OSSIM leverages the power of the AlienVault Open Threat Exchange by allowing users to both contribute and receive real-time information about malicious hosts. AlienVault OSSIM is an open source Security Information and Event Management (SIEM) product. It is a unified platform providing: Asset discovery Vulnerability assessment Intrusion detection Behavioral monitoring SIEM OSSIM provides the basis for AlienVault's proprietary Unified Security…
N/A
BMC Track-It!
Score 3.4 out of 10
N/A
BMC's Track-It! (formerly Numara Track-It!) is an IT asset management, IT help desk, and license management solution.
If this is your first experience with a SIEM, this one can get you started. Take the time to learn the ins and outs of the product and you'll most likely be satisfied with it if your company is an SMB. If you need compliance reports, OSSIM is too small for you, you'll need to go with USM or USM Anywhere.
Track-It! is great for a small-to-medium sized enterprise that has a fairly small IT department but needs far more control of tickets than just email and spreadsheets. It scales well enough as IT departments grow, adding techs is simple enough, as is changing the workflow. A large company would probably be better off with a different solution. The lack of easy customization, and the shortcomings it has in workflow templates (which would be a nightmare for project management) means it won't scale up that far.
Asset discovery. Once installed in a centric, network-accessible server, OSSIM can poll all your endpoints with common protocols (SSH, SNMP, WMI) to detect and discover site-wide assets to monitor. You only need to group them by your own criteria once added to the product.
SIEM Event Correlation. You can define quite complex correlation rules to detect possible suspicious or malicious actions or attempts in your network, in order to categorize them as real threats or as false positives, thus streamlining your risk assessment and management.
Ease of installation. The entire AlienVault OSSIM is self-contained in an ISO file, which can be burned into a DVD or just mounted in your server of choice (physical or virtual) for deployment. The installation process is automated and quote verbosed, with options for static IP, email messaging and others.
Ease of access. Being AlienVault OSSIM a self-contained appliance, it can be accessed via web by any device that supports a web browser, being that desktops, workstation, mobile devices, etc. The OSSIM dashboard and other features are automatically rearranged to adapt to the particular device being in use.
AlienVault OSSIM is far easy to use and manage - provided you know what you're doing. As any SIEM application, there is some background knowledge required in order to take advantage of the product's functionalities, such as the log correlation and analysis. Other than that, the application is quite usable and robust.
Everything is done through MSSP and installation pro services. Once those hours are burned up, then you're on your own without a lot of help. Typically the pro services hours aren't enough to get past 60 days and MSSP are hit and miss. We had a miss for installation helpers.
We have rarely needed to use Support for BMC Track-It!, but in the times that we did need to use it, they were excellent. The biggest issue is that after not paying for support for about three years, now that we NEED support, it is too expensive for us to receive. This is due to the way their support is billed. So long as you never drop support, then you should be fine.
Originally my organization leveraged alien value due to the lower cost of entry and ability to manage it as a service provider. Unfortunately, after several years of working with this tool, it became unwieldy to use as it felt that almost every useful report had to be created by hand. As other tools have come out with the ability to do automated responses such as Stellar Data processor, we have begun to evaluate alternatives.
BMC Track-It! is much more bare bones compared to ServiceNow products, and if your department has the money, ServiceNow is a much better option. Not only is the Knowledge Base much easier to create and publish articles, but the asset management in BMC Track-It! is practically useless. BMC Track-It! is more cost effective, and with a small amount of technicians there's likely no reason to need a bigger solution, but it leaves a lot wanting.
The biggest positive impact it had on ROI was that the software itself didn't require any expensive ongoing maintenance contracts since it was installed and managed by our organization.
The negative aspect of this is if there was a major problem with the software, then it would require contacting the vendor, at which point it could become expensive for a service call.
