requirements. We have internal staff resources for internal incident management. We leverage the EventTracker SOC team. When we detected the virus, we kept in contact with the EventTracker SOC team and sent them emails, and they would call me and say that they see it on this server or that desktop, and we'd go and take it off of the network and clean it. Then, we would put it back on and they'd watch to see if they saw any traffic that was not supposed to be coming from that server. For the whole remediation process, they were sort of part of the team. Data is all configured to automatically go in. We deployed their agents, and those agents just send the log data directly to the SIEM. We don't manually upload anything. We did not integrate it with any other solutions. View full review »
Find out what your peers are saying about Netsurion, Splunk, AT&T and others in Security Information and Event Management (SIEM). Updated: September 2019.
371,639 professionals have used our research since 2012.
Sean Sheil
Information Technology - Business Process Analyst at a financial services firm with 51-200 employees
Go through some training to know the ins and outs of the application. It has changed quite a bit in the seven years I've worked with it, and it would be a good idea to do some more training to learn all the new features and to make sure you can utilize all the capabilities. The UI is okay. As I said, we're probably underutilizing the product compared to what we should be using it for. We don't view the information from it on screens. We more go off of the reports that we get daily out of the system. In our company there are only three people using the system. We're all IT managers. We're only monitoring about 30 systems and we don't have plans to increase usage. Total time for deployment and maintenance would be a part-time IT manager, ten hours a year. In terms of internal staff resources for internal incident management, it's the same three IT specialists. I would give the solution an eight out of ten. I'm not giving it a ten because of a lack of understanding of the system and some of the kludginess in the generating of reports. View full review »
Consulting Engineer at a tech vendor with 10,001+ employees
Get the preferred support. This is for the guy who uses and maintains the back-end of the system. Because if you don't have your firewall configurations configured correctly, you will need to have that support. All of our domain controller event logs are consolidated and stored on the server. Right now, we are sitting at 101 domain controllers, which is way too many. However, this was one of the main reasons why we purchased it, and it is performing well. The product version that we are on right now is much faster than the version that we were previously on. View full review »
Assistant LAN Administrator at a non-profit with 10,001+ employees
Overall, it's very straightforward. View full review »
Find out what your peers are saying about Netsurion, Splunk, AT&T and others in Security Information and Event Management (SIEM). Updated: September 2019.
371,639 professionals have used our research since 2012.
Sign Up with Email