What advice do you have for others considering Securonix Security Analytics?

This is a solution that will help you a lot in hardware processing and in optimizing the time it takes to review events, which is what admins often spend their time doing. There are things on the network that you can't see with traditional tools. There are tools that don't give you the visibility that Securonix gives you. Foreign Language: ----------------- (Spanish) ¿Cuál es nuestro caso de uso principal? --------------------------------------- Hemos personalizado los usos de la plataforma para nuestro beneficio. En general, lo usamos para intentos de acceso fallidos, problemas de red y permisos/bloqueos, y tenemos casos de uso para plataformas como Windows Server. Somos una empresa de servicios y socios de varios proveedores. Brindamos soporte a los clientes. Nuestra estrategia es que cada equipo vendido a los clientes venga con un servicio de valor agregado, y Securonix protege a nuestros clientes. ¿Qué es lo más valioso? ----------------------- Para optimización y análisis de datos tiene un buen motor de evaluación de reincidentes y eso nos ha ayudado a detectar, a tiempo, lo que otros SIEM básicos no detectaban. Esas otras soluciones necesitaban más tiempo para detectar al mismo nivel. ​​Podemos personalizar nuestros casos de uso con las herramientas proporcionadas por Securonix. Es una excelente herramienta que puede ingerir datos de diferentes maneras y es muy flexible. ¿Por cuánto tiempo he usado la solución? ---------------------------------------- He estado usando Securonix Next-Gen SIEM durante un año aproximadamente. ¿Qué opino de la escalabilidad de la solución? ---------------------------------------------- El escalado es flexible. Si nos quedamos cortos en términos de EPS, simplemente aumentaríamos el EPS. Y si el servidor RIN tiene pocos recursos, al ser una máquina virtual podríamos aumentar los recursos según la cantidad de datos. Es una excelente opción para la nube en términos de escalabilidad. Es flexible tanto para nosotros como para nuestros clientes. Tenemos planes para aumentar el uso para ciertos clientes. ¿Cómo son el servicio de atención al cliente y el soporte? ---------------------------------------------------------- El soporte es excelente. A nivel de servicio nos atienden rápido. Contamos con una persona de post venta que da seguimiento en algunos casos. También puede ver los tickets y puede escalar algo según la urgencia. ¿Cómo calificaría el servicio y soporte al cliente? --------------------------------------------------- Positivo. ¿Qué solución usé anteriormente y por qué cambié? ------------------------------------------------- Usamos un SIEM tradicional donde todo era muy manual. No tenía inteligencia de amenazas o búsqueda de amenazas de compromisos, mientras que Securonix tiene esas características. Cambiamos porque queríamos una buena herramienta para automatizar ciertos procesos manuales para que todo sea más flexible. Con Securonix, tienes la opción de integrarte con otros servicios de indicadores de compromiso, y eso ayuda a crear una plataforma más poderosa y eliminar los falsos positivos. ¿Cómo fue la configuración inicial? ----------------------------------- Comencé el proceso de diseño y continué con la incorporación e implementación. La implementación inicial fue simple, pero tuvimos algunos retrasos porque teníamos nuevas soluciones y tuvimos que crear nuevos modelos. Pero, en general, si tiene soluciones tradicionales que tienen un modelo creado, es fácil de implementar. Tardaría una semana.