High Tower Software Security Event Manager
This is the first time we've used a High Tower appliance, and we're impressed. For starters, Security Event Manager (SEM) had the easiest deployment of any product we tested. Not only were configuration and setup a breeze (and finished in a morning), the device provisioning process was an absolute joy. Essentially, when we began pointing our syslog streams at the High Tower system, it intelligently identified each source, flagged it as a potential asset candidate, and made a reasonable guess as to what it was--for example, Cisco PIX or Linux host. The UI consolidated these device guesses under a "candidates" tab, and we simply approved or disapproved them as legitimate log sources. High Tower's well-thought-out approach saved us time and energy in our 30-some device environment--its impact in reducing deployment times in a several-hundred or several-thousand device environment would be significant.

SEM also had the most no-hassle interface of the products we tested. In fact, we found ourselves gravitating toward it frequently. During testing we misconfigured a relay host, for example, resulting in the transmission of large amounts of data onto our outbound Internet links--a move that sent our latency through the roof. We immediately noticed that our events per second spiked from an average of 100 or so to more than 2,000, right from the SEM dashboard. Now, that's not to say that the other products can't be configured to chart event-per-second ratings, but because SEM has such a clean interface, it became our go-to product for many investigative efforts.

SEM's biggest shortcomings are on the reporting and real-time correlation fronts. Its reporting capabilities are simple at best. Canned reports are customizable, but what comes out is extremely basic. As for correlation, SEM is currently not in the same league as ArcSight ESM, enVision, QRadar and Symantec's Security Information Manager. SEM 3.1 (the latest shipping version) comes with 20 prebuilt correlation rules that are quite useful, but we couldn't build new rules from scratch. The only thing we could do is provide some tuning parameters for those 20. We saw a working demo of Version 3.2, due out later this year, and High Tower added the ability to customize real-time correlation rules, addressing our biggest concern with the product.

High Tower also has a very cut-and-dry pricing model; it ships turnkey systems that are sized based on two factors: event-per-second load and storage capacity. That's it. For organizations willing to sacrifice some flexibility and features for ease of use and deployment, High Tower SEM will be hard to beat.