SolarWinds Security Event Manager Reviews

When an account is created in active directory your teams can be notified. You can also be notified when computer objects are created in your enviroment. This can be helpful to spot unknown devices that may try to bind to your AD for authentication. Or if accounts are deleted in mass you can react quickly.

SEM is great in my environment for monitoring Windows Event Logs to view any changes in Active Directory such as adding users to administrators and domain admins groups. Also for auditing configuration changes on Cisco devices, it is very useful. I find it not so useful for logs from the VMware NSX platform. For these logs, I use VMware's own vRealize Log Insight. It would be great if I could consolidate everything onto SEM and have a single place to collect and analyze all logs.

It is well suited to monitor your Windows AD. You can get detailed login information and notifications like failures and lockouts. It also shows the IP address where it occurs so it makes locating the culprit a lot easier.

It does well with monitoring for suspicious activity. It can alert you if It sees a client is trying to circumvent DNS so they can go through proxy avoidance tactics.

SolarWinds SEM is great for alerting when applications are misbehaving, sometimes if an application gets stuck in a logic loop you will immediately know with SolarWinds SEM because you can see the logs generated on that application would have skyrocketed. It also provides useful information to really track down what computers are locking your account out (we all deal with this). SolarWinds SEM will only benefit you if it can see the logs on the device or forward them to SolarWinds SEM.

The SolarWinds Security Event Manager is great for people who want to be able to either view logs or set up emails for certain actionable events. However, it would be less helpful in a situation where you want your SEM to be taking action on specific items. There are some actions that can be taken by the SEM, but they constitute a rather short list in comparison to other SEM tools.

Smaller companies just getting started with looking at security products would like the product. Also, maybe smaller companies without dedicated security staff that just need something for some bare minimum requirements. It does some of the easy stuff pretty well, and there's no massive learning curve.

Bigger companies or companies with dedicated security staff will likely look at other options. This seems like an entirely mid-market only purchase. If you want to be able to correlate events from multiple sources, not just agent-based windows logs, you'll likely need to look elsewhere. While you can also forward syslog to the appliance, you can't enrich any data or use sources like NIDS/HIDS logs. This product will not give you a true single pane of glass like some offerings.

SolarWinds Security Event Manager is well-suited for small- to mid-sized organizations that cannot afford a large Information Technology team or department. SolarWinds Security Event Manager has robust reporting and logging capabilities, but significant time must be spent up front to ensure proper configuration. Once configured, however, the power of SolarWinds Security Event Manager stands above Cisco from an alerting perspective and can assist with investigating any security issue in your environment.

I'd give it a 0 if that was an option. Sometimes, on the rare occasion that the SSO isn't broken, we can actually log in to this and click around for 30 minutes and finally find some logs that point us in the right direction for tracking down what's locking out an AD account. Other than that, it's useless.

SEM is well suited for all size networks, from small to large. It can be used by network engineers or by security engineers as the tool can address multiple issues.

The initial install is the first step and shows you some compliance issues that you may not even be aware of.

SolarWinds Log & Event Manager is very well suited in a heterogeneous enterprise setting (multiple locations/campuses) where you would have various brands/manufacturers of devices represented. While it doesn't require a full-time admin, it does take a little time to add/update/remove nodes in, configure data collection settings, and generate custom reports. Because of this, it may not be a perfect fit for a small to medium-sized business due to the initial investment of time and cost.

LEM is best deployed in networks requiring high-speed aggregation of log messages across disparate platforms to a single logging system. In an environment where immediate response to security events and incidents is needed, LEM performs very well. From tracking suspicious user login events in real time to detaching suspect USB devices from workstations, LEM provides the ability to respond quickly.

Filtering, detection, and notification of Windows and AD events is LEM's strong point, though it's tricky to build the filters. It's not necessarily designed for forensic firewall packet capture but it can be used for that purpose.

Great for email alerts of account actions, such as lockout, enablement, and disablement. We engaged in a separate solution to track account creation. Other solutions are needed for the in-depth tracking of account lockouts if it doesn't involve a definite source machine on the network.

For medium to large scale business that incorporate high-value resources and need a central log repository I think SolarWinds is fantastic. It may be overkill for smaller businesses however.

It will get your logs collected and sortable. If you are mostly doing Windows servers or workstations, then it can be a good solution. You will have to be willing to learn the software and manually create all the alerting and reporting, but once you have it set up the way you want, it should work. If you are looking at a log collection solution that has any of its own smarts and analytics, you'll want to look elsewhere. If you want out of the box reporting and alerting, look elsewhere.

LEM is valuable for pulling from many sources and consolidating resulting events into reports and alerts. LEM is not well suited to users not used to working with and parsing raw information.

SolarWinds Log & Event Manager (LEM) is a SIEM that is very well suited for environments where you have a small team managing your technology and need a powerful tool that is easy to set up and requires little maintenance and care to continue doing it's job. In the time that we have had LEM deployed, it has been very solid and has required very little intervention to resolve issues. It comes pre-packaged with some great correlations to get up and running right out of the box as soon as log sources are pointed at it. If you need a SIEM and either don't have the expertise in house, or don't want to spend the resources for professional services, this may be a good fit. There are only a handful of situations where we have run into LEM's limitations when trying to setup functionality or correlations. Otherwise, it is an excellent SIEM that offers some great features.