\ En cuanto a nuestra estrategia de implementación, la herramienta que teníamos anteriormente tenía una funcionalidad de reenvío, entonces lo que hicimos fue desplegar información al RIN y de ahí enviamos la información a la nube. Después de eso, creamos una canalización y enviamos el resto de los eventos para que pudiéramos sacar de producción el SIEM anterior. Las fuentes tardaron un mes en incorporarse. Nos tomó un mes tener acceso a los equipos porque no administramos ciertos equipos. Fue un proceso burocrático.\ Securonix hace el mantenimiento. No requiere trabajo de nosotros. Nos envían correos electrónicos que indican que el sistema se reiniciará brevemente y normalmente no tarda mucho. ¿Y el equipo de implementación? ------------------------------- Contratamos a un ingeniero de incorporación de Securonix que nos ayudó con la implementación del RIN. Nos explicó el proceso hasta que entendimos todo. Nuestra experiencia con el ingeniero de incorporación fue buena. Nos ayudó con cualquier pregunta que tuviéramos y nos dio seguimiento a través de correos electrónicos. Para la implementación de Securonix, solo necesitábamos una persona de nuestro lado. Yo era el punto de contacto con nuestras otras áreas. ¿Cuál fue nuestro Retorno de Inversión? --------------------------------------- Donde vemos nuestro mejor retorno de la inversión es en el tiempo y la mano de obra que ahorramos. Antes de Securonix, nuestro personal tenía que investigar eventos constantemente. Ahora, un ingeniero con algo de experiencia es suficiente para acelerar las cosas y dar tiempo al resto de los administradores para hacer otras cosas. ¿Cuál es mi experiencia con los precios, el costo de configuración y las licencias? ----------------------------------------------------------------------------------- El precio está bien en comparación con el mercado, pero creo que en algún momento los competidores alcanzarán el precio. Sería bueno que, por ejemplo, hubiera una opción para ofrecer a los clientes que han utilizado la solución durante más de un año algún tipo de servicio adicional. No hay ningún costo fuera de la tarifa de licencia estándar, aparte de un cargo por servicio de instalación inicial. De lo contrario, simplemente hay un costo mensual por el servicio. ¿Qué otras soluciones evalué? ----------------------------- Estábamos pensando en Splunk, QRadar y Rapid7. Uno de los inconvenientes de esos sistemas sería la infraestructura. Muchas de las otras plataformas, incluida McAfee, necesitan cajas o servidores de implementación en nuestra infraestructura o en las infraestructuras de nuestros clientes y, en muchos casos, la infraestructura crece continuamente. Con Securonix, eso no sucede. Es una solución en la nube que solo requiere un pequeño servidor de implementación con pocos recursos, dependiendo de cuántos eventos se reciban. Y toda esa información también se almacena en la nube. El costo, en comparación con otras soluciones, es mejor. Comparado con otras plataformas, es muy simple pero, al mismo tiempo, es muy eficiente porque empaqueta la información en un vistazo. Después de eso, le da la opción de cazar amenazas y eso puede iniciarse en el tablero. Es muy intuitivo. Una persona que tiene cierta noción de ciberseguridad puede moverse rápidamente ya que te da información sobre cualquier ataque. Te da un resumen y te da enlaces para recibir información. Y si no tienes mucho conocimiento de la herramienta, siempre puedes tomar los cursos que están gratis en la web. Hacerlo nos ayudó a comprender la solución. ¿Qué otro consejo tengo? ------------------------ Esta es una solución que ayudará mucho en el procesamiento de hardware y en la optimización del tiempo que lleva revisar los eventos, que es a lo que los administradores suelen dedicar su tiempo.\ Hay cosas en la red que no puedes ver con las herramientas tradicionales. Hay herramientas que no te dan la visibilidad que te da Securonix.

