SenSage Enterprise Security Analytics
SenSage, formally known as Addamark, got its start in the SIM arena by providing a powerful back-end replacement for conventional RDBMS technology. Originally, SenSage partnered with SIM vendors to bundle its technology, but over the past 18 months the company has begun integrating features into its ESA product that are squarely in the area of SIM. SenSage shipped us a whopping six Intel multiprocessor systems running Linux on which to evaluate ESA. It offers a software-only delivery model, but the company clearly wanted us to evaluate ESA on a specific set of hardware.

SenSage's claim to fame is its proprietary database-like architecture that does away with much of the unnecessary overhead found in most SIM apps. The rough idea is that, by structuring and indexing data a specific way, you can scale your online SIM database to multiple terabytes without being plagued by conventional RDBMS performance ceilings. In speaking to organizations that have crossed the multi-terabyte threshold in their SIM deployments, we're convinced that performance can become a problem with really large data sets. However, we weren't able to test this.

Although we would love to put the data-volume issue to the test in future review, we humbly submit that data management is but one facet of SIM; if the reporting, UI and real-time analysis capabilities aren't there, query times are going to be a secondary concern. Unfortunately, these other areas are precisely where ESA needs work.

SenSage has most of the important pieces of a SIM product in various stages of development, but it reminded us of just how inadequate offerings from SIM vendors were two to three years ago. For example, the installation process was far from painless and took several days to complete, we had a few glitches with services dying during our testing and requiring restarts, and the UI is closer to the Microsoft Office toolbar than an integrated SIM suite. Bringing new devices and parsers online was painful, too, requiring us to copy and edit files on the file system to get everything working properly. None of these are show-stopping faults, but we found the product seriously rough around the edges. It's also stunningly expensive, with an as-tested price about three times greater than what rivals charge. It is one of the least-mature SIM products in the space plus the highest entry-level price--not a winning combination.

To the company's credit, our support team solved every problem we tossed at it, including a rapid turnaround on an arpwatch parser and alerting mechanism we wanted to put in place.

Perhaps for some shops SenSage's scalable back end will balance its price and lack of polish, but we suspect the company is going to need to beef up the rest of the product's features to remain competitive.