NetIQ Sentinel™ is a full-featured security analytics platform that simplifies the deployment, management, and day-to-day use of Log Management and SIEM. Sentinel readily adapts to dynamic enterprise environments and delivers the actionable intelligence security professionals need to quickly understand their organization's threat and compliance posture and to prioritize response.
The Sentinel platform can be licensed to provide two different sets of capabilities according to enterprise needs:
- Sentinel Enterprise
- A full-featured solution that enables the complete set of log management plus real-time analytics capabilities. Sentinel Enterprise focuses on security analytics and SIEM use cases such as real-time threat detection, alerting, and remediation. The Enterprise solution includes all the capabilities of Sentinel for Log Management.
- Sentinel for Log Management
- A solution that focuses on log management use cases such as the ability to collect, store, search, and report on data in a highly flexible and scalable system.
Deployment Options
- High Availability installation
- The Sentinel High Availability add-on provides rapid failover within a cluster in the event of a major system failure, built right into our simple soft appliance. Whereas the certified HA solution for traditional Sentinel installation relies upon separately-purchased SUSE Linux High Availability Extensions, this solution rolls the entire package into a software appliance, allowing you to easily roll out new or additional Sentinel HA cluster nodes. The High Availability (HA) version of the appliance embeds additional HA capabilities right into the appliance installer. In a distributed environment, you can deploy any combination of traditional installers and soft appliance, depending on your requirements.
- Traditional installation or Appliance installation
- Sentinel is offered both as a traditional installer and as a soft appliance. The traditional installation deploys Sentinel on an existing Linux operating system by using the application installer. The Sentinel appliance is a ready-to-run software appliance built on SUSE Studio.
The appliance combines a hardened SLES operating system and the Sentinel software in a pre-built package. Sentinel provides appliances in Open Virtual Machine (OVF) and Live CD (ISO) formats, which eliminates the need for different appliance formats for each hypervisor platform. The Sentinel OVF appliance can be used on hypervisors such as VMware and Xen appliance packages. The Live CD can be used to install a soft appliance to bare metal or to hypervisors that do not support OVF.
- High Performance Multi-Tiered Traditional Storage or Hadoop-based Scalable Storage
- Traditional storage is a file-based event storage system optimized for fast retrieval and long-term archival of events. The event store provides 10:1 compression, fully indexed searches, flexible retention/privacy policies, and speeds up relevant reporting tasks while also providing you the flexibility to archive your data to traditional backup and forward some or all of your events to a traditional relational database store.
Scalable storage leverages the Cloudera's Distribution Including Apache Hadoop (CDH) framework to store and manage large data. Hadoop-based scalable storage provides you the ability to seamlessly scale up data collection and visualization to a very large EPS with a single Sentinel server.
- Data Federation
Sentinel enables organizations that have deployed several instances of Sentinel Enterprise and/or Sentinel for Log Management in different locations to search events not only on their local Sentinel servers but also on existing remote Sentinel servers from a single, centralized console.
- Agent-Based or Agentless Data Collection
Sentinel provides you the flexibility to use either agent-based or agentless data collection for your Windows and UNIX/Linux event sources. You can determine which method to use for each event source based on the needs of your environment.
For more information, see the "Deployment Considerations" section in the Sentinel Installation and Configuration guide.
- Anomaly Detection
- Sentinel allows you to identify threat patterns and anomalies in your environment by establishing specific baselines respective to your unique IT environment to deliver better intelligence and faster detection of anomalous activities. Baselining and trending allow you to view patterns of historical activities and to develop models of typical IT activities to spot new, potentially harmful trends. (Available in Sentinel Enterprise with traditional storage.)
- Event Correlation and Alerts
- Correlation adds intelligence to security event management by automating analysis of the incoming event stream to find potential threats and generates alerts to send instant notification about such potential threats. Sentinel also provides alert dashboards that enable you to perform powerful exploration and analysis of many alerts at once. (Available in Sentinel Enterprise.)
- Threat Intelligence
- Sentinel provides packaged support for Threat Intelligence feeds that help you detect known bad activity such as interaction of your own hosts with compromised internet hosts. This capability supports immediate prioritization of threats based on externally-provided intelligence. (Available in Sentinel Enterprise.)
- Real-time Event Visualization
- Comprehensive, categorized real-time visualization of incoming event data with full filtering and drill-down capabilities to give you access to your event data instantly.
- Security Management and Compliance Monitoring
- Sentinel provides integrated, automated real-time security management and compliance monitoring across all systems and networks while allowing you to demonstrate and monitor compliance with internal policies and government regulations such as PCI, ISO27xx, Sarbanes-Oxley, HIPAA, GLBA, FISMA, and others.