Analyzer vs. Vantage - Product Comparison

Analyzer and Vantage intelligently and efficiently import and analyze more than 200 log formats from many different vendors.

Most competing log file analyzers are hard-coded to analyze a particular log file type. Achieving all reporting requirements, using only one application, means spending less on software maintenance, hardware and administration.

The ability to translate web proxy server log file data into manageable information will enable organizations to:

Maximize Employee Productivity
Identify employees who excessively use corporate Internet resources for recreational purposes. Effectively publishing and communicating Internet usage policies and making employees aware of monitoring activities, and corresponding breach consequences, will assist in reducing personal Internet use.

Ensure Policy Compliance
Identify misuse and ensure compliance with acceptable Internet usage policies by monitoring which sites are being viewed, for how long, what is being downloaded and by whom.

Ensure Legal Compliance
Mitigate risk of costly liability and litigation issues by ensuring compliance with acts and regulations relating to Internet usage.

Reduce & Verify Bandwidth costs
Assess bandwidth usage and identify excessive downloading from particular websites, of specific files, and by which employee. Verify accuracy of Internet Service Provider’s charges.

The ability to translate web server log file data into manageable information will enable organizations to:

Verify Effectiveness of Online Campaigns
View the most common sites referring traffic to your own website to validate the effectiveness of online marketing initiatives. Display search terms commonly used in search engines referring to your company's website to optimize the website's search ranking and maximize bids on the correct search terms for online pay-per-click campaigns.

Optimize Website Performance
Prioritize web page sequences, improve navigation, improve browser support and reduce link breaks by monitoring incoming website traffic, commonly accessed pages, user agents (browsers) accessing your website, client and server errors.

The ability to translate email server log file data into manageable information will enable organizations to:

Reduce Bandwidth costs
Identify emails with large attachments, who sent them, and if they were work related.

Protect Confidential Information
Monitor email activity to protect the transmission of confidential organizational information.

Mitigate Litigation Risks
Mitigate risk of costly liability and litigation issues by ensuring compliance with acts and regulations in relation to sexual harassment, bullying and discrimination that can arise from improper email usage.

Reduce Unproductive Email and Messaging Communication
Analyze data from email log files to identify unproductive chatting and emailing.

Maximize Email Virus Protection
Analyze log files from email virus scanning software, or devices, to identify the source of viruses. Identify who sent the virus, who received it, attachment name and how your virus scanner dealt with it (Can only be analyzed using Vantage).

The ability to translate messaging server log file data into manageable information will enable organizations to:

Reduce Bandwidth costs
Identify messages with large attachments, who sent them, and if they were work related.

Protect Confidential Information
Monitor instant messaging activity to protect the transmission of confidential organizational information.

Mitigate Litigation Risks
Mitigate risk of costly liability and litigation issues by ensuring compliance with acts and regulations in relation to sexual harassment, bullying and discrimination that can arise from improper messaging usage.

Reduce Unproductive Messaging Communication
Analyze data from instant messaging log files to identify unproductive chatting.

The ability to translate security device log file data into manageable information will enable organizations to:

Strengthen Security Controls
Verify the configuration of a network's firewall and its control of network traffic. Identify and investigate security breaches, determine the source of email viruses and manage their organizational impact.

Maximize Effectiveness of Existing Blocking & Filtering Solution
Review websites that employees have been denied and granted access to in order to validate the effectiveness of existing Internet filtering service.

The ability to translate network device log file data into manageable information will enable organizations to:

Improve Network Management
Investigate traffic between computers, ports or applications to diagnose network problems. Gather information to help decide which protocols to prioritize over others. Better manage network resources and troubleshoot certain events.

WebSpy’s ability to translate event data into manageable information will enable organizations to:

Monitor failed authentication attempts
Identify any users who are trying to access files and folders that they are not authorized to access, or system failures preventing legitimate user access.

Prevent data loss and leakage
Identify the access, modification or printing of confidential files to prevent information leakage or identify the person behind accidental or deliberate data loss.

Ensure employees adhere to specified work schedules
Monitor event logs that record when an employee’s computer has been powered on or shut down.

WebSpy's latest addition to the Vantage range, Vantage Ultimate, incorporates all innovative Vantage features as well as being able to satisfy the surging organizational need of distributing information - securely and responsibly.

Distribute Information. Distribute Responsibility.
IT Managers are too often left with the responsibility of managing and enforcing acceptable Internet usage for the entire organization.

Using Vantage Ultimate administrators can distribute reports to managers or department heads that show the activity of their direct subordinates, placing the responsibility of enforcing acceptable usage with the managers themselves.

Empower Users. Full Disclosure.
You can use the Vantage Ultimate to distribute reports to each member in your organization detailing their own personal Internet usage (sites visited, search terms used etc).

This empowers users to modify their own behavior once they understand how much of their activity is productive or unproductive and what it costs the organization. It also serves as a gentle reminder to employees that their activities are being recorded and that they should keep their online behavior within the bounds of the organization’s acceptable use policy.

