SolarWinds Security Event Manager Reviews

We use SolarWinds as a kind of SIEM solution, so I don't have other additional security needs. Lately, we've been exploring other solutions. We are a Managed Security Services Provider, and we have nine people predominantly working on that solution. We also have team members who work on multiple solutions.

Lately, all of the solutions continue to improve, so I believe SolarWinds will also improve. But all the solutions need to have the same features, so I don't see any specific feature that needs to be more user-friendly. There is no unique element that makes SolarWinds better than the others.

SolarWinds should improve its correlation capabilities. The correlation does not automatically detect and reduce the events fast enough. You have to manually do a correlation report, which means the tool is not scalable in many ways. Another area that needs improvement is the integration of the IT framework. We are automating the framework using their tools. I think that automation will help.

We've been using SolarWinds for three years.

SolarWinds' stability is fine. I don't think we've had any software issues.

There are some scalability issues with SolarWinds. For example, whether it will be on-prem or on the cloud, there are several things we have to leave with the integrators. Many solutions are integrated. SolarWinds is not convenient enough to meet our current needs and it requires an upgrade, but I'm also thinking about some others. I believe that Azure is doing well as a cloud tool right now.

We're not happy with SolarWinds' support.

Whether SolarWinds is easy to set up depends on what you're doing. Before a technician did the implementation, someone had been tweaking and operating. However, the tool does not support many things or have much to offer.

Licensing cost it's an issue with SolarWinds. 

I rate SolarWinds six out of 10. Comparing SolarWinds with Azure, it seems like Azure can do much more, so we are considering switching to Azure. If you are thinking of adopting SolarWinds, I would suggest considering what your business needs. Every business has different requirements. For example, if you're an IoT guy, you don't need tools that will help you with your IT environment. If you're in the manufacturing or oil and gas industry, you have a combination of IT and IoT, so then you'll go for something that fits those needs. 

I basically use it to look at the logs that are coming in, analyze those logs, and get recommendations of where we have problems.

It has in-depth monitoring capabilities and an easy way for setting up dashboards. I can expand in various areas, or I can reduce areas. It supports different types of breakdowns, filters, and rules. 

It is very simple for an out-of-the-box type of product. It doesn't take a lot of time to figure it out, which is unlike some of the solutions that I have looked at. It meets all the aspects.

Under the new system, it is not upgradable the way they say. When you try to do an upgrade, it doesn't really work unless you dump everything and start from scratch. You lose a lot of your nodes. Whenever you set your nodes up and everything else, they don't want to bring those nodes back in, so you have to really go back and restructure all your nodes. I went from version 6.5 to version 6.6 and then to version 6.7. I then went to version 2019, and now it is version 2020. It would be good if we can upgrade without having to delete everything and start from scratch.

They can maybe build more KPIs and other things for the dashboard. Some of the other systems already have built-in KPIs. SolarWinds is starting to catch up, but it is not there yet. They can include some of the business or industry standards for tracking the time, that is, the meantime to detect (MTTD) and the meantime to resolve (MTTR). They can also find a way to build a KPI that measures the number of instances of port scans experienced in a week or a month.

I have been using SolarWinds LEM for a year and a half.

It is stable.

It is scalable. Altogether, we have about five actual users. I got myself as the administrator, and then there are a couple of people who do the monitoring. I have got 2,000 systems listed on it.

In terms of a team, I would say you need at least three people for what I am doing. I am using the key research logs and pulling data from these logs. For one person, it takes a lot of time to do what I am doing right now.

I am very satisfied with their technical support.

I had another system, but I wasn't happy with it and its service and support. We just let it go.

The initial setup is straightforward. The actual initial installation is not a problem. The problems come when you do your upgrades with it.

It took about a week to set it up and get all little things going in the way I wanted to. To make sure that correct data logs are going in, I tweaked some of the rules and filters and the domain across the net with individual systems.

We originally started out with the seller, but when we did the first upgrade, it didn't go the way it should. From that point, I set it up from scratch and did the upgrade. At that time, it was version 6.6.

