ArcSight Review

It has good options for shaping data and using them in very complex rules. Performance is the product's Achilles' heel.


What is most valuable?

I think the ability to create rules more flexible than in other products (i.e. IBM QRadar) is its most valuable feature. It has good options for shaping data and using them in very complex rules.

How has it helped my organization?

It has increased our detective capabilities in the cybersecurity landscape. We're able to build SOC around it, and make it a central tool for detecting network compromises.

What needs improvement?

Performance is the product's Achilles' heel. The aggregation can't be done for a long period of time, i.e. one week. On top of that, in comparison to the competition, ArcSight works very slowly and