OpenService Security Threat Manager 3.5
OpenService primarily uses a software delivery model, though it told us it has provided turnkey packages in the past. We tested STM 3.5 using stock Windows 2003 builds on our Dell 1850 servers. STM has a few deployment options, but for our review we decided to put the event collectors and correlation engine on the same platform. Initial installation was a little confusing, but it didn't take us more than a few hours to get the base system up and running. Bringing our device data feeds online was more complicated, however. In fact, we didn't find very many operations in STM intuitive.

OpenService has a lot of the basics covered: STM supports a wide range of devices; it has reporting tools and a correlation rule capability; and it provides built-in database management tools to import, export and prune stored data--a feature a number of the other products lack. It also possesses one of the more advanced role-based authorization systems we've seen, letting organizations tier access to the SIM infrastructure. Access can be controlled for editing configuration files, restricting which device classes can be viewed, viewing alerts, managing the database and more.

What STM doesn't have, however, is a friendly and intuitive UI and an easy way to manage everything. The UI is HTML- and Java-based and uses a tree-based navigation method. Similar to QRadar's interface, STM's presents a lot of actual event data using HTML-based tables. Unfortunately, we found the layout prohibitively confusing. STM also lacks a native syslog collection service; OpenService expected us to install a third-party service to get things running, a state of affairs we find shocking in 2006.

STM is part of a larger OpenService network management framework, but testing integration with that framework was beyond the scope of this article. Perhaps customers looking to have more closely linked network and security operations teams will find STM more useful than we did, but we think OpenService would be wise to modernize much of its product.

Greg Shipley is the CTO of Neohapsis, an information security consultancy and enterprise IT product-testing lab. Write to him at [email protected].