When we started, there were a lot of false positives. Now, the amount of false positives has been reduced. It is much better than before. I would definitely recommend this solution to others. I would rate Securonix Next-Gen SIEM as nine out of 10.

It is a good solution, but it definitely requires some improvements. It has already improved a lot. They are upgrading it in every build, and it is getting better. They work on policy decommission. Whenever a policy gets old or replicated, they remove the policy. They work on the content refresh. For example, last year when we had the Log4j vulnerability, they immediately updated their content and applied the policy. They provided an update for the Log4j vulnerability. I would definitely recommend this tool. It is really a good tool. It has all the features available. I don't know anything about the pricing. I don't know if it is more expensive or cheap as compared to the other tools, but as a UEBA tool, I would definitely recommend it to everyone. Overall, I would rate it an 9.5 out of ten.

I would rate this solution a nine out of ten. My advice is to get a proper idea of the tool you are working on and be sure to read the documentation.

I would advise having a look at it. The user experience or the user interface is definitely better than other tools, but you need to see how it interacts with your data sources and how easy it is to integrate it with those data sources. It took us at least four to five months to realize the benefits of the solution from the time of its deployment. It depends on the log sources you are concentrating on and want to fine-tune. Most SIEM tools, including Securonix, have a lot of use cases that can be tied to Windows, VPN, etc. Modifying and tuning just one log source is not enough. You should tie different log sources so that you get an idea about any lateral movements. Everything that flows into a SIEM solution has to be tuned. If I'm sending a raw log in any format, it needs to be properly sanitized and tuned for my security requirements, which takes time. We had to go back and forth and get a lot of things fixed. It takes a while for the tool to understand and start triggering based on a specific activity. False positives will always exist. They won't completely go away. When we first deployed it, it used to trigger alerts for 500 to 600 users, which had come down to 20 to 30. It needed continuous fine-tuning, but as an analyst, I was no longer overwhelmed by hundreds of alerts. It took a while to get to that stage and involved a lot of blacklisting and whitelisting. Even though the false positive rate had come down to a pretty good number, we still had to intervene and verify whether it was a false positive or not, but it was easier to do. It hasn't helped to prevent data loss events, but it has helped to reduce further loss of data. We got to know about an event only when it had already started to happen. When the tool identified that something was happening, it would alert us. If an analyst was active enough to understand that and put a stop to it, it could have prevented any further loss, but I am not sure how much a data loss event would have cost our organization, especially in intellectual property. However, we figured out that about 40 to 50 GB of data was sent over a period of time. It was sent in small bits, and it included confidential reports, meeting keynotes, etc. We would not have known that if the tool had not notified us. I would rate it a 10 out of 10 based on the experience I had. We didn't have any major issues related to slowness or querying the tool. Querying was pretty simplified, and there were also documents to know the processes. Their support was good, and they were also good in terms of the expansion of the tool. When we wanted a new data source, they were there to review it and modify it with us. They provided good assistance.

According to my clients and the security world, I cannot eliminate all the false positives because you cannot let false positives go. You need to make sure that there are no attacks attached to that false positive. So, we have a team of analysts who monitor it every time. So, if a false positive policy gets an alert, then we just go ahead and make sure to analyze it. That is okay. If it is a false positive, then we mark it as one. We did eliminate a lot of false positives, but not all of them. It is our choice, not Securonix's, what we want to keep or eliminate. I would rate Securonix as nine out of 10.

Our clientele includes small and medium sized companies, not enterprise. I rate Securonix Security Analytics as an eight out of ten.

We tried to implement it and we've taken it out. We've tried it with two clients, it failed, and therefore we moved them now to QRadar. It was terrible. It offered bad support and was a bad product, and everything that was promised wasn't able to be delivered. We canceled our partnership with them, and we've actually reverted the two clients that were supposed to go onto the Securonix, on to QRadar now. We were trying to onboard two customers, and we ended up implementing this solution with neither of them. I'd rate the solution at a five out of ten.

I would say Securonix is a nine out of 10. The core functionality is the best that I've seen in the market. Being able to execute on ingesting logs, building alerts, looking at anomalies, providing fast search, and being able to provide an extensive history available to search is a huge win for us. We're often investigating stuff that happened a long time ago. The only thing that we could work on is the user experience when doing threat-hunting, and they've been open to looking at that and exploring options. So I think that will improve also.

I would rate the product at eight out of 10 right now, because there are scopes for improvement, operationally as well as technically. But they have definitely come a long way in a very short time, so I really give them eight-plus. There's definitely some scope for improvement operationally, and there are some technical features which need to be added.

On a scale of one to ten I would rate Securonix an eight.

