ArcSight Enterprise Security Manager (ESM) Reviews

Name: ArcSight Enterprise Security Manager (ESM)
Brand: OpenText
Rating: 4 (93 reviews)

3.9 out of 5

93 reviews
89% willing to recommend

6,331 followers

What is ArcSight Enterprise Security Manager (ESM)?UNIXBusinessApplication
Price:

ArcSight Enterprise Security Manager (ESM) is a powerful SIEM solution for analyzing, collecting, correlating, and reporting on security event information. ArcSight ESM analyzes information from all of your data sources while helping your organization maintain high security. In addition, the solution is very customizable and enables users to create their own company-specific rule sets to automatically trigger instant alerts.

Get the ArcSight Enterprise Security Manager (ESM) Buyer's Guide and find out what your peers are saying about ArcSight Enterprise Security Manager (ESM), Splunk Enterprise Security, Wazuh and more!

ArcSight Enterprise Security Manager (ESM) is the #12 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give ArcSight Enterprise Security Manager (ESM) an average rating of 7.8 out of 10. ArcSight Enterprise Security Manager (ESM) is most commonly compared to Splunk Enterprise Security: ArcSight Enterprise Security Manager (ESM) vs Splunk Enterprise Security. ArcSight Enterprise Security Manager (ESM) is popular among the large enterprise segment, accounting for 64% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 18% of all views.

Buyer's Guide

ArcSight Enterprise Security Manager (ESM)

May 2024

Get the report

Helped 772,127 peers since 2012

Featured reviews

Ramnesh Dubey

Solutions Architect at Ericsson

Feb 14, 2024

The first limitation is with the ArcSight Data Storage Manager (ADSM). ArcSight's total capacity is currently capped at 12 TB. This becomes an issue if a customer needs a longer real-time data retention period, such as exceeding 90 days or reaching a year or even ten months. Increasing the disk space beyond 12 TB is not currently possible. So, increasing the storage capacity is one area for improvement. Additionally, the real-time data retention is limited due to the 12 TB restriction. Depending on the Events Per Second (EPS) you receive, you might only be able to retain data for seven to ten days. Overall, the 12 TB limit is the main issue we face in terms of maximizing real-time data storage. Moreover, there are a few improvements I would like to see in future releases. My main suggestion for ArcSight is to simplify the deployment process. Currently, the installation process is quite complex. There are various components involved, including transformations, multiple installations, and containerization for various components. Ideally, I'd recommend that ArcSight allow the entire installation, including the ESM and database, to be completed within a single unified setup process for a streamlined experience. Additionally, having readily available and well-organized documentation for the step-by-step installation process would be incredibly helpful. I would also like to see better support.

Read full review

AbhishekMishra

Technical Lead Project Individual Contributor at DXC

Apr 27, 2022

The visualization is not very good compared to Splunk. The dashboard and the comparability with new devices could be better. For example, we have a lot of cloud infrastructure that's coming around. Nowadays, most of the appliances are cloud-based. So, the comparability of Splunk is more with cloud infrastructure. With ArcSight, we have to build FlexConnectors to integrate multiple data sources, and we need visualization in that with FlexConnectors. If you go to Splunk, they have their own apps developed, and they work more proactively compared to ArcSight. The performance and speed could be better. Technical support could be improved.

Read full review

Irfan Ali

Lead Principal Architect at Injazat Data Systems

Feb 13, 2024

The deployment does require some effort. ArcSight is one of the most complex, complicated solutions to deploy. It's a large-scale deployment. So, it has full modules to be deployed. The footprint is larger compared to some other platforms where the footprint is in single or two virtual machines, which is not the case in ArcSight. On average, two weeks or three weeks of time for deployment matters. Moreover, deployment involves more than just installing the tools. Integration with it is a second step. That takes longer than just the tool deployment. Then, after integration, you have to onboard the different log sources. Even for that, the combined time of deployment and integration is less than onboarding the different source environments. Once you do all this and then establish the correlation, only then from the customer's point of view, it's a complete deployment. From a product perspective, it is different. Some products are easier to have a fresh installation but difficult to integrate, and then they're very difficult to onboard the log sources. So, from the product point of view, when you consider a deployment, it should be considered an end-to-end deployment from zero to production-ready. And here, ArcSight is a longer platform to deploy. Moreover, it is quite difficult to maintain it because of the different components, and it can be because of the licensing model; it takes longer. It will take more effort to maintain it. Sometimes, the hardware fails, and sometimes the virtual machine fails. Sometimes, the operating system and sometimes the database separately. The more components you have, the more knobs you have to keep an eye on. Two people are required to maintain it.

