Item: ManageEngine ADAudit Plus
Rating: 8
Author: Ken Lubar

Use Cases and Deployment Scope

We use ManageEngine as an SIEM system for reporting on AD and other events. Various of our customers require SIEM systems and ManageEngine met the needs. It's pretty lightweight. We have about 50 workstations and 2 active AD controllers. Not a lot of usage against the ManageEngine but it mostly does the job. See later in the review for the good, bad, and ugly.

Pros and Cons

Data capture against a wide variety of sources (logs, events, windows, Linux systems)
Ability to find specific events in the logs
Basically unlimited history
Useful dashboard (although not really once you dig into it)

It's based on Java engine that is slow -- reports are often difficult to build (we are going to upgrade the machine it's running on to see if this is the issue)
Keeping this software up to date is a pain; there should be a better "update" function
The naming and navigation are terrible -- it's never clear which feature you're looking for and where it's hidden in the menus
Adding machines is not as easy as it should be; occasionally there are IP conflicts that are nearly impossible to resolve

Return on Investment

Gets the job done and meets SIEM checklist
Occasionally has help assign responsibility for "mistakes"
Provides some peace of mind for reporting

The reports are accurate and easy to get. There really hasn't been an "ah ha" moment from the systems, but that's really the nature of what it does. The ROI for the amount of effort and price is high. If you need a on premises, "check the box", cost effective SIEM systems I'd highly recommend checking out ManageEngine.

ManageEngine ADAudit Plus provides an in depth look at changes made across every aspect of your Active Directory. How has being able to track changes in your Active Directory impacted your organization?

Not a lot -- but we were not really looking for this functionality. We don't make a lot of changes so it wasn't really needed. We occasionally pull reports to provide insights into changes, but if we didn't have the capability we would be okay doing it manually.

ManageEngine ADAudit Plus User Behavior Analytics

Again, not really something we focus on. We have better measures than session length, login and logout times and file activity to evaluate users. Once or twice we have used the data as quantification for other employee actions.

ManageEngine ADAudit Plus Security Objectives

Does what it needs to do -- but ManageEngine really just provides reporting on events that have already happened. It's useful for trends and reporting but does not (is not designed to) provide active threat mitigation.

No. We don't use ManageEngine for any real-time activities. The system is to look at long-term trends and evaluate potential threats. ManageEngine has no ability to stop threats in real-time -- and by the time we'd look at a report it, the damage would be done.

Alternatives Considered

Splunk Log Observer

Choice for ManageEngine was made on support, ease of implementation and cost. We were looking for a monitoring solution that was on premises and cost effective.

Support Rating

Super eager to help and prompt call backs and support. On nearly every case the support rep offers to remote in and help you fix it. This is much faster than describing the issues back and forth in emails. Minor downside is that most reps are not native English speakers (we are in the US) and are difficult to understand.

Key Insights

Do you think ManageEngine ADAudit Plus delivers good value for the price?

Yes

Are you happy with ManageEngine ADAudit Plus's feature set?

Yes

Did ManageEngine ADAudit Plus live up to sales and marketing promises?

Yes

Did implementation of ManageEngine ADAudit Plus go as expected?

Yes

Would you buy ManageEngine ADAudit Plus again?

Yes

Likelihood to Recommend

ManageEngine is mostly a "check the box" solution for SIEM systems. We needed something that satisfied our customer and was cost-effective. I would highly rate the system on "worth what paid for". Support is eager to please and prompt. My only issue is that it's mostly based outside the US with helpful, but non-native speakers so it's hard to understand them. I wish they would spring for better help "phone lines" so I'm not dealing with difficult to understand and unclear speakers.

ManageEngine -- Gets the job done!

Overall Satisfaction with ManageEngine ADAudit Plus