I'm not an engineer, I'm a consumer of the tool. It's doing what it's been asked to do. It's really all about use cases and having the data. You have to have your use cases well-defined and make sure you can feed Securonix the data. You should definitely do a PoC. Never buy anything without checking it out first. I wouldn't say the solution's behavior analytics has helped to prioritize advanced threats. Regarding the Hadoop piece, I would compare it to the way I drive a car. I put gas in it and I don't care what kind of engine is in there, how the engine works. I just turn the key and the car starts. The users are our security operations team, which has about a dozen people. We use it on a day-to-day basis. We'll increase the use cases.

From a positive standpoint, with Securonix, or with any UEBA vendor, but specifically Securonix as that's the one that we're using, it definitely overcomes a lot of the challenges with trying to understand what's normal and what's not normal in an environment. With the traditional SIEM rules, it's very difficult to tune some of the policies to understand what is normal for your environment. That's really helped us quite a bit. Another thing that might be helpful regarding understanding the platform is that it takes a little bit of time to come up with the behavior profiles. It might take 30 days, depending on what you're trying to look at, before you start seeing some alerts trigger, because you're looking at things over a longer period of time. The biggest lesson I've learned using Securonix is that with behavioral analytics, and any UEBA vendor, it does reduce some of the alerts but it also has the potential to create additional volume or additional alerts, which could be good or bad. So just understand that there definitely is the potential to get a lot more security alerts as a result of using the product. The way we try to work around the increase is through the ability to tune some of the policies to remove some of the few things that produce known noise. The biggest thing is just tuning things out, where applicable. Another is by leveraging their threat models. Correlating several different policies together, which are part of a threat model, might provide a little bit more context. As an example, if two of these three policies fire within a certain period of time, it might be a little more interesting than just, say, this one stand-alone policy triggering by itself. The behavior analytics probably doesn't help us to prioritize advanced threats. It's just the nature of UEBA, I don't think it's necessarily a reflection of Securonix. But one of the challenges with being able to detect a lot of rare activity or anomalous activity is that you tend to find there's a lot more rare stuff happening in your environment than you would expect. It helps us, but sometimes it has the potential to create a little bit more noise as well. With SNYPR, they have what's called SNYPREye which monitors the cloud solutions of SNYPR to detect if there is any type of operational issue. We have five people on our team who use Securonix. They're security threat analysts. They all have the same feelings that I do: That it's very helpful with security monitoring, and that it also provides threat-hunting and investigations on users. We have shared roles, so I wouldn't say we have dedicated focus on just Securonix. We're a small team that does a little bit of everything. At a minimum, if we didn't have that shared focus, maintenance of Securonix would take one full-time resource.

If you're looking for an analytics-based system, which is what everybody should look at, and if you are thinking of something that provides a quick return on investment, then you should definitely look at Securonix, in addition to doing your due diligence with other products. Definitely have Securonix in the mix if you're looking for actionable threats, flat pricing, and a cloud-based solution. The biggest eye-opener is how wonderful the cloud environment is. There is a whole new universe of threats that get exposed by moving to the cloud. It has all these benefits, but it also reveals a lot of risks. So there's a lot of work. Businesses will continue to adopt the cloud, and security has a lot of catch-up work to do to secure data in the cloud. But Securonix is bringing those issues to the front and we are coping with them, one thing at a time. This is our single pane of glass for monitoring threats to our environment. It's being used companywide for monitoring purposes. It's our 24/7 eyes on glass. There are certain applications that we have not integrated yet and there are new applications that we continue to onboard. As we grow, and as we bring in more devices, we will want to integrate them into this platform. It is always a work in progress. Our analyst who goes in and looks at the threats is the primary user of the system. There are also secondary users. For example, the compliance team looks at all the compliance reports that they need to meet the requirements we are bound by. They have their own use-cases that they look for. As the CTO, I have dashboards that I look at to monitor the overall health of our security posture. We also have investigators who look at specific investigations. If there is something that involves HR or our legal team, that becomes a case that we need to track. From a deployment perspective, we had one person working part-time with the Securonix PS team for the first four weeks. After that, Securonix went away and that part-time resource continued to work on it. The part-time resource for deployment is a point of contact for Securonix. We need to send them data. We can tell them, "Hey, these are the data sources that we want to prioritize," in the first four weeks, for example, and this is the data we are going to send you. This person is the point of contact for them to coordinate with our internal teams to make sure the data is fed correctly and that we have scheduled the imports, etc. In terms of maintenance, there is none for us because they do it.

