Strengths: Highly intelligent SIEM analysis capabilities
Weaknesses: High cost for a software only product
Verdict: Strong product, but quite pricey for software only
Sentinel from NetIQ offers a lot of robust SIEM features and functions, including log collection, aggregation, correlation and analysis and reporting all from one single point that is easy to use and manage. Administrators and security personnel can use this tool to gain a great amount of insight into security events, as well as prevent threats that may be unseen without the use of Sentinel's powerful log correlation engine.
We found this solution to be of average difficulty to set up and deploy. It comes as a software package that can be installed on either a Microsoft Windows or Enterprise Linux server. NetIQ recommends the Linux deployment, so that is the one we had for evaluation.
Overall, we found the installation to go pretty smoothly. It required minimal Linux experience. After installation was complete, we were able to manage the entire product from a web-based management interface. Included in this interface is the Sentinel Control Center, which provides a centralised interface to manage data and analysis of events.
Once we became comfortable navigating around the various dashboards and menus of the appliance interface, we found this product to include a wide variety of reporting, analysis, and automation and remediation capabilities. Once configured, Sentinel will be able to detect anomalies in the network and event baseline and provide remediation and threat information automatically.
Aside from threat monitoring and event management, this product also integrates with identity management platforms to help create a more specific picture of an event by tying in user information and logging. Sentinel can correlate information from IPS/IDS sensors against known vulnerabilities to help identify possible threats before they become a problem.
Documentation included many PDF guides, including installation, administration, a quick-start and user manuals. We found all material to be nicely organised and to include many step-by-step configuration instructions and examples, along with screenshots and clear descriptions. We found a good amount of overlap in the manuals, which made finding information on specific configurations easy.
NetIQ offers both 12/5 and 24/7 product support levels to customers as part of an agreement. This includes phone- and email-based technical aid, along with access to product and software updates and upgrades. Customers can access an area on the website at no cost, which includes a knowledgebase. Furthermore, users can access a full user forum that features many custom-built connectors and helpful information from product users.
At a price of c£38,835 (converted from Euros, which the company sells in) for the software and one year of support, NetIQ Sentinel is quite costly for a software-only product, and we find it to be slightly above average value for the money. While this tool does carry a monstrous price tag, it also includes a great amount of intelligent features and functions that give it solid SIEM capability, which helps make it worth the overall cost.