Re: Poll: What is your experience with McAfee SIEM support
1.How would you rate experience with the McAfee SIEM support? About the best I've gotten from any support organization. I experience what Rhinomike refers to with another organization. But not SIEM support. All issues ( Approx 15 ) were solved. Several took a month.
2.What level of support do you have? Gold
3.In what region are you based? California
4.What areas are particularly painful? Painful Support? none. Communication? Great. Follow Through - As needed. Knowledge Sharing - All questions asked were answered.
- if new release is available, support will push for immediate upgrade, which in most cases breaks other things. 100% agree. And 75% of the time, the problem did get solved post release. New Rules cause me at least 1 week of work everytime.
Painful -> Features - Need a better reporting. Having to augment the SIEM in order to begin to deal with Intrusion Detection ( Logons, DNS, Firewall alerts ).
** Have been using a Combo for 4 years. Second Combo cloned at another site with the help of one McAfee's consultant last year.
So obvisoulsy, I have not had as difficult of a time, getting these two SIEMs to do what I think they should do as a some. So what's the difference?
We use a COMBO. We customize NOTHING on the unix side - ever. We customize Rules,Queries,reports, WL,Alarms,Views. No more than 200 devices per SIEM. We Do not use the ELM. All data fits without using it. We do not allow Support to remote into it. They tell me/email the commands and I do everything.
I work for a VAR and McAfee always comes in and evangelizes their SIEM solutions. Let me make it clear, I'm not technical, and we received generic on about SIEM.
We also partner with other SIEM vendors.
We're a McAfee MASP reseller, so instead of relying on their support we developed our own Managed SIEM team for our customers. Third party always seems to get it right(er) simply because their core revenue is tied with the customer satisfaction rather than product sales.
What I would suggest is to look in your area, or with your existing suppliers and see if their provide such a service, if that is an option for you.
From my experience, almost all the vendors minimize the resources they invest in their our support team and are quite happy to make a living of product sales.
I guess that's why this yearly and bi-yearly displacement has increased lately, and Managed Services have trippled.