CorreLog, Inc. - Comprehensive Analysis Report
Summary
CorreLog, Inc., founded in 2007, was a leading independent software vendor specializing in Security Information and Event Management (SIEM) solutions. The company's core mission was to deliver advanced network and system security, assisting organizations in achieving compliance with various regulatory standards such as PCI DSS, HIPAA, SOX, FISMA, GDPR, ISO 27001, IRS Pub. 1075, and NERC. CorreLog carved a niche by providing real-time log management and event correlation, notably excelling in mainframe security event monitoring. Its solutions were designed for seamless integration with existing IT investments, securing data across both mainframe and distributed operating systems. In October 2018, BMC acquired CorreLog's assets, integrating its offerings into BMC’s mainframe solutions to enhance security capabilities under the BMC AMI Security product family.
1. Strategic Focus & Objectives
Core Objectives
CorreLog's primary business objective was to deliver comprehensive SIEM software for real-time monitoring, alerting, and incident response. This encompassed collecting and analyzing data across diverse network components to detect suspicious activity and security threats. The company aimed to help businesses accelerate transformation and multiply productivity through innovative software offerings, with an emphasis on cloud-based solutions, and extensive integrations and connectors.
Specialization Areas
CorreLog specialized in security information and event management, offering capabilities such as high-speed message gathering, an indexed search engine, extensible dashboards, reporting tools, and a ticketing facility. The company was particularly recognized for its real-time mainframe SIEM capabilities, workflow orchestration, mainframe simplification, and robust data protection features. Its unique value proposition centered on its proprietary "semantic correlation" techniques and auto-learning functions.
Target Markets
CorreLog primarily targeted financial services, healthcare, manufacturing, and the public sector. The company's customer base ranged from Fortune 500 enterprises to small and mid-sized businesses (SMBs), serving a broad spectrum of organizations seeking advanced security and compliance solutions.
2. Financial Overview
Funding History
CorreLog, Inc. was founded in 2007. The company had historically not raised any external funding rounds. Prior to its acquisition, as of 2018, CorreLog was generating an estimated $4.4 million in annual revenue. The company operated as a private entity until its assets were acquired by BMC Software in October 2018.
3. Product Pipeline
Key Products/Services
CorreLog offered a comprehensive SIEM software suite. Key features and capabilities included:
CorreLog SIEM Correlation Server: At the core of its offerings, this server utilized proprietary semantic correlation techniques and neural network technology to decipher vast amounts of log messages into actionable intelligence, alerts, and tickets. It focused on real-time event correlation, processing threads, alerts, triggers, and actions for rapid response to threats.
CorreLog SIEM Agent for IBM z/OS: This agent enabled real-time viewing of mainframe security events from RACF, ACF2, Top Secret, and DB2, integrating them with security events from distributed systems.
Log Management and Compliance Tracking: The platform featured high-speed indexing for "Google-like" search capabilities, allowing for quick and accurate queries without reliance on open databases. It supported multi-platform log management across Windows, UNIX, Linux, IBM z/OS, Linux on z, and virtualized platforms. Its compliance tracking included scorecard functionality for standards such as PCI DSS, HIPAA, and Sarbanes-Oxley.
Security Features: These encompassed endpoint management, application security, behavioral analytics, real-time monitoring, network monitoring, threat intelligence, event logs, and file integrity monitoring (FIM).
Operational Features: Automated help-desk ticketing and reporting functions, direct monitoring of Windows "Application and Service" logs, support for double-byte characters for localization, and LDAP support for integration with third-party identity management solutions.
4. Technology & Innovation
Technology Stack
CorreLog's technological platform was built around a comprehensive Security Information and Event Management (SIEM) software suite.
Core Platforms and Technologies: The company utilized industry-standard syslog protocol and SNMP traps for collecting system log messages. Its solutions operated across diverse environments including Windows, UNIX, Linux, IBM z/OS, Linux on z, and virtualized platforms.
Proprietary Developments:
Semantic Correlation: CorreLog's SIEM Correlation Server utilized proprietary "semantic correlation" techniques, employing correlation counters, alerts, and triggers to transform extensive log messages into understandable threats, alerts, and actionable "tickets."
Auto-learning Functions and Neural Network Technology: The flagship CorreLog Security Correlation Server integrated auto-learning functions and neural network technology to enhance its threat detection and event correlation capabilities.
Scientific Methodologies:
Real-time Event Correlation: The core of CorreLog's offering was its ability to perform real-time event correlation, using threads, alerts, triggers, and actions to derive meaning from vast volumes of log messages.
High-Speed Indexing and Search: The platform featured high-speed indexing, capable of searching a terabyte of data in under one second, providing a "Google-like" search experience for quick and accurate queries.
Technical Capabilities: The CorreLog Solution Suite offered a wide array of capabilities including endpoint management, application security, behavioral analytics, real-time monitoring, network monitoring, threat intelligence, event logs, file integrity monitoring, compliance tracking, log management, automated help-desk ticketing, reporting, and scorecard functionality.
5. Leadership & Management
Executive Team
George Faucher (President & CEO): George Faucher was the founder, President, and CEO of CorreLog, Inc.
