SolarWinds Security Event Manager (SEM)

The Solarwinds SEM will get your logs collected and analyzable, especially for Windows servers or workstations, it can be a good solution. Alerting and reporting need to be done manually, but once you have it set up the way you want, it will work solidly. If you are looking at a log collection solution that has any of its own smarts and analytics, Solarwind doesn't have such machine learning features, maybe in the future. If you want out of the box reporting and alerting, that won't happen. They need to create and fine-tune the rules more.

LEM is best deployed in networks requiring high-speed aggregation of log messages across disparate platforms to a single logging system. In an environment where immediate response to security events and incidents is needed, LEM performs very well. From tracking suspicious user login events in real time to detaching suspect USB devices from workstations, LEM provides the ability to respond quickly.

We have had scenarios in the past where a user account gets locked out continuously. As it turned out they recently changed their password but were apparently logged in elsewhere under their old password. The problem came in trying to determine where they were logged in from. With LEM we were able to query for the lockout event to determine where the failed login attempts were coming from. Once known, the account was logged out of the machine and the lockout events quit occurring.

The SEM tool [seems] very difficult to use due to lack of support from SolarWinds customer support. No up-to-date documentation on how to onboard, no videos on best practices, no use case videos[, and] bad customer service.

SolarWinds Log & Event Manager (LEM) is a SIEM that is very well suited for environments where you have a small team managing your technology and need a powerful tool that is easy to set up and requires little maintenance and care to continue doing it's job. In the time that we have had LEM deployed, it has been very solid and has required very little intervention to resolve issues. It comes pre-packaged with some great correlations to get up and running right out of the box as soon as log sources are pointed at it. If you need a SIEM and either don't have the expertise in house, or don't want to spend the resources for professional services, this may be a good fit. There are only a handful of situations where we have run into LEM's limitations when trying to setup functionality or correlations. Otherwise, it is an excellent SIEM that offers some great features.