From a privacy point of view, Vantage Ultimate is an easy way to provide employees with full disclosure regarding the information recorded about them.

Self Serve, On-Demand Investigation.
You can also use Vantage Ultimate to distribute original data storages to any of your organization’s members, enabling them to conduct their own ad-hoc drilldowns on any information they require. For example, distribute storages to HR managers enabling them to investigate the activity of employees that have handed in their resignation notice, but still have access to confidential company resources.

Protect Employee Privacy.
By assigning permissions to each of your Vantage Ultimate users, you can ensure they can only view the reports they are allowed to view. However, some employees need to view the traffic of all users, but do not necessarily need to identify users. For example, a network administrator may need to view the amount of traffic downloaded from a particular site per user, but does not need to know which users where involved.

This is easily achieved using the ‘Identify users’ permission, which masks all usernames with a hash code.

More Vantage Ultimate Information

 

In Analyzer, if you want to create a separate report document for 10 departments in your organization, you need to create 10 tasks, each with a report action filtered for a specific department.

In Vantage you can produce separate report documents for each department, user, or any other summary item, with a single run through the Report wizard.

Vantage enables you to add custom columns to the tables in your reports, utilizing functions such as Sum, Average, Maximum, Minimum, Count and Count Distinct. Analyzer only allows you to select from a predefined list of columns.

Analyzer can display the ‘Total browsing time’ for users, departments, dates, and sites, however Vantage can also be configured to display:
- Average session time
- Longest session time
- Shortest session time

Where a session is the amount of time a user spent browsing before taking a five minute break (default is set to five minutes, but this is user configurable).

Vantage can also provide a column that counts the items in a different summary. Some useful examples include:
- Counting the number of different sites a user visited.
- Counting the number of users that visited a website.
- Counting the number of people that sent a particular email.

Other useful custom columns include:
- The time of the first and/or last hit to a particular web site.
- The number of files downloaded by a particular user.
- The average size of files downloaded by users.
- The number of ports accessed by a particular user or IP address (computers accessing a large number of ports could then be analyzed further to check for port scanning behavior).

Example of a table that can be produced in WebSpy Vantage. The columns Analyzer is not capable of producing are highlighted in orange. (click to enlarge)

WebSpy Vantage has the ability to generate trend reports, that show you trends over time and allow you to predict future values. Analyzer simply does not have these types of reports.

Trend reports produce a line chart where the horizontal axis always displays time. The vertical axis can display any aggregate column (including custom columns) such as size, browsing time, number of sites etc. Any Summary can be chosen for the series, such as Users, Departments, Protocols and a new point can be plotted on the chart every ‘n’ hours, days, months or years.

You can also draw a linear trend line through the results and extrapolate into the future to estimate potential requirements as well as limiting the time frame of a trend report to view daily, weekly, or monthly patterns.

Some useful examples of trend reports include:
- The amount of traffic downloaded over the past three months to estimate what the traffic downloads will be next month.
- The traffic pattern for each day of the week in order to discover when your peak download times are.
- The pattern for the number and/or size of emails sent each hour to discover when your peak emailing times are.

The below table shows the navigation/drilldown tree of the same HTML report produced in both Analyzer and Vantage.

Analyzer Report Navigation Tree	Vantage Report Navigation Tree
Top 50 sites _ Selected Usernames __ Bruce ___ Bruce's sites	Top 50 sites _ Bruce's sites

You can see that the Analyzer report requires you to expand two nodes in the navigation tree before you can see the sites Bruce visited. In the Vantage report, these sites are displayed at the root level of the report and can be accessed with a single click.

Vantage lets you create advanced filters on any node in a report template, so you can filter a list of sites by a specific user, status code, action, date or any other summary item. You can also have another node in the report that is filtered completely differently without the need for creating a long drilldown tree in your report.

Having these two nodes at the same ‘level’ also means that only a single pass through the storage is required to gather all the information to create the report. Analyzer will take two passes through the storage due to the extra drilldown.

Vantage reports can therefore be optimized to generate faster than Analyzer reports by avoiding unnecessary drilldowns and extra passes through the storage.

By providing more filtering options on each item in a report template, Vantage reports can be produced faster and organized much more intuitively.

By default, storages in both Analyzer and Vantage are partitioned (internally structured) by date. When you drilldown into any item other than a Date, Analyzer or Vantage must read through the entire storage to retrieve that information.

For example, if you drilldown into a specific user, the entire storage must be read to retrieve the information for that user. If you drilldown into a date, only the partition in the storage that contains the information for that specific date needs to be read. Drilling down into a Date is therefore much faster than drilling down into a User.

Vantage enables you to change the way your storage is partitioned. So if your usual workflow is to go to the Users' summary and drilldown into specific users, then it makes sense to partition your storage by User. This way, only the partition for a particular user needs to be read as opposed to the entire storage.

