Arcsight by OpenText vs. Trellix Intelligent Sandbox

In the current lot of hundreds of SIEM solutions out there in the market, ArcSight ESM is fairly less expensive with strong fundamentals in place. The log ingestion, correlation are very well performing and totally worth ROI. However, the tool has lost its way when it comes to staying abreast with current feature curve of SIEM technology and the evolution has not been done by MicroFocus. Search times are high and there is no major plug-in that has been introduced as part of the product life cycle.

Incentivized

It is suited for people who are looking to secure their PCs from malware attacks. There is also email threat prevention where it will detect unwanted mails which come through our inbox. The sandbox feature comes in handy when you want to test new applications that will prevent it spreading to multiple systems in an environment if it is malicious. It has good customer support for all our technical queries. Since pricing is quite high, small-scale organizations can't afford it.

Incentivized

• User friendly interface.
• Easy to create queries and rules to make all the things automatic.
• Backup, maintenance and support of this product are always nearly perfect.

Incentivized

• Automatic updates.
• Runs in the background.

Incentivized

• ArcSight is a really complex tool, but it's not that easy to implement and maintain.
• Troubleshooting issues on ArcSight can be hard if you have a large environment.

Incentivized

• handling exceptions if you could centralize it would be nice.
• In the same way, it could improve how the logs are seen, the board is very rough.
• At the level of final use, there is no way that it can visualize the time it takes for a scan to be carried out remotely.

Incentivized

Overall, it is a good investment in order for an organization to stay compliant and stay secure from all the wild things happening. It is definitely a cost effective tool with some good features including correlation, log storage, reporting and dashboards. If a customer is looking for advanced set of features, then I would highly not recommend this.

Incentivized

If you go for platinum support, it's good as you have priority for support. They will take remote control of your machines and troubleshoot. Also, they arrange requirement SEM depending on the issue.

Incentivized

Personally, I have only called our internal IT team about needing changes to permissions, not McAfee itself, but our IT team can make the changes though it seems to take them longer than I would think it needs to take. As someone who administers a different program, with different permissions, I would feel they should be able to make the exceptions faster and easier.

Incentivized

We are currently using Elastic search as well for better management of our devices and to keep all the loopholes filled that have been created around the non-upgraded version of Arcsight Enterprise Manager. Elastic searches have the latest mechanism to fetch logs and correlated data, as well as process them in a more useful way.

Incentivized

McAfee brand is used, mcafee antivirus scan, mcafee drive encryption, mcafee DLP, mcafee cloud proxy. He Kaspersky at the corporate level and used his admin dashboard is a bit rough. I recommend mcafee since the graphical environment is very friendly with the administrator. We selected it because at the administration level it is more comfortable, support for end users is very easy, the administration console can create roles and segregate permissions.

Incentivized

• It is recommended for handle small enterprises.
• Cant integrate any threat intel tool so we majorly works through filters.
• It is slow takes time for large searches.

Incentivized

• Its high pricing is unsuitable for our business.
• We no longer stress about any undesired invasion.
• Our data is safe and sound.

Incentivized