6. Talent and Growth Indicators
Hiring Trends and Workforce
Prior to its acquisition, CorreLog had approximately 15 employees as of 2015, growing to about 74 employees at some point before the acquisition. Following its acquisition by BMC in October 2018, CorreLog no longer operates as an independent entity, and its workforce has been integrated into BMC's operations. Therefore, independent hiring trends or employee sentiment specific to "CorreLog" are not separately tracked.
7. Social Media Presence and Engagement
Digital Footprint
Before its acquisition by BMC, CorreLog, Inc. had a limited social media presence. An example includes a video posted on YouTube in October 2018 titled "The GDPR Aftermath: How Lack of Real-Time Alerts Can Cost Millions." Post-acquisition, any relevant social media activity and engagement related to CorreLog's technology are integrated into BMC's corporate social media channels, particularly concerning the BMC AMI Security product family.
8. Recognition and Awards
Industry Recognition
While specific independent industry awards for CorreLog, Inc. as a standalone entity are not prominently detailed, its products, such as the CorreLog SIEM Correlation Server, received positive reviews. Customers praised its ease of installation, scalability, robust features, and competitive pricing, especially for compliance-related tasks. The solution was noted for its quick implementation, enabling prompt monitoring and alerts.
9. Competitive Analysis
Major Competitors
CorreLog operated in the competitive Security Information and Event Management (SIEM) market. Its top competitors included:
Splunk: A major player in SIEM and operational intelligence, known for its data platform for searching, monitoring, and analyzing machine-generated big data.
Sumo Logic: Offers a cloud-native SIEM and log management platform.
Exabeam: Specializes in User and Entity Behavior Analytics (UEBA) and next-generation SIEM.
IBM Security QRadar: A comprehensive SIEM platform that provides security intelligence, log management, and network activity monitoring, powered by AI.
Other Competitors: Atera Networks, SolarWinds, Snare Alliance, LLC, Oohlalog, and RSM Partners Ltd.
CorreLog differentiated itself through its focused expertise in real-time log management, advanced correlation, auto-learning capabilities, and strong support for mainframe security event monitoring across various platforms. At the time of its acquisition, CorreLog held a 0.03% market share in the SIEM category, compared to LogRhythm's 3.41%.
10. Market Analysis
Market Overview
The Security Information and Event Management (SIEM) market is dynamic and undergoing significant growth, driven by the increasing sophistication of cyber threats and stringent regulatory compliance requirements. The global SIEM tools market was valued at USD 5.94 billion in 2024 and is projected to reach USD 11.86 billion by 2033, with a compound annual growth rate (CAGR) of 7.91%. The managed SIEM services market is also experiencing robust growth, expected to reach USD 21,707.2 million by 2030, at a CAGR of 16.5%. Key drivers for this growth include the surge in cloud-based SIEM solutions, increased frequency of cyberattacks, and rising data breach costs. CorreLog operated within this market, providing real-time threat detection, incident response, and comprehensive compliance reporting. North America held the largest share of the SIEM market (42.6% in 2023).
11. Strategic Partnerships
CorreLog maintained strategic alliances and field integrations with various leading SIEM solutions to enhance interoperability within the cybersecurity ecosystem.
SIEM Integrations: Its SIEM Agent had certified integrations with major SIEM solutions like IBM Security QRadar, HP ArcSight, Splunk, LogRhythm, and McAfee Enterprise Security Manager. This allowed customers to leverage their existing IT security investments.
* Xbridge Systems: In 2016, CorreLog partnered with Xbridge Systems to unveil a comprehensive data loss prevention (DLP) and real-time event auditing solution specifically for IBM z/OS mainframe security and compliance.
12. Operational Insights
CorreLog's operational strengths were rooted in its ability to offer a comprehensive, easy-to-install, and highly interoperable SIEM solution. The company emphasized rapid deployment, claiming customers could achieve operational monitoring and alerts within hours. Its distinct competitive advantages included deep correlation functions, high-speed indexing for search, robust mainframe support, and flexible reporting tailored for a wide array of regulatory requirements. The solution's small footprint and minimal system resource consumption contributed to its operational efficiency. CorreLog also provided free versions of its Windows Agent and Windows Tool Kit to enable standard syslog capability for Microsoft platforms.
13. Future Outlook
Strategic Roadmap
Following its acquisition by BMC in October 2018, CorreLog's strategic roadmap and future directions are integrated into BMC's overall product strategy, particularly within its BMC AMI Security product family. CorreLog's security management capabilities for mainframes were combined with BMC's mainframe solutions to deliver end-to-end solutions, ensuring the availability, performance, and security of critical applications and data on modern mainframes. This integration aims to provide real-time visibility into mainframe security events, directly feeding into SIEM/SOC systems, and offering a comprehensive view of mainframe threat activity. CorreLog's underlying technology continues to power features within BMC AMI Command Center for Security, providing dashboard views, SIEM correlation, and alerts for security events from z/OS. Additionally, BMC AMI Defender products leverage CorreLog's capabilities to deliver real-time mainframe access data, offering a unified, multi-platform view of security events. This strategic integration by BMC is designed to enhance mainframe security offerings and simplify compliance for customers.
