How does this stack up against ..

Hey Aaron,

ArcSight Logger is a narrower solution than LEM. Logger is much more focused on log collection and search with some alerting capabilities, while LEM is a more holistic solution that includes log collection and storage along with correlation, alert/response, and other features that are more akin to things you see in the full ESM (though much easier to use).

LEM also has a native agent, not Snare, and it is not polling-based, it pulls directly from the Windows Event API to receive the events in real-time and forward them to the appliance. We've actually seen cases in the field where events weren't logged to disk (due to failing hardware) but were posted to the API, and thereby to LEM for response/notification (whereas something like Snare/Lasso or a WMI-based polling tool would not). This agent also provides USB device file/process monitoring and the ability to do responses (detach USB device, restart service, enable/disable accounts, etc) at the system level.

As a SIEM, we parse and categorize the data, presenting it in real-time and also storing for search. You can search both this data and the original log data in a flexible, drag and drop search builder - rather than just being presented with a big ol search box and having to type your own queries. A search box is handy if you know exactly what you're looking for - or live and breathe logs - but log data isn't always as straightforward as we'd wish, so you end up following threads and building complex search logic that we make easier.

So, to sum up: Logger is a narrower solution, going after pure log management (think more like Splunk, which is really what that data sheet is comparing itself to). Most of our customers need more than just to store and search logs - they need to use that information to empower the IT organisation to troubleshoot, respond to issues in real-time, and help meet compliance initiatives. It's the same person with 10 different jobs, and they need one tool to do it.

The youtube doesn't quite do the features justice. To be fair, you should probably get a tour of LEM.

Pricing, well, I'll leave that discussion to sales. :)

Could someone contact me for a webex demo of this product?

Yep, someone will contact you externally.

Still waiting to be contacted and now I need a quote and a trial.

I would also like to get a trial of this software as well as see some list pricing on the SolarWinds website.

Hi folks,

I have alerted the LEM. You should here from the soon.

Andy