Colasoft Capsa vs. Elastic Observability

Capsa is highly recommended to be used in small dense areas of a network where it makes sense to be able to run analytics off of a mirror port to gain insight into traffic trends. It is a costly product to install in branch locations, and requires a decent spec hardware to run appropriately

Incentivized

We can use this Elastic Observability in our business problems such as Creating internal/operational efficiencies issues, customer relations/service, and business process outcomes issues. This product has a lot of features for the above problems. But this product may be having some issues when charting purposes. But it can adjust for that purpose.

Incentivized

• Robust Application. Able to handle traffic that most businesses will throw at it.
• Easy to use. Easy to setup captures and filter down to specific traffic types.
• Relatively cheap for what it's able to accomplish.

Incentivized

• Open source code base
• Community support
• Is fast in processing

Incentivized

• Needs options to scale to 10Gb/s networks. The cutoff for performance looks to be around 3Gb/sl
• Needs API access to trigger capturesl
• Needs Agents for remote capturesl

Incentivized

• Difficult to setup/maintain
• Search pattern bar could be more user-friendly
• Premium subscription features are very expensive

Incentivized

Colasoft performs more like the traditional wireshark as opposed to other solutions that tend to focus on graphs instead of giving you the raw data. I personally prefer the raw data, and then the ability to build graphs upon this (which Capsa can do). This allows for quicker analysis and makes it easier to relate to.

Incentivized

Splunk is a very good product but the licensing costs are high; we utilise the best of both worlds by using both products for slightly different purposes. We put the voluminous data with simple use cases in Elastic where it doesn't cost too much and can be searched quickly while putting the less voluminous data with more complex use cases in Splunk so we can take advantage of Splunk's very comprehensive but often much slower SPL search query language

Incentivized

• While the product doesn't detect malware, it has helped track down malware infected machines by using data from other applications to run filters to look for known traffic destinations for that malware. For me this is a huge ROI since malware can be the great unknown.
• Relatively cheap compared to the feature set.

Incentivized

• Cost management.
• Good customer increment.
• Time management.

Incentivized