| Feature Description |
ManageEngine EventLog Analyzer
Try now |
Elastic Stack |
| Log collection |
| Agentless |
|
|
| Agent-based |
|
|
| Cross platform log collection |
|
|
| Heterogeneous server/ device support |
|
|
| Import logs |
|
|
| Periodical import of logs |
|
No sufficient information |
| Log filter |
|
|
| Custom log parsing and indexing |
|
|
| Log collection and processing rate |
20,000 logs/second with peak event handling capacity up to 25,000 logs/second. For Windows event logs the EPS is 2000 logs/second. |
No sufficient information. |
| Log formats supported |
| Windows event log |
|
|
| Syslog |
|
|
| Any format – with custom log Parsing and indexing technology |
|
|
| Amazon Web Services (AWS) EC2 Instance |
|
|
| Application logs supported |
| Proprietary applications [Microsoft IIS Web Server, FTP Server (W3C logs), Apache Web Server, DHCP Windows, DHCP Linux] |
|
|
| Database applications [Oracle Audit, Microsoft SQL Server] |
|
|
| Any application – with custom log parsingand indexing |
|
|
| Other devices supported |
| Custom devices [IBM AS400 (iSeries), VMware] |
|
|
Custom devices
- Firewalls
- Intrusion Detection System/ Intrusion Prevention System (IDS/IPS)
- Anti-virus application
- Mail and web application
- Vulnerability Scanners
- Unified threat management solutions
- Symantec DLP Application
- FireEye
- Symantec Endpoint Solution
|
|
|
| Alerts and notifications |
| Real-time alerts |
|
|
| Notification – email and SMS |
|
|
| Run automated scripts as alert response |
|
No sufficient information. |
| Compliance alerts |
|
Not readily available. Can be built. |
| In-built incident management module |
|
No sufficient information. |
| Create tickets for incident in external help desk software |
|
|
| Threat intelligence |
| Real-time alerts for global blacklisted IPs intruding the network. |
|
|
| Advanced threat analytics that provides more information on the malicious source, type of threats, and more. |
|
|
| Reports |
| File integrity monitoring |
|
|
| Canned reports |
|
|
| Custom reports |
|
|
| Scheduled reports |
|
|
| Report distribution via email |
|
|
| Reports in PDF, CSV and HTML formats |
|
|
| Drill down to raw logs |
|
|
| Filter using mouse gesture |
|
|
| Management specific reports (Ask ME) |
|
|
| Trend reports |
|
|
| Privileged user activity monitoring reports |
|
|
| Log search |
| Advanced search using Boolean, wildcards, grouped search, range search, phrase search |
|
|
| Formatted log search |
|
|
| Raw log search |
|
|
| Save search result as report and as alerts |
|
|
| Compliance reports |
| Canned reports |
|
|
| Customizing existing report |
|
|
| Creating new compliance reports |
|
|
| PCI-DSS |
|
|
| HIPAA |
|
|
| FISMA |
|
|
| SOX |
|
|
| GLBA |
|
|
| ISO 27001 |
|
|
| Real-time event correlation |
| Event correlation |
|
|
| Field-level filters to build correlation rules |
|
|
| Pre-defined rules to detect various attacks, including ransomware, brute-force and more. |
|
|
| User session monitoring |
|
|
| File Integrity Monitoring |
| Reports on file integrity monitoring |
|
|
| Report scheduling |
|
|
| Real-time alerts when critical changes are made to files/folders that are being monitored |
|
Not prebuilt. Can be created. |
| Audit trail of file/folder changes |
|
|
| Log archiving |
| Flexible periodicity |
|
|
| Flexible retention |
|
|
| Secured (Encrypted) |
|
|
| Tamper-proof |
|
|
| Service provider features |
| User based views |
|
|
| User based dashboards |
|
|
| Rebranding |
|
No sufficient information. |
| User management |
| Realm and user-based access |
|
|
| Active Directory (AD)-based user authentication |
|
Not prebuilt. Can be configured. |
| RADIUS server-based user authentication |
|
|
| Implementation |
| Easy to install |
|
|
| Web-based client |
|
No sufficient information. |
| Appliance-based |
|
No sufficient information. |
| System requirements |
| Bundled database (PostgreSQL/MySQL) |
|
No sufficient information |
| Windows & Linux platforms support |
|
|
| 64-bit support |
|
|
| Pricing |
| Pricing basis |
Based on the number of servers, devices and applications. |
No sufficient information. |
| Annual licensing model |
|
No sufficient information. |
| Perpetual licensing model |
|
No sufficient information. |
