The ArcSight log collection mechanism is simple and it supports a large number of devices. Rules, Report and Dashboard can be customized based on the user requirements and hence it helped a lot to impress our customers. Additionally, ArcSight has tight integration with incident response tools such as HP Threat Response Manager, CIRT and Encase. ArcSight provides platform to integrate third party dashboard tools such as idashboard and Tableau. Also HP ArcSight inbuild case management is very simple and can be exported to external HP service Manager.
Improvements to My Organization
ArcSight helps to track all configuration changes and correlates with corresponding service tickets. Hence, helps a lot in auditing system and network admins with minimal time and cost. ArcSight use cases which helps us to detect insider threats as well as external attacks. Before implementing SIEM, these were not detected by manual monitoring process. Lastly, ArcSight helps the human resource team and Fraud management team in incident analysis and provides forensic data as needed. This was always a challenge to the team previously.
Room for Improvement
As of now, HP doesn’t have healthy integration of flows, this could use significant improvement. High Availability is a major concern for all of our customers, HP needs to significantly improve in HA.
Use of Solution
I have been using this solution for the last 6 years.
No. ArcSight implementation is simple and robust.
Yes. ArcSight Logger and Connector appliance RAID failed sometimes.
Customer Service and Technical Support
Customer Service: Good.Technical Support: HP support needs to improve a lot. For solving one ticket HP support takes a lot of time and there is no proper problem management process.
I have been working with ArcSight since I started my career.
Straightforward. All the components are clubbed into single installable so installation is very simple and straight forward.
Vendor. They had a good amount of ArcSight implementation experience.
Other Solutions Considered
We evaluated Alien Vault.
I would recommend buying ArcSight.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Jun 11 2014