The biggest lesson we have learned from using Securonix is to start small. Don't throw everything at it. Start with one single use case and build out. Don't throw all the use cases into it at once. Otherwise, it's too much work, you get flooded with too much data, you can't focus on what's important, and you can't clean it as quickly. You can clean it, but it will take a lot of time. My advice is to go with the cloud solution and, as I said, start small. Don't try to ingest everything at once. And don't create use cases for everything under the sun. Because we're on-prem, we've had to both focus on threats and on the engineering of the platform. They provide support, but we still have some engineering overhead on our side. We have five users using it and they're all investigator-analysts. We deployed with the help of four people who are security engineers, and maintenance is pretty much done by the two Securonix support people we have. Overall, I would rate Securonix at eight out of ten. We're still going through it, developing, learning, and we find issues.

The single thing I recommend most is understanding your environment and being able to articulate the risk and threat models. Securonix is very good now, better than when we first bought them, because we were early adopters. We're in the pharmaceutical space and they didn't have very many Pharmas. They were very good at financial institutions, the banks, the credit card companies and that sort of data, but when it came to risk and threat models for Pharma, we were so successful because we knew what we wanted. I had studied insider threat and behavior analysis for quite a while before we brought in Securonix and was able to start out with very accurate models and articulate things like the relationship between sender and recipient of emails. Is there generally a higher risk with one-to-one or one-to-many relationships on either side? If the data is in the body of an email or in an attachment, which is more important to me? Different models, like competitor domain or personal domain, or USB use: What are the most important things to know about your own environment? Be able to tell them in a way that helps them build the risk models. Probably in some environments, again, finance for example, where they've had years of experience, they could probably plug in a box and you could just throw all of your events at it and it would be accurate in at least pointing out the anomalies. But you would still need to be able to say what, in your environment, is bad and what is not. That is the single biggest thing: Know your own environment and they can build it to match your needs. The biggest lesson we've learned using Securonix, in hindsight, is that if we had paid the additional $45,000 to start with, in the cloud, we would have been years farther ahead. We're trying to stay very low-budget. We built the on-prem version and thought that was going to be sufficient, but we ran out of space and the ability to add new data sources and risk and threat models. The on-prem version became limiting. The biggest lesson we learned was that we probably should have spent what was not a lot more money and had the cloud, Hadoop-based version, much earlier in the game than we did. If I had a big enough staff, it would probably be preferable to do some of the back-end, hands-on coding ourselves, but I don't have that kind of talent on hand. Outside of that, we have no complaints about it. When we've asked them to make certain changes to the user interface or to workflow within the tool, they've been very quick to respond and make those subtle changes for us. Outside of that, we're fairly pleased with this platform. We have three intelligence analysts and they look at the events themselves, do the initial assessments, and write up the cases. I direct the team and I have one technical lead. I'm in the compliance division, so my team monitors for compliance with specific corporate policies. In addition, our IT department recently also purchased Securonix and they're building a platform on software risk to complement the insider threat that I have. There are currently five users there. The Securonix team does all of the back-end work because it's housed entirely in their cloud. Overall, I would give Securonix a ten out of ten. We've been extremely happy with them as a company and as a product. The product has been very good for my career. But again, we put the time into making it accurate right from the start so we have found some fairly significant things. I feel the product is accurate. Whenever we have worked with the company, they've been a good bunch to work with. I'm happy to stand up on their behalf. It's been a true partnership with Securonix, more than that we just license their product and use it.

