SolarWinds Security Event Manager (SEM)

A good product for a single pane of glass auditing various products.
Not a product you can set up properly in 1 hour and needs long hours of reading to get used to.

There are numerous SIEM solutions out there, all of which offer similar features. SEM does have a slight learning curve to get set up and working but is not unreasonable. For us, SolarWinds SEM strikes the perfect balance between cost and functionality. We re-evaluate our logging needs every year and SEM continues to meet the requirements of our business.

LEM is best deployed in networks requiring high-speed aggregation of log messages across disparate platforms to a single logging system. In an environment where immediate response to security events and incidents is needed, LEM performs very well. From tracking suspicious user login events in real time to detaching suspect USB devices from workstations, LEM provides the ability to respond quickly.

Smaller companies just getting started with looking at security products would like the product. Also, maybe smaller companies without dedicated security staff that just need something for some bare minimum requirements. It does some of the easy stuff pretty well, and there's no massive learning curve.

Bigger companies or companies with dedicated security staff will likely look at other options. This seems like an entirely mid-market only purchase. If you want to be able to correlate events from multiple sources, not just agent-based windows logs, you'll likely need to look elsewhere. While you can also forward syslog to the appliance, you can't enrich any data or use sources like NIDS/HIDS logs. This product will not give you a true single pane of glass like some offerings.

For medium to large scale business that incorporate high-value resources and need a central log repository I think SolarWinds is fantastic. It may be overkill for smaller businesses however.