It is in the appropriate mid-range. It is not as expensive as some of the other solutions. It is also not cheap.

I would recommend SolarWinds LEM. We plan to continue using it. We have already put in the Orion platform system and brought it into play. We are next looking at the server access management. That probably would be the next step to implement.

I would rate SolarWinds LEM a ten out of ten.

The primary use case is for privilege account monitoring. It's monitoring admin accounts for things such as who logged in, where they logged in from, what time they logged in, and from what devices they used Remote desktop, with the privileged accounts.

It's a good tool to do troubleshooting, you can see extensive Info about Kerberos User Auth tickets or Windows Kerberos Machine Auth tickets, which can alert you to say , failing Kerberos Authentications due to incorrect NTP (Network time).

We're able to do a bit more in terms of forensic analysis.

I am able to correlate  the S.A.M. Service Applications Monitoring in SolarWinds ORION Platform.

I can trace back several things including the performance at a certain date and time. 

It's extremely easy to deploy.

The LEM 6.6, if it's a Windows host, you use the 64-bit or 32-bit installer, and  install it. Immediately, you'll start seeing Windows SYSTEM, SECURITY and Application Logs from the host where you deployed the Agent. So, this makes the deployment very easy to install.

On a daily basis, it's good for PKI monitoring.

It's very good for troubleshooting, and data monitoring. It gives you an advanced warning with your backups. If you have no monitoring tool in place, SolarWinds SIEM is a good place to start and very inexpensive.

They need to do better with the Connectors. I had to battle with the IIS Web server Connector that comes built in with this product. No matter how I configured the IIS Web connector, I never saw SW pull in any IIS logs from my hosts , where Agent was installed.?

They have over 500 connectors, but in my experience only handful work. Also there's no PowerShell Logging connectors, if you want to pull in PowerShell Logging logs from your hosts into the SIEM.

SolarWinds LEM is a product that I have been using for approximately a year and a half.

Very stable. It seems backend database is PostgreSQL and needs no maintanence.

Not very scalable in my opinion. That's why I'm investigating new SIEM replacement.

good. can be hit or miss sometimes, but sometime you get some good tech support over there.

With this company, there was no real SIEM and no real use cases before I deployed it. Because of that, I can develop the use cases the educate the management on what they need in terms of SIS security monitoring.

Very easy setup.

in-house.

very good.

Easy setup, very cheap and licensing cost is very fair and easy to understand

There was no time. Just read several reports from Gartner, IT Central etc. I did try ManageEngine , but it was a product which was already in Test phase implemented by my predeccesor

n/a

The tool would see all the events and be able to judge on its own which event was not a big deal. It also gives you insights, email alerts and app directory changes. 

The solution helps me to go back in time and search for different events. For example, if you wanted to know who activated an account; you could go back in time and find out.

The product should  improve the ease with which you can create event alerts. They are not as hard now but you need to have an easier way.

I have been using the product for ten years. 

It's good. I haven't had an issue ever with stability. 

I think the solution scales well.

The solution is easy to deploy. 

We have had ROI with the use of the tool. 

I would rate the solution an eight out of ten. It's a good tool for what it costs.

SolarWinds Security Event Manager is used for retrieving events and suspicious activities.

We are only studying the solution.

SolarWinds Security Event Manager has been generally working well.

I have been using SolarWinds Security Event Manager for a couple of months.

SolarWinds Security Event Manager is stable.

The scalability of SolarWinds Security Event Manager is good.

We might increase our usage of the solution in the future.

I have contacted the support from SolarWinds Security Event Manager and they are good.

The deployment of the solution took a couple of weeks.

The company had to use a third party for the implementation of the solution.

I have seen an ROI by using this solution.

The price of SolarWinds Security Event Manager is reasonable.

We have more than one person who does the maintenance of the solution.

I rate SolarWinds Security Event Manager a seven out of ten.

The initial setup is very straightforward and simple. 

It can scale quite well. 

