LogLogic ST 3000 and LX 2000
LogLogic shipped us two appliances for testing: an ST 3000 and an LX 2000. The LX is a classic log-aggregation, monitoring and storage product, while the ST provides a platform for large (terabyte-size) unaltered logs that are easily text-searchable. The ST and LX devices both receive and store data, but the ST is designed to manage larger data sets. The two products are manageable through the same UI, however, so interaction was seamless; we typically didn't even notice which unit we were accessing. LogLogic positions the two appliances as a bundle for organizations that need ad hoc querying abilities on larger data sets.

Both LogLogic's strengths and weaknesses share a single trait: simplicity. On the positive side, we had the products up and running in a matter of minutes. Similar to High Tower's product, our LogLogic appliances attempted to identify the log sources it received, which made the configuration process painless. The UI is Web-based, and we found it a bit cluttered at times, but for general reporting and ad hoc querying it's adequate.

Configuration and user setup were easy--we even configured remote NAS devices for additional storage capacity in no time. LogLogic also has a basic but incredibly useful ad hoc querying tool. You can enter a text string, for example, and it will search its entire data set--regardless of data origin or device type--for that string. This may sound like a simple enough feature, but we were surprised at how few products can accomplish this easily. LogLogic's capabilities had us using the product more than the others for tasks such as username lookups.

On the negative side, LogLogic seems more focused on simply managing and storing logs, and less with real-time monitoring and analysis. The product does have a basic dashboard for monitoring event-per-second loads, system health and general statistics on log transportation, but it lacks the real-time correlation rule sets found in ArcSight ESM and QRadar, making it less security-analyst- and incident-response-friendly. Bottom line, you probably aren't going to use it to monitor the health of your security posture; it's more suited to monitoring the health of your logging infrastructure. Now, this log emphasis isn't necessarily a bad thing--log transportation, storage and querying capabilities are all necessary components of security information management. However, organizations need to be mindful of their requirements. For some, LogLogic's products might meet their needs. But those that want a more SOC-minded toolset with advanced correlation rules may need to invest in a third-party analysis tool in addition to LogLogic to meet their goals.