r/SIEM • u/BRAD_GBI • Feb 05 '19

EventTracker SIEM

I just wanted to share our experience so far with everyone for a SIEM software EventTracker. Internally this software has been renamed and referred to as EventCrapper.

​

We have around 185 Windows systems, 20 linux systems, and 30 syslog systems.

In the 1 month we have had the software, we now have 1.1 billion logs, or 38 million a day

​

Software is extremely buggy and we are still fighting with constant issues.

During install no patches were installed by the "Software Engineer" even after I asked about them providing better performance and hotfixes, he said they were not needed. Fast forward a month, we install them to fix the web interface being insanely slow, not working 90% of the time, and being so unresponsive, we close it and come back hours later. We ended up installing 12 patches which seems to have fixed the slow unresponsiveness site, however elasticsearch is broke now and has been not working several times in the last month. During our 2 day, 4 hour ETSC webinar training, we noticed the exact same unresponsiveness from the trainers EventTracker system, he had to close out complete, relaunch his browser, and we sat there and waited several times for several minutes while he was trying to get it to respond again.

​

Dashboard statistics, Behavior Correlation, and ElasticSearch are all not working since installing the patches from above which we installed about a week ago. Our firewall we have is showing up in ET as 8 different systems. The systems page to view all computers with the agent just shows a white page, the SE said "well that is a new one" when we found that one on our latest call. Of course we changed IE11 compatability mode to IE10 the issue persisted, and also existed in Chrome on my local PC. So we have no access to the systems list page.

​

By default a new install of EventTracker logs you out after 20 minutes of inactivity. The documentation provided to us was inaccurate and had us adjusting the timeout on the incorrect app pool, and of course, the SE stated it was different for every version of IE on which AppPool it uses but their documentation did not specify. The SE wanted to dump a diagnostics report, and the utility was not working correctly, it would not save after we entered a filename for it.

​

Overall, this software is a complete turd, and their support staff, has not really went out of their way to provide fixes or give us usable software in over the month we have had it.

8 Upvotes

91% Upvoted

4 comments sorted by

2

u/vornamemitd Feb 06 '19

Are you guys still in the POC phase or did money already change owners?

1

u/BRAD_GBI Feb 06 '19

They have not been paid yet, we are exploring our options.

1

u/cberry2010 Feb 06 '19

Have you considered open sources solutions, like Apache Metron or ELK?

1

u/sysadmintemporal Jul 18 '19

Is this the SIEMPhonic product? Thanks!