exaProtect

I work for an MSSP, and we are currently looking at expanding our Managed IDS 
offering. As part of this we are looking for a product that will collect and 
aggregate events from a large number of heterogenous event sources (if truly 
event generator agnostic, then even better) (both network and host sensors). In 
short, (some of) our requirements are that it can collect events, standardise 
their format and allow us to apply filtering *after* event collection (so it 
would necessarily have to support high volumes of data).

After collection, events need to be stored securely, and displayed to analysts 
in as good a way as possible (I am sure we all have our preferences here - I am 
partial to Sguil/Sguil-like displays).

Now - to my question. We have looked at exaProtect, and it seems like a solid 
product which meets a majority of our requirements. I was wondering if anyone 
on the list have any experiences / opinions on exaProtect that they would like 
to share?

Thanks in advance.

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------