Anyone have experience using ArcSight and if so, what is your opinion of the product?
Who is Participating?
btanConnect With a Mentor Exec ConsultantCommented:
i see one of the strong area (out of their many suite) is in log management. it ranked among the top for SIEM domain especially in aggregation and correlation of the intelligence source (which you define and they can customised connector to it - or they called it flexconnector). it has also geared towards the emerging threat such as advanced persistent threat - the key is to identify the indicator and shorten the actionable response (which they also include upon detecting anomalies in the log). There is a cascaded chaining of the appliance for the scale up (or down) support depending on the environment (or sensor deployed). it does not really go into sensor but "collect" from them as typical SIEM product does. I would not drill into their spec details but can check out this link for comparison (not latest but have the parameter for consideration in SIEM)

having said that, nothing comes free and they can be steep but it depends on your business requirement and security needs. maybe for a security operation centre that is running 24x7, the ROI is justifiable but for SME, there can be other options (such as splunk etc). of course, I am not saying they are the best SIEM solution but would be already been deployed by many (based on their case study and partners). they also have research projects with public sectors which show motivation to innovate and contribute back.

nonetheless, it depends on what solution you are looking at and simply ask who are their competitors and have comparison checks, can be easily googled too. primarily, have the business needs satisfy and scale down according based on the security appetite (have some risk assessment)

the question which we may want to ask them is what role do they play in a cloud environment and handle the increasing big chunks of data and log (balancing with security needs) .... just some thoughts

samrog777Author Commented:
Thanks for the input. Much appreciated.  We have ArcSight ESM & Logger installed and I am finding it to be a beast to maintiain. For us, it is just yet another application we  have to use and this product appears to require a dedicated person.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.