SIM/Net Management Combo on Tap

eIQnetworks on Monday will roll out a combination security information management (SIM)/network management platform that aims to bring the two worlds closer together, Dark Reading has learned.

The eIQnetworks new SecureVue software's arrival is timely: SIM technology is not only integrating more closely with traditional security tools, but it is also in the early stages of blending with traditional network operations tools, according to a new report by The 451 Group. (See Report: SIM Market to Heat Up and Blurring the Line Between SOC & NOC.)

While most organizations have no intention of combining their SOCs and NOCs, many are feeling pressure to get the two to communicate and share information better, often for compliance reasons. But integrating these traditionally separate worlds with their point solutions isn't easy -- it can be a costly, manually intensive task just to get to the bottom of a network event.

"There is too much time and money today spent in integrating these products," says Vijay Basani, co-founder and CEO of eIQnetworks. "Our goal is to define the incidents and necessary data to get to the bottom of an issue very quickly, with an overall cost benefit."

SecureVue encompasses SIEM, asset, configuration, performance, and vulnerability assessment functions, the company says. The SIEM features include real-time views of log management and forensics, and the asset and configuration components handle the typical management of hardware and software, as well as configurations for change control best practices. There is a performance analytics, and a vulnerability assessment piece centrally manages vulnerability scanners such as eEye Digital Security's Retina, ISS Scanner, and Nessus.

IPkey, a managed security services provider for small- to medium-sized businesses, has been beta-testing SecureVue and plans to purchase the tool. The company is looking at whether the multi-function product can replace its IPSwitch WhatsUp Professional network management tool, too.

Marcus Clarke, president of IPkey, says the possibility of consolidating the company's separate security and network management systems is attractive. "If we had a worm attack, for example, and we saw large amounts of bandwidth from a particular server of PC, we can't correlate those things automatically right now," he says. "SecureVue would let us do that."

Another benefit would be reducing the manpower it takes to run IPkey's redundant, co-location sites with two tools. "We have two separate physical facilities, so we double everything we do." And IPkey's technicians have to integrate any security and network issues "in their heads" now, he says, so the integration would save on manpower as well. IPkey runs eIQnetworks' Security Analyzer for monitoring security events.

"Correlation is a biggie for us," Clarke says. "That would give us the ability to develop some intelligence in our software and systems."

SecureVue is now shipping and runs on Windows and Linux. The central server component doesn't yet support Linux, but the regional and collection servers do. Pricing starts at $49,000.

— Kelly Jackson Higgins, Senior Editor, Dark Reading