|
SIEM
Sentinel 6.0
REVIEWED BY BRENT HUSTON
Novell
Price: Starts at $65,000
Novell, which acquired Sentinel, its entry into the SIEM market, from e-Security last year, offers a robust product that is getting better with each revision.
Sentinel has many parts, and could take quite a bit of work to set up in a large environment. The setup isn't necessarily pain-ful, but there are steep system requirements, which may not be an issue for enterprises.
In a large environment, Novell recommends each component be installed on a separate machine for maximum performance. Setting up collectors, which gather data from devices and convert it to the Sentinel event log format, takes some work, but it pays off in the end in the breadth of device support.
For test purposes, we installed them on the same machine. Sentinel supports a variety of platforms, such as Linux, Solaris, Windows and databases, including Oracle and Microsoft SQL Server.
Control Center is the front end to the brains of the operation, and where most of the time will be spent analyzing data and events. Sentinel manages to display copious data in a logical GUI.
Nonetheless, Sentinel's interface can be somewhat intimidating at first, because you have to deal with so many pieces and so much data. It's tab-based, with a navigation toolbar on the left that changes depending on the tab you are in.
|