My advice is that you should want the new, best product. I don't want to say there is no other way, but it scales and it works. If you don't have the manpower, if you don't have the technical skills to have it deployed on-premise and manage - like us, we did not - I would definitely recommend going SaaS. The cloud-offering is a game-changer. It would have been tough for us to deploy Hadoop on-premise and manage it and maintain it. We're not mature enough to handle Hadoop. So I would definitely recommend SaaS to anybody who's looking that Securonix. The other thing I would recommend is monitoring cloud if you're going with SaaS. We didn't know there were so many things to a monitor in our cloud infrastructure until we actually started monitoring it and figuring out the monitoring gaps. Most of our security is running on Securonix. It's the backbone of our security so we are running quite a lot on it. We do plan to expand it. We are planning to see if it makes sense to add app data on it. We don't currently have a lot of application data flowing in. We have SAP and other applications that we are looking to add to this. We are also looking at if it makes sense to explore a little bit more on the network analytics side. One of the key things they have improved on recently, when they moved from version 5 to version 6, is that version 5 was not scalable. It was running on a relational system and it was also a little complex to manage and run. Version 6 is a lot smoother and has a much better user interface. There is less operational overhead, because we don't have to manage it, at all. It's completely remotely managed. We have six or seven people, specifically, who log in to the solution, not all at the same time. They are actively using it. Their roles vary from SOC to insider threat. We also have our response guys who log in, and then we have about two people who take action on threats. In terms of deployment and maintenance, this is all SaaS. In 5.0 we had about one to one-and-a-half people dedicated to it, but now we don't have any dedicated people. We just have one point of contact available on our ops side to look at any issues with the collector or if one of our data feeds has any issues. Again, it being SaaS, we have no administration overhead. The tool has matured and it has definitely helped our program mature over time.

The best advice is to make sure that you understand your use cases. For example, we said we want it to trap a high number of downloads, we want to see if people downloaded and then emailed out any of the objects. We came up with the use cases of what we wanted to check for even before we started our implementation. Then the Securonix people were able to better set up the individual threats that we were watching for. The other thing that we do is we categorize our data. We say a given type of intellectual property is high, medium, or low. That way we know what we really want to protect. Somebody taking a nut or a bolt isn't the same thing as somebody taking a turbocharged engine and trying to sell it to somebody. It took us a while to actually come up with a standard for categorizing and then to actually categorize, because there were millions and millions of objects or drawings that we needed to classify. That was a project in and of itself. We did that before we did any kind of analytics with Securonix. The first thing we did was classify our data. When I took this role, they said, "Hey, we want you to protect our high IP." So I smiled and said, "So how can I tell what the high IP is?" And they said, "Oh, well it's in this folder." I said, "What happens when it's out of the folder? How do I know?" I wanted it so that the data could always tell me it's IP level, regardless of what folder it was in or even if it was out on someone's desktop. That's why, to me, that's the first thing that you need to do. Because otherwise, it's just hearsay in terms what's important to protect. If it's important to protect, label it and then we'll understand. We look for ways for us, and for the system, to improve identifying things. For the majority, we've been happy for what's there. With typical software you run into software issues that might slow you down and you have to get them fixed. They've been very good about resolving issues when we find them, especially because we find stuff that is pretty unique because of what we're doing with application monitoring. It's so specific and it's really customized for how we've set this up. There are just a handful of users of the solution. I'm the main one who works with the consultants. Otherwise, it's a group of just under ten people who are even able to get into Securonix and look at the information. Like me, most are in IT. There's one person in insider-threat security who helps with coordinating investigations. There's also someone on the business side, even though he is, in a way, more IT-related. He works for the engineering standards group on the business side. In terms of deployment and maintenance of the product, we certainly rely on the Securonix folks. There was one main person we used for the deployment of Securonix. Sometimes that person had a second, and I was involved as well. Only three people, from our side, were involved in the actual deployment, although I needed people to write the query to ingest the data. But once that was done, I didn't need those people anymore. Maintenance is done by me and the Securonix consultant. Since it's a SaaS environment, I have no idea how many people they have on their side, making sure that the system's working fine. For what we're doing and what it can do, on a scale of one to ten, I would put it in the nine to ten range. The only reason I wouldn't say ten is that means it's always perfect. There are always issues. But I'd say it's at least a nine.