#1 most frequent
United States of America
51.0%739 installations of 1,448
What is Arcsight by OpenText?
A combined SIEM and SOAR, used to accelerate threat detection and response with holistic security analytics, native SOAR, and intelligent automation.
Categories & Use Cases
Product Demos
Top Performing Features
Correlation
Correlation of logs and events to pinpoint significant threats
Category average: 8.4
Centralized event and log data collection
Effectiveness of real-time centralized event and log data collection
Category average: 9
Event and log normalization/management
Ability to normalize event syntax so that logs can be compared and are machine-understandable
Category average: 8.5
Areas for Improvement
Behavioral analytics and baselining
How effectively activity and behavior baselines are established and maintained
Category average: 7.5
Response orchestration and automation
Quality of built-in response orchestration and automation in Next-Gen SIEM
Category average: 7.1
Incident indexing/searching
Effectiveness of searching across structured and unstructured events and incidents within SIEM
Category average: 8.8
Who Buys & Uses Arcsight by OpenText
#2 most frequent
India
10.4%150 installations of 1,448
#3 most frequent
United Kingdom of Great Britain and Northern Ireland
4.0%58 installations of 1,448
ArcSight Intelligence SIEM(provides visibility over any devices)
Use Cases and Deployment Scope
ArcSight Intelligence here use as a SIEM tool.Through this we are able to integrated several devices through connectors and easily parse and analyze all the log sources with a single console.Our analyst easily monitor all the log sources and analyze the alerts also easily create filters according to their needs and nearly cover all kind of alerts .
Pros
- It provide a single console to monitor several connectors.
- It helps us to integrate all kind of log sources .
- It helps us to create filters and manage the specific search according to usecases.
- We can create several filter at the same time and manage all the device activity also create a parser to parse the logs from different devices.
Cons
- It is slow comparing to any other SIEM Tool.
- We have to create filter for each alerts need some custom filter .
- Here we dont have any single tab for see all the alerts .also need some attractive features for dashboard.
Most Important Features
- Any device integration with this tool.
- Coalescing the logs easily helps analysts to check all kind of alerts.
- It has the feature to notify critical alerts directly to senior analysts.
- Easily understand and parse the logs from different devices.
Return on Investment
- It is recommended for handle small enterprises.
- Cant integrate any threat intel tool so we majorly works through filters.
- It is slow takes time for large searches.
Alternatives Considered
IBM Security QRadar SIEM
Other Software Used
IBM Security QRadar SIEM, Fortinet FortiGate, Trend Micro Deep Security Smart Check
ArcSight - A better insight security solution
Pros
- Integration with smart logger and ESM to create rules and easy management of the same.
- Easy integration with all end point security management tool(IPS/IDS, Firewall, Anti-Virus) and their consolidated output at a single place to effectively rectifying true and false positives.
Cons
- There is a storage problem that should be improved for better management.
- There is need to improve the search mechanism.
Return on Investment
- It helps us a lot which managing security event and incidents.
- It is also very useful to have a dashboard for an quick overview and scheduled reports for timely checks of all activities.
- It requires more space and search management to be one of the favorites on the market.
Alternatives Considered
Elasticsearch
Other Software Used
Infoblox IPAM for Microsoft, Azure Security Center, Cylance Smart Antivirus, CylanceOPTICS, CylancePROTECT
ArcSight - Enterprise Security Manager Review
Use Cases and Deployment Scope
I use ArcSight ESM to provide security monitoring services to several customers cutting across different verticals like Finance, Oil and Gas, Retail to name a few. Our company is one of the largest Managed Security Services provider in the region and we use multiple SIEM tools to cater to the ever-growing MSSP market and ArcSight Enterprise Security Manager is one of them.
Pros
- Industry standard log parsing using CEF (Common Event Format)
- Excellent correlation capabilities
- Good overall vendor support when it comes to supporting on operational issues
Cons
- Search times are very slow and this is due to their archaic CORR database, an immediate overhaul is needed
- New plug-ins related to niche features are not rolled out timely, for example feature rich dashboards
- Featured like Machine Learning and Artificial Intelligence which are industry talks are completely missing
Return on Investment
- The overall impact is neutral since it balances the investment and returns.
- Since it is less expensive compared to its competitors, it is fairly suited in an environment with less expectations and less budget.
- It does not fit in at all where the security monitoring is at an elevated level and there are routing threat hunting exercises that need to be performed daily.
Usability
A good, but complex, SIEM tool
Pros
- Really robust tool, as it can expand to millions of EPS.
- Support clustering.
Cons
- ArcSight is a really complex tool, but it's not that easy to implement and maintain.
- Troubleshooting issues on ArcSight can be hard if you have a large environment.
Return on Investment
- ArcSight allows us to monitor all of our clients in a centralized environment.
- We had to hire two engineers just to maintain/troubleshoot the Arcsight environment.
Other Software Used
Slack, Cisco Webex Teams (formerly Cisco Spark), Cisco Webex Meetings, Zscaler Web Security
Worth having SIEM Arcsight
Pros
- Data management.
- Security rules.
- Reports can be fetched & scheduled.
- User & role management.
Cons
- Storage.
- User console is a bit heavy & takes time for loading.
- Flex development of connector.
Return on Investment
- It's a good SIEM solution. Doesn't have much negative impact.
- Customization is the best part.
- Good reporting features.
- Does require good hardware configuration.
Other Software Used
Proofpoint Advanced Threat Protection, CrowdStrike Falcon Endpoint Protection, Digital Shadows