Read full review

ArcSight Enterprise Security Manager (ESM) market share

As of April 2024, the market share of ArcSight Enterprise Security Manager (ESM) in the Security Information and Event Management (SIEM) category stands at 2.0%, down from 2.8% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Key learnings from peers

Valuable Features

The most valuable features of ArcSight Enterprise Security Manager (ESM) include:

- easy integrations

- flexible network monitoring

- good visibility over traffic and logs

- easy management and good dashboards

- compatibility with various platforms and network devices

- the ability to take logs from the cloud

- customizable options

- out-of-the-box rules for configuring functioning rules

- robust threat intelligence and templates

- event correlation capabilities- ease of use

- integration with third-party products

"We utilize ArcSight ESM for real-time threat detection in our organization. We have custom rules that we've developed on top of the WAN services, along with scheduled licensing activities."
"I would rate the ease of use for new users an eight out of ten, with ten being easy to use. It is a good tool."
"It gives better overall visibility. Before, we didn't have a unified system for managing security alerts. ArcSight introduced various alerts, giving us a better visibility of potential problems."

Room for Improvement

Areas for improvement in ArcSight Enterprise Security Manager (ESM) include enhancing the user interface (UI) and improving data searchability. The query language should be simplified, and the UI interface should be less complex. Users desire graphical dashboards and reporting capabilities, as well as the ability to customize fields captured in logs.

Training and documentation should be improved, and the solution could benefit from better API integration and more machine-learning capabilities. Integration with other security products and network solutions should be enhanced, and reporting should provide insightful reports for senior management.

The complexity of configuring and deploying ArcSight can be challenging for organizations, and more dynamic reporting and a modern interface are desired. AI and ML features, as well as user and identity behavior analytics, would be valuable additions.

The dashboard could be optimized and integrated more effectively with devices. Cloud scalability and improved analytics with AI/ML correlation are also desired. The initial setup should be more straightforward, and additional training and focus on cloud content would be beneficial.

The onboarding process needs improvement, and a better GUI and inclusion of intelligence tools are desired. The interface should have a more modern design, and capabilities for behavioral analytics should be integrated. The merging of Logger and ESM models is suggested for improved deployment and database management.

"We have pricing issues. ArcSight ESM may not be the most user-friendly option, and its interface is quite traditional. However, despite these aspects, we find it a good cybersecurity solution. It needs to improve the dashboards, documentation, and support as well."
"The first limitation is with the ArcSight Data Storage Manager (ADSM). ArcSight's total capacity is currently capped at 12 TB. This becomes an issue if a customer needs a longer real-time data retention period, such as exceeding 90 days or reaching a year or even ten months. Increasing the disk space beyond 12 TB is not currently possible."
"The correlation engine effectively connects different events, significantly improving our detection reach. However, limitations exist with non-default alerts, where additional costs arise for integration."

ROI

ROI from ArcSight Enterprise Security Manager (ESM) is valuable and beneficial. The ability to quickly detect and respond to events is highly valued as it allows analysts to promptly engage, isolate, and mitigate potential threats. While the ROI may not be significant in monetary terms, implementing at least one SIEM in the infrastructure is often necessary for compliance purposes.

Pricing

The pricing for ArcSight Enterprise Security Manager (ESM) varies depending on the client and is in the same price range as other solutions. The cost is considered reasonable and affordable by some users. However, others find the licensing costs to be high and believe that the price of the license could be lower.

"Pricing is good, I'd rate the pricing a seven out of ten, with ten being low price. It's better than Splunk and IBM QRadar because their pricing is based on EPS."
"The pricing model is expensive compared to open-source alternatives."
"The product licenses are inexpensive."

Popular Use Cases

The primary use case of ArcSight Enterprise Security Manager (ESM) is for correlation, aggregation, and collection of data. It is used for compliance, log retention, and general security operations.

The product can be deployed both on-premises and on the cloud. It is utilized by enterprise companies, government-based entities, and international oil and gas entities.

The use cases vary from active directory exploits to endpoint exploits, real-time alerting, and monitoring. It is also used for security information and event management (SIEM), log analysis, threat analysis, incident management, and cyber security attack detection. Integration with third-party products is important for data completeness.

It is used by administrators, security reporting and action teams, banks, and for data analytics and monitoring web traffic sources.