The File Integrity Monitoring is great. In FIM, if you want to know who has changed a file, when that file was changed, et cetera, you have that visibility. You can make the reports from the console directly. That is out of the box. The report is there for you to use. The customization for the reports and alerts is also very easy. It helps maintain compliance and security. You also can easily analyze the logs as needed. 

This is a stable product.

It supports high availability, which is very helpful. 

It captures all of the requirements clients tend to need. It has everything. 

We'd like more customization capabilities. We need to post events on the end of the devices. Sometimes, the event does not respond. There seems to be a compatibility issue at play. For the customized UX, if you post events, there are compatibility problems. The OEM needs to work on that part.

I've been using the solution for six years. 

The solution is stable and reliable. There are no bugs or glitches, and it doesn't crash or freeze. 

Scaling is easy. You just have to add VMs. 

The support is good. Previously, the support was not good. However, they've improved it over the last two years.

2020 there was an attack on SolarWinds software. They had trouble then. Now, it is stable and the support is very, very good. They have expanded their offices all over the world. I am located in India. They have a branch here so we can deal with local people.

The installation is very easy. Even if you are non-technical, it's not an issue to get everything up and running. 

You only need maybe two people to monitor and manage it once it is deployed. However, if the environment is quite large, you may need more. 

If a person prefers to pay for a subscription, the cloud deployment is the way to go. However, they can also choose to go on-premises and have a perpetual license. I can't speak to the exact costs, as I am on the technical side. 

We compared the solution to QRadar.

We are partners. 

This can be deployed both on the cloud and on-premises. 

I'd rate the solution nine out of ten. 

We are using SolarWinds Security Event Manager for event analysis.

The most valuable feature of SolarWinds Security Event Manager is the analysis and the knowledge about the incidence that we trace.

I have been using SolarWinds Security Event Manager for approximately six years.

The performance and stability of SolarWinds Security Event Manager are good.

The scalability of SolarWinds Security Event Manager is good. 

We have approximately 500 users using this solution in my organization.

We used the support from SolarWinds Security Event Manager and they are knowledgeable but challenging to get in contact with them.

The vendor did the setup of SolarWinds Security Event Manager.

We used an integrator for the implementation of SolarWinds Security Event Manager.

I would recommend SolarWinds Security Event Manager to others.

I rate SolarWinds Security Event Manager a seven out of ten.

Our primary use case is analyzing log files from any kind of source which is IT related. We use the product in our company on a daily basis and also integrate it for others. There are four people in our company using this software, and it's part of their daily routine to check everything. We are consultans and a reseller of the solution. 

The most valuable feature of the solution is intuitivity of navigation; it's easy to build rules and actions which are based on the logs and event types we collect with the software.

Some things on the roadmap could be improved but I understand they're working on those issues. The main area that would mean a big improvement for me would be for the product to include multiple dashboards. I would love to see a multi-page dashboard where you could see information side-by-side; to slice through the dashboard to see specific topics. For example, one network dashboard, one active directory dashboard, one VMware dashboard, etc.

That feature is something they could include in the next release - the ability for a report to flip to different technologies. And it would be nice if there were some pretty configured templates for the dashboard so that you don't have to fill all the data in. For example, a template for active directory or KPIs, or a template for VMware KPIs.

We've been using the solution for about one year.

It's a very stable solution. 

Scalability is a plus with this software. 

Technical support is good, they've even helped us during the night because they're in a different time zone.

The setup process and determining all the log files from all the different systems is quite easy. However, to get all the information out of the log files and create rules and access based on the log files, means that it's sensible to hire consultants. The simple setup of the virtual machine takes about two hours and after that it really depends on the number of log files and the number of devices. You're looking at about half a day and you have pretty much installed everything. 

The setup cost is not as expensive as Splunk or many other competitors. Cost is dependent on the size of the company.

I would advise people to make themselves familiar with the SolarWinds work community which has all the users' comments and where you can get the newest topics about everything connected to the software. It makes sense to peek around there. There is also SolarWinds SCM online training which is a big help when getting started with the software.

The product fills all our requirements but there is always room for improvement and so I would rate this product a nine out of 10.