What did SIEM ever do for your business?
Following last year's billion pound acquisition by HP, ArcSight's security information and event management (SIEM) platform is under the control of a technology giant, but some of Arcsight's former employees felt that there were a few things HP could also be doing to improve the solution.
Last week I met with EdgeSeven, established by former ArcSight employees Jon Inns and Rick Wilkinson who rather than setting up a competitor to their old company, are now working on a complimentary tool to the SIEM technology.
Inns explained that a problem with SIEM is that people do not understand what it does and what it can do and it is all well buying tools but if the technology is not being used correctly it is a poor investment.
“This is what we are about,” he said. “What we are trying to do is different, we believe ArcSight is the best technology as analysts say, and if the technology is done right it can bring riches but few people understand what it is about and how to approach it.”
Wilkinson said that SIEM is a complex product but invariably it is trying to solve a complex problem. “People look at the technology but they are not ready to, they look at the questions but are not sure what questions they should be asking.”
Inns said: “This is a method to walk the customer from the question to the solution, if they have got a product are they sweating it? If not, do they need it? You can address this with a managed service or an in-house development.”
Inns explained that the product and service is around SIEM, data analysis and compliance ‘bolt-ons', as well as trying to monitor black spots to enrich data in real-time.
Wilkinson said: “This is adding to relevance and specific standards, you can enrich it with niche applications. This is a clear move within the mid-market, with log management price and correlation this is the same problem, but some people have got the same problem, as they do not have a security guy.
“We see an absolute market for providing technology for the mid-market who do not have the resources to achieve situational awareness.”
An added service to a technology that is supposed to do the work for you may not seem like the best business plan, but what EdgeSeven were saying did seem to make some sense if you are not getting the best from your investment. After all, there is no shame in asking for help to get a better result.