Go Premium for a chance to win a PS4. Enter to Win



Posted on 2011-03-03
Medium Priority
Last Modified: 2012-05-11
Anyone have experience using ArcSight and if so, what is your opinion of the product?
Question by:samrog777
LVL 65

Accepted Solution

btan earned 2000 total points
ID: 35034518
i see one of the strong area (out of their many suite) is in log management. it ranked among the top for SIEM domain especially in aggregation and correlation of the intelligence source (which you define and they can customised connector to it - or they called it flexconnector). it has also geared towards the emerging threat such as advanced persistent threat - the key is to identify the indicator and shorten the actionable response (which they also include upon detecting anomalies in the log). There is a cascaded chaining of the appliance for the scale up (or down) support depending on the environment (or sensor deployed). it does not really go into sensor but "collect" from them as typical SIEM product does. I would not drill into their spec details but can check out this link for comparison (not latest but have the parameter for consideration in SIEM)


having said that, nothing comes free and they can be steep but it depends on your business requirement and security needs. maybe for a security operation centre that is running 24x7, the ROI is justifiable but for SME, there can be other options (such as splunk etc). of course, I am not saying they are the best SIEM solution but would be already been deployed by many (based on their case study and partners). they also have research projects with public sectors which show motivation to innovate and contribute back.

nonetheless, it depends on what solution you are looking at and simply ask who are their competitors and have comparison checks, can be easily googled too. primarily, have the business needs satisfy and scale down according based on the security appetite (have some risk assessment)

the question which we may want to ask them is what role do they play in a cloud environment and handle the increasing big chunks of data and log (balancing with security needs) .... just some thoughts


Author Closing Comment

ID: 35059907
Thanks for the input. Much appreciated.  We have ArcSight ESM & Logger installed and I am finding it to be a beast to maintiain. For us, it is just yet another application we  have to use and this product appears to require a dedicated person.

Featured Post

WatchGuard Case Study: Museum of Flight

“With limited money and limited staffing, we didn’t have a lot of choices in terms of what we could do to bring efficiency. WatchGuard played a central part in changing that.” To provide strong, secure Wi-Fi access within the museum, Hunter chose to deploy WatchGuard’s AP120 APs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Will you be ready when the clock on GDPR compliance runs out? Is GDPR even something you need to worry about? Find out more about the upcoming regulation changes and download our comprehensive GDPR checklist today !
When you put your credit card number into a website for an online transaction, surely you know to look for signs of a secure website such as the padlock icon in the web browser or the green address bar.  This is one way to protect yourself from oth…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question