Tripwire steps into SIEM territory
Tripwire steps into SIEM territory
By Robert Westervelt | Feb 8, 2010
0 comments
Facebook
LinkedIn
Digg
Tripwire Inc. has announced plans to sell security information and event management (SIEM) technology, but analysts say it's entering an already chaotic and crowded market where it is sometimes difficult for enterprises to thoroughly evaluate vendors.
The Portland, Ore.-based configuration management vendor is introducing Tripwire Log Center, selling log and event management software that can tie into many different systems.
The biggest challenge for enterprises is to get SIEM software to tap into event data from a variety of proprietary data sources, such as network firewalls and intrusion detection systems. The goal of SIEM products is to help collect and analyze all the activity data to determine the overall health of a network. In addition, SIEM systems are being deployed to give compliance auditors evidence that a company is maintaining log data and that someone within the organization is minding the network.
"All these tools were originally designed to take logs from security devices and correlate them for threat purposes," said John Kindervag, a senior analyst at Cambridge, Mass.-based Forrester Research Inc. "There was never a movement to put payment application data into some of these things and with the various payment applications out there it can be a difficult process."
With much of the interest in SIEM products driven by compliance initiatives, the market for SIEM products is jam-packed with vendors, many competing with similar products. Established names include Arcsight Inc., CA Inc., Intellitactics Inc., IBM, NetIQ Corp. and EMC's RSA Security division. Other vendors include LogLogic Inc., NetForensics Inc., Novell Inc., Sensage Inc., Symantec Corp. and TriGeo Network Security Inc.
Most vendors sell SIEM appliances and prepackaged software, though there are no advantages to choosing an appliance over a software package. Alternatively, Kindervag said small and midmarket companies may eventually choose SIEM in a Software as a Service (SaaS) package.
Similar
Add comment
Similar
knowledge_central_tab
