Expert Insight: Symantec Enterprise Vault

Symantec Enterprise Vault (EV), which featured in our recent "E-mail Archiving and Management (EAM) Report" started out in 1999 as KVS.” In 2004, Veritas acquired KVS for $225 million, completing a heady and rapid journey -- from start-up obscurity to a division of a multibillion-dollar Goliath in just five years.

While best known for its sales of security and antivirus products, Symantec generates a sizable percentage of its revenues from its availability and performance management offerings, as well as its broad compliance tool-set. As Symantec likes to say: It provides the tools to enable you to use your technology with confidence. Within this large corporate structure, EAM comes under the Data Center Management Solutions Group, which is itself part of the Enterprise Availability division.

Symantec Enterprise Vault (EV) offers one of the more comprehensive EAM solutions on the market today. This solution set does just about everything, and it does much ofit well. Widely assumed the clear market leader (in terms of revenue), EV appears on many shortlists -- often as the vendor to beat.

The product has at least one major weakness, though: relying on Alta Vista for searching and indexing. Alta Vista has reached the end of its life, and though Symantec asserts that it won’t move away from this solution, EV customers have consistently told us that search and retrieval can be very slow. This has been enough of a shortcoming for some customers who have to routinely run complex queries (e.g., for discovery) to switch to other systems.

As the EAM market goes through a period of upheaval and change, many credible alternatives to EV have emerged. Additionally, the EV technology has been through a couple of ownership changes in a short time, and the development team has had considerable – if expected – staff turnover. We expect some time to pass before things settle down.Capture

EV supports all the key methods of capture, including journaling, scheduled capture, andPSTs. Interestingly, you can use almost any combination of the capture methods to meet yourspecific needs, rather than one or another. Additionally, you can weight indexing associatedwith the captured messages so the system creates a full, medium, or brief index. The full indexincludes the message and any relevant attachment content; the medium index consists of allrelevant metadata content from the message or attachment; and the brief index includes onlythe headers.

Symantec recognizes that all email is not equal and that it makes sense to brieflyindex some sections of the archive content and to reserve the full index -- with concomitantperformance impact -- to certain individuals or departments. We liked the capture option that sweeps the Journal itself in real time, lessening the load on the messaging server.

Policy Management
End users can apply retention policy to emails within their Outlook or Notes client with theUser Classification Engine (UCE). Of note, unlike some of its competitors, Symantec does agood job of semi-automating this “manual” process. The system scans the email and applies anumber of classification options for the user to select, such as "Personal," "Business," or "Junk."To configure email supervisory/monitoring reviews, EV uses the separately licensedCompliance Accelerator.

Designed specifically for broker-dealers and the financial services, Compliance Accelerator addresses SEC 17a-4, NASD 3010, and 3110 email retention and compliance requirements. Still, it should work perfectly well for any regulated or self-regulating firm that wants to closely monitor email traffic. Compliance Accelerator pulls batches, which you configure, out of EV and places them on a structured workflow review path. All in all, EV provides very comprehensive controls and options. You can then review the search results and, where required, annotate and question them.

The Automated Classification Engine (ACE) automatically classifies and potentially tagscaptured messages using pre-configured rules. At the capture point, ACE separates out junkfrom true business information and presumably archives only the business-criticalinformation. Just as importantly, ACE applies retention schedules to different types of content.Using a Web-based editor, you can configure the rules independently or trigger predefined ruletypes, such as anti-money laundering, chain mail, or sexual harassment.Typical rule settings include keywords, file names, and recipients. You can also use Active Directory groups. In a nutshell, ACE captures email via the journaling function, passes it to a policy engine that applies tags and retention rules, and then returns it to the Enterprise Vault for archiving. ACE typically requires a separate installation and the re-routing of captured mail before it enters the archive.

One final point: EV integrates with a range of Enterprise Content Management (ECM) products, including Documentum/EMC and Interwoven. EV captures and archives files from these sources, and can recognize and apply the retention policies within those systems as well.

Next Page: Retrieval, reporting, and licensing

Retrieval

EV offers Discovery Accelerator as an add-on module to provide extra functionality to thestandard capabilities. This legal discovery tool supports archive-wide searches based on amixture of criteria such as date ranges, content types, personnel, and so forth. Following asimple but effective work flow, the tool pulls these emails back into a block to be reviewedand exported to -- for example -- a PST format for review and legal counsel. DiscoveryAccelerator supports legal holds and the tagging of retrieved data to further add granularity tothe findings.

To fully leverage the capabilities of Discovery Accelerator, you should use it withACE. In addition, Discovery Accelerator also has an API to support third-party analytic tools. Overall, Discovery Accelerator ranks as one of the best discovery options we have seen in an EAM product set.EV also creates and indexes an HTML version of each file, which you may see as either a plus or a minus. On the one hand, this future proofs the archive contents to some degree, because HTML will always be an accessible file format. On the other hand, you end up with a very large archive with potential performance impacts.

Reporting and analytics

EV has good reporting options within some of the modules, such as Vault Monitoring, but the product suffers -- as do many of its competitors -- from weak report presentation and analytics. The data is there, but accessing and ultimately displaying it can be kludgey. In fairness, most vendors drop the ball here, but any potential buyer needs to take a closer look at this before getting in too deep.

General user experience
Overall, the user experience within EV is good. Full marks go to Symantec for providing a centralized console for both archiving and policy management which simplifies administration, potentially down to a single individual.

Licensing

Symantec bases licensing on a per-user/per-module basis. With so many individual modules, this licensing model cuts both ways for the buyer. On the one hand, you only need buy theessentials, rather than committing to a suite of products that can quickly become redundant. On the other hand, the price can escalate quickly as you add modules to the bundle. The standard Information Foundation bundle may give you all the product modules that you need, and includes the email security options.

Conclusion

In summary, the EV product set has been well conceived, well designed, and well tested in the marketplace. Sometimes it seems like a Swiss army knife, with a tool for every occasion.Many enterprises truly need that breadth, but you can find simpler and, depending on thecircumstances, equally practical and efficient tools on the market.— Alan Pelz-Sharpe is a principal at CMS Watch, covering ECM technologies and practices. Formerly he was a Strategist at Wipro and VP North America for Industry Analyst firm Ovum. An 18-year veteran of the document technology industry, Alan has written extensively on document, Web, and records management topics and delivered keynotes at events around the world.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Byte and Switch's editors directly, send us a message.