Both Analyzer and Vantage come with keyword profiling technology that categorizes web sites and email subject lines into profiles such as Adult, Career, Information Technology etc.

Vantage enables you to profile any summary, not just URLs and email subjects. A great use for this is profiling the Keywords summary that displays search terms entered into search engines like Google.

Although it is true that search terms are recorded in URLs, and URLs get profiled by Analyzer, you will find that these URLs will often get categorized into the ‘Search Engines’ profile due to the site name portion of the URL.

For example, the following URL is the result of a Google search for ‘football scores’:
http://www.google.com.au/search?q=football+scores

Although the URL contains the word ‘football’ which should categorize the URL into the ‘Sport’ profile, it also contains the word ‘google’ which will categorize it into the ‘Search Engines’ profile.

Being able to profile only the Keywords Summary provides a great indication of the productivity of your user’s searching habits. This functionality can be accessed by using the provided ‘Web Searches’ Report in Vantage, or by adding this functionality to any existing report using the custom expression: profile([Site.Keyword]).

Analyzer has some great reports to extract critical information from your storage, such as your top 10 users and the profiles they browsed. But if you notice something of concern that needs further investigation, you need to go to the Summaries screen, run an analysis with the same filters as your report, drilldown until you get to the same summary included in your report, and then drilldown further to investigate.

Vantage enables you to utilize any report template when running an analysis on the Summaries screen. This means you can extract critical information as defined in your report template, display it on the Summaries screen, and drilldown past what is defined in your template to further investigate areas of concern

Example Scenario: You run a report template on the Summaries screen that extracts your top 10 users and the profiles they accessed, and you notice that one of your users has accessed the Adult profile. Vantage enables you to drilldown on that profile to view further information such as the Sites that were accessed, the times they were accessed, the files downloaded from those sites and so on.
Running a Template Analysis on the Summaries screen and drilling down past what has been defined in the template (Click to enlarge)

Vantage enables you to include a chart for any column that you have added to your table.

For example, you can show a bar chart displaying the browsing time of your top 10 users followed by a pie chart showing which of those users downloaded the most traffic.

Analyzer can only show one chart per table.

Configuring a template node to display more than one chart.

A typical Summary in Analyzer displays a table that contains a single Key column such as ‘Users’, followed by a few aggregate columns such as Hits, Total Browsing Time, Incoming (MB), Outgoing (MB) etc.

Vantage enables you to add multiple Key columns to any table, allowing you to see more information in a single table without performing an extra drilldown.

For example, if you want to view the IP address assigned to particular user in Analyzer, you need to drilldown into that user and go to the ‘User Addresses’ summary. In Vantage, you can create a user report with an extra Key column added to the User table that displays the Source Address.

The following table shows an example of what this table would look like. The two highlighted columns indicate the Key columns.

User	Source Address	Bytes Received	Bytes Sent	Hits
Bruce	10.1.10.10	163,353 KB	6,435 KB	11,678
Olivia	10.1.11.27	31,194 KB	3,419 KB	6,396
Total		194,547 KB	9,854 KB	18,074

Other useful multi-key examples include:
- Show Sender, Subject line and Recipients of the 10 largest emails sent within your organization in one table
- Display the profile that each site was categorized into right next to the site name in any Sites table.
- Displaying the Destination Port number along with another column describing what protocol the port is commonly used for such as ‘WWW’ or ‘SMTP’. This is achieved by combining ‘Destination Port’ and ‘Destination Port aliased by Port Names’.

When using the Summaries screen in Analyzer, you can drilldown into a particular user to see more information, such as the sites they visited. To analyze a different user, you need to click back up to the Users Summary and drilldown into the second user.

Vantage enables you to select multiple users, right-click them and select ‘Drilldown Separately’. This conducts a speed-efficient drilldown allowing you to view the sites each user visited side-by-side.

Reporting on subnet ranges in Analyzer can require complex configuration in Aliases using wildcards.

In Vantage this has been greatly simplified by allowing you to specify subnet Aliases using actual bitwise subnet expressions.

For example, Analyzer enables you to group everything in the 192.168 subnet by entering 192.168.*. Vantage does this using the expression 192.168.0.0/16. Vantage’s bitwise operation is much faster than Analyzer’s wildcard system, and it also enables you to configure more complex subnet configurations such as 192.168.3.192/26.

As well as importing all the information that Analyzer extracts from your log files, Vantage imports more advanced fields (which Analyzer ignores) such as firewall rules, packet direction, and source/destination network.

This lets you analyze more information, as well as giving you more options when specifying filters.

For example, Microsoft's ISA Server logs two fields called Source Network and Destination Network. In Vantage you can use these fields to filter out all outgoing traffic in order to concentrate on incoming traffic only (show me everything where Source Network is External and Destination Network is Internal).

You can also analyze the ISA firewall rule responsible for blocking traffic.