Vendor Landscape: Security Information & Event Management

Product Pricing Scenario
A mid-level retailer with corporate offices on the US west coast, east coast, and Ireland is looking to implement a SIEM solution. The company
employs 2200 people. The firm is interested in reducing the effort associated with monitoring, alerting, and responding to security events at the
Endpoint, Network, and Datacenter levels. The firm also has 100 retail outlets scattered throughout the US and Europe however all stores are
franchised and so out of scope.
The corporate office breakdown is as follows:
US West Coast (Head Office)
Employing 1600 people (70% of total staff), the west coast office holds Sales, Finance, Strategy, Marketing, Buyers, and the majority of IT. The
IT staff here consists of 45 employees, 3 of which are dedicated security professionals consisting of 1 Security Manager and 2 Security
Analysts.
US East Coast (Satellite)
Employing 200 people (10% of total staff), the east coast office holds solely Sales and Marketing department.
Ireland (Satellite)
Employing 400 people (20% of total staff), the Ireland office employs Buyers and Manufacturing and also a DR facility. Manufacturing consists
of 300 employees. The company’s remaining 5 IT staff are located here though none have dedicated security responsibilities.
The expected solution capabilities are as follows:
• The organization described in the pricing scenario is interested primarily in reducing the cost of demonstrating compliance with financial and
privacy-related regulations, enhancing visibility of typical external and internal threats, and simplifying the forensic effort associated with
event/incident response. Advanced persistent threats are a lesser, tangential concern.
• The anticipated volume & complexity of ad hoc queries against logged and correlated event data is fairly small, driven primarily by incident
response efforts and gaps (if any exist) in canned compliance reports.
• The SIEM product is expected to be used regularly by 4 IT staff (the Security Manager and 2 Analysts at the head office, as well as one of
the IT staff at the Ireland satellite office), with additional dashboard-/report-level access for 4 users (2 in compliance/audit and 2 in IT
management/executive).
Info-Tech Research Group
72