Service and Support

The customer service and support for ArcSight Enterprise Security Manager (ESM) have received mixed reviews. Some users have had positive experiences, mentioning that the support is very good and helpful. They appreciate the availability of 24/7 standby support and quick follow-up on logged tickets.

However, there are also negative reviews, with users stating that the support is not as good as it used to be and that it can be challenging to get timely assistance. Some users have faced challenges with ironing out specific details about technical support and payments. Additionally, there have been complaints about the quality of professional services or engineers provided by Micro Focus, the company that now owns ArcSight ESM.

Scalability

ArcSight Enterprise Security Manager (ESM) is highly scalable. Scaling up ArcSight is not a challenge and can be easily done through vertical and horizontal scaling. The solution allows for the integration of various technologies, although there were some limitations with integrating EDR.

While on-premises scaling can be a challenge, the cloud option is considered to be quite robust.

Scaling up ArcSight ESM can be costly, requiring additional investments in storage, licenses, and log processing.

Stability

The stability of the ArcSight Enterprise Security Manager (ESM) solution is generally positive. Users have mentioned that the tool is rock solid. Some users have rated the stability as eight or ten out of ten. However, there are also a few users who mentioned that stability could be better, with occasional crashes for the connector or server.

It is noted that stability depends on how well the solution is deployed and managed, and there may be challenges with complex correlations.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our ArcSight Enterprise Security Manager (ESM) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

18%

Computer Software Company

13%

Manufacturing Company

Government

Comms Service Provider

Educational Organization

Real Estate/Law Firm

Media Company

Retailer

University

Insurance Company

Energy/Utilities Company

Legal Firm

Healthcare Company

Construction Company

Outsourcing Company

Wholesaler/Distributor

Non Profit

Logistics Company

Marketing Services Firm

Performing Arts

Non Tech Company

Hospitality Company

Consumer Goods Company

Aerospace/Defense Firm

Transportation Company

Pharma/Biotech Company

Compare ArcSight Enterprise Security Manager (ESM) with alternative products

Learn more about ArcSight Enterprise Security Manager (ESM)

ArcSight Enterprise Security Manager (ESM) Features

Real-time threat detection
Visualization and reporting capabilities
Patented log management
Personalized dashboards
Scalable event monitoring
Seamless integration with your existing SOC tools
Behavior profiling
Data and user monitoring
Application monitoring
Analytics
Deployment/support simplicity

ArcSight Enterprise Security Manager (ESM) Benefits

Some of the benefits of using ESM include:

Real-time information: ArcSight ESM can correlate data from any source in real-time to detect incidents before they become a breach.

Compliance: Optional compliance packs enable packaged reports for PCI, SOX, and IT Governance.

Security analytics: With ArcSight ESM, you can build and maintain a security operation center (SOC) through big data security analytics.

Integration: ArcSight ESM allows you to integrate SOC with network operations, service desk, CMDB, business intelligence, Hadoop, email security, application security, threat feeds, and more.

Speed: ArcSight ESM provides excellent speed of event collection with patented log management tools.

Advanced detection: ArcSight ESM can detect unusual or unauthorized activities as they occur, preventing business disruptions.

Decrease threat exposure: By implementing ArcSight ESM, you reduce threat exposure because the solution detects threats in real time.

Operational efficiency: ArcSight ESM makes it possible for you to automate responses with ArcSight’s native SOAR, which saves your organization time, and therefore increases your operational efficiency.

Reviews from Real Users

Below are some reviews and helpful feedback written by ArcSight Enterprise Security Manager (ESM) users.

A Head of Professional Services at a computer software company says, “The simplicity of the solution is the most valuable aspect of the product. The product is quite mature. It's been around for a long time. The integration is easy for the most part.”

A Managing partner at a tech services company states that the solution is “Good at consolidating logs, fairly stable, and can scale.”

PeerSpot user Abbasi P., Vice President Derivatives Ops IT at a financial services firm, explains, “The user interfaces are quite good and speedy, and I like the consoles too. The typology and the setup are also good.”

A Chief Technological Officer at a tech services company says, "It is a very useful tool for intelligence building because it has many use cases and many rule sets."

An Associate Vice President at a consumer goods company comments, “We primarily use the solution for its technology including its independent logs, and those types of things. The solution offers very good monitoring. The product's log management and event management capabilities are excellent. There are a lot of really good analytical components. It helps us focus on analysis.”

ArcSight Enterprise Security Manager (ESM) was previously known as Micro Focus ArcSight, HPE ArcSight, ArcSight .