Market Development
With network operations in mind, Mazu Networks and eIQnetworks partner
Analyst: Andreas Schneider, Nick Selby | Sector: Networks & Media »» | Date: 26 Jun 2007 Event summary • Mazu Networks and eIQnetworks have announced a technical integration through which eIQ's SecureVue enterprise security information manager (ESIM) will incorporate analysis made by Mazu's Profiler network behavior anomaly detection (NBAD) product. • Mazu's Profiler can now send alerts directly to SecureVue. The integration also allows SecureVue users to see snapshots of Profiler reports about historical behavior of suspicious hosts by right-clicking within the eIQ dashboard. • Mazu works similarly with several ESIM vendors. This differs because Profiler sends objects and data to eIQ, where they're rendered by the SecureVue console. This fits with eIQ's aim to offer network and security management from a single console. The 451 take We've said before that ESIM and NBAD work well together, and this is a good start – but by no means is it as tightly integrated as the ESIM-NBAD offerings from vendors like Q1 Labs or Tier-3. But even at this level of integration, context from Profiler expands eIQ's claims of visibility into both security and network operations. Worms no longer possess checkbook-moving fear in CxOs, and Mazu has been trying to demonstrate its value to both of those camps. SecureVue is being messaged as a bridge between NOC and SOC, a role we believe Profiler can help it can fill. We're curious to see the integration deepen with Profiler 8.0; Mazu is mum on its plans. Mazu should also benefit from upsell opportunities into eIQ's large customer base. Details ESIM vendor eIQnetworks and NBAD vendor Mazu Networks have announced a partnership composed of a reseller agreement and technical integration between their keynote products: eIQ's SecureVue and Mazu's Profiler. Under the partnership, Profiler alerts can now be displayed through and rendered by the SecureVue dashboard. SecureVue users will also be able to drill down into network security events and see Profiler analysis of historical traffic to and from a suspicious host. Mazu has similar partnerships with a number of ESIM vendors, but says this one is different because eIQ is importing raw Profiler data and displaying it as though it were part of the SecureVue console. The other vendors offer, essentially, screenshots of Profiler views. They said the integration will be complete in the beginning of August. Mazu says the companies will exchange customer lists and go on joint sales calls. EIQ claims 2,300 customers, including downstream customers of resellers, and 10 of its flagship SecureVue product (whose average deal size is around $100,000), while Mazu has grown from 140 in September 2006 to 'approaching 200' now. Mazu's average deal size is $150,000, with deals ranging from $50,000-1m. It claims 75 employees, with 30 in sales and 45 in support and engineering. In 2006, 50% of sales were through its channel, a number which Mazu would like to have at 75-80% by the end of 2007. Competitive landscape Mazu has integrations with its strategic investor Symantec, ArcSight, netForensics, EMC/RSA's Network Intelligence and OpenService, and with log management vendor LogLogic. Q1 Labs offers an ESIM product mixed with some homegrown NBAD, as do Australian vendor Tier-3, and Cisco with its CS-MARS ESIM product. Pure-play NBAD comes from Arbor Networks, Lancope and troubled GraniteEdge Networks. ESIM vendors looking to address network operations center (NOC) and security operations center (SOC) convergence include ExaProtect, which acquired Solsoft in October 2006; ArcSight, which recently released Network Configuration Manager based on technology acquired from Enira Technologies; and Enterasys, whose NetSight Automated Security Manager offers functionality similar to ArcSight's (Enterasys licenses Q1 Radar for the ESIM). Others include Novell's eSecurity, EMC/Network Intelligence (beginning integration with EMC and RSA) and IBM's Tivoli Security Operations Manager, acquired from Micromuse (which had previously acquired GuardedNet). Attachmate's $495m NetIQ acquisition promises some gap-bridging. OpenService has been talking about gap-bridging since at least 2002. SenSage plays here as well.