Migration options with enVision being discontinued/replaced

[RSAAdmin]

Since RSA is in the market to acquire another SIEM solution to replace enVision - what can current enVision customers expect?

[RSAAdmin]

Interesting - where was this said?

[RSAAdmin]

From a VAR who indicated that his RSA contacts had told him RSA was looking for another SIEM product to acquire. They are still making sure they call you to remind you that your maintenance is due. I can't say I'm surprised. There hasn't been much (if any) innovation since the Network Intelligence acquisition. The enVision platform is little more than an expensive log collector at this point; the correlation engine is pathetic. If I owned any other RSA acquired products (Archer or Netwitness) I'd be looking at alternatives. It's amazing that a company the size of EMC would tolerate the gross incompetence that the RSA division has demonstrated.

[RSAAdmin]

Sounds rather weird taking into account that they have just moved almost all devices to content 2.0 and managed to bring in the SQL and Bloom filters. I have to admit that they haven't been so innovative and they are falling behind the competitors, if they won't bring Next-Gen SIEM functionalities and fix the GUI. GUI is ugly and if you want to bring out the benefits, you need to design your own reports, dashboard views, alerts and also use Event Explorer, which is still quite clumsy. Correlation engine works, but configuration options could be much better and easier to understand. Hopefully this rumor is just a rumor or your VAR's own invention

[ScottPause]

Um, even if this were true, I'm not sure their product plans involve posting to a community forum.

As far as I understand it, they are working to integrate existing products and leverage the best of breed per product.   Ultimately some type of migration may be needed to get to that new product/platform, but I've not heard anything to indicate they are jumping ship.

I would imagine, like any good product growth, that they will be slowly sharing features and integrating them over time - not an all in one "switch to product B".

This all said, migration of the TB's of data will be an issue for any customer and RSA obviously is aware that it could cause customers to flee if its unreasonable.

And enVIsion does have it flaws currently, so the sooner RSA can help its customers, the less chance they will leave. 

[RSAAdmin]

I'm sure they wouldn't announce anything officially until such time as they had actually made an acquisition. You do have to wonder why things have been so quiet on hear since all of the hype around 4.1. Where is all of the marketing hyperbole? Shouldn't we at least have a Q1 road map by now? I took a look at Archer and the enVision integration is there - but barely. We were looking at Archer for risk/compliance management because we felt that being under the RSA umbrella there would at least be plans for taking advantage of the data enVision has to offer - but it just isn't there and they weren't very big on talking up the enVision relationship.

[RSAAdmin]

After speaking with my enVision rep, they said they generally do not publically release roadmaps until after the RSA conference as they generally like to make announcements there.

[MatthewGardiner]

I would encourage all enVision customers to spend some time looking and thinking about the NetWitness product. http://www.emc.com/security/rsa-netwitness.htm Also thinking from the point of view of how effective traditional SIEMs are with Advanced Threats/Targeted Attacks. Also, to contact your RSA Sales teams to walk through where we are taking the enVision product.

[RSAAdmin]

I was at the roadmap presentation at the RSA Conference, and I never saw in any roadmap or presentation where enVision is being discontinued or replaced by another product. The enVision product is not going away as I understand, it is being augmented and integrated with other RSA tools and products. The NetWitness platform augments enVision in that you have the ability to drill down into the packet data, rather than just having a notification from a syslog type event. For forensics, this is invaluable, as you can completely reconstruct the conversations using NetWitness to better understand what is happening in your environment. The integration with Archer is there, and is better than ever. I was involved in the original integration with Archer in 2010, and the new Framework Connector has progressed a lot further than the custom programmed task triage scripts that had to be used in the past, and has exceeded my expectations for integration. I would highly encourage that you contact your RSA Sales rep for a roadmap presentation, there is some good stuff coming down the pipeline for enVision in the future. Rick

[RSAAdmin]

I would also encourage everyone to check out the new RSA SIEM Overview Video posted in the blog corner. Gives a nice high level overview of where RSA is going with its SIEM portfolio, and how enVision is a crucial part of it. [[page no longer exists]]