Symantec Security Information Manager 9500
Symantec entered the SIM space quietly when it acquired a small vendor named Mountain Wave back in 2002, and only recently started marketing its SIM offering aggressively as the revamped Symantec Security Information Manager 9500. Symantec shipped us a 9500 appliance, which we got up and running in a day, albeit with some minor struggles.

Unlike High Tower and LogLogic, Symantec is still bundling individual device collectors and parsers separately. So to bring a new class of device online you must first install the proper parsing code--a task that is manageable, but cumbersome. We found this approach particularly odd given that Symantec is using an appliance--why not just bundle everything on the device and be done with it? The 9500 wasn't as smooth as High Tower SEM on the device-provisioning front, either; we had to identify all our logging sources manually. Perhaps minor points given the full range of features, but if we were forking out $60,000-plus for a SIM product we'd want these problems resolved.

Moving past installation nuances, the product is relatively mature in the areas of real-time analysis, correlation and reporting. The 9500 supports configurable dashboards, an incident-handling and ticketing system, and a basic set of canned reports. Like the products from ArcSight, Q1 and Network Intelligence, Symantec's offering also supports a GUI for creating custom correlation rules. The correlation rules editor and logic were a little awkward at first, until we understood more about the "AND and OR" modeling Symantec uses to build rules.

Symantec's pricing model is a combination of starting price, per-device price and annual support costs that include threat data feeds. The MSRP base is on par with that of offerings from companies such as High Tower, but Symantec also charges additionally per device, which makes the model less convoluted than ArcSight's, but more complicated than that of many of the other vendors.

Symantec does offer one unique feature: Through mining data sets from its DeepSight service, Symantec bundled an intelligence feed so that the 9500 can download and integrate known IP ranges and attackers into its internal data sets. This gives you some global perspective of top threats active on the Internet. For example, all the SIM products we tested could detect port sweeps and generic network scanning. However, by integrating the Symantec threat feed and incorporating it into live watch lists, the 9500 could identify common attackers on the Internet and give us additional information about frequency, timelines, when they were first spotted and more. We found this information useful when determining which probes to investigate further.