Editor's note: This is a summary of our testing of this product, for a full rundown of how it fared in our testing across SIEM categories; please see our full coverage.

EIQ Networks' SecureVue is a multi-function product that offers SIEM functionality as one of its many components.

EIQ has taken a somewhat novel approach of gathering not only traditional device events and vulnerability information but also configuration and performance data. The product has one of the widest ranges of device support that we tested, and has the product's abilities to profile hosts via configuration "snapshots" and provide 3D views of events are certainly useful features. Unfortunately, the user interface is a bit rough. And, more seriously, it's pricey and many of the supporting tools are quite limited in functionality which makes it hard for us to recommend SecureVue for many traditional SIEM uses. That said, it was outside the scope of our test to explore SecureVue's non-SIEM-like functions – such as it's auditing and compliance management wares -- to see if they make up for the SIEM shortcomings.

SecureVue came to us on an Intel-based appliance running Windows 2003 eIQ Networks offers unique presentation features, but underlying SIEM need some improvement. eIQ Networks has done an impressive job of writing parsers for a wide range of formats and device types, and although the provisioning of new devices wasn't as smooth as High Tower's process, it was pretty close. We were also really impressed by SecureVue’s parsing editor; the tool allowed us to take log data of an unknown type, import it, and then select and match relevant fields (e.g. source IP address) by doing nothing more then highlighting the text on the screen. Very slick.

What we struggled with in our day-to-day use of the product was the awkward paths we had to take to view the data. For example, in most of the SIEM tools we tested there was an event overview table of some sort that allowed us to view all correlated alerts in real-time. Drilling-down into a correlated event to reveal the "trigger" events was usually a mouse click away, and double-clicking further lead us to the raw event log itself. Using SecureVue accomplishing the same tasks takes multiple steps; clicking on an alert leads you to a forensic report query, which then launches a different window to present the events leading up to that trigger. Once there, the event viewer was relatively inflexible; we couldn't easily sort on columns, re-arrange columns, or do any of the data "slicing and dicing" we wanted to do when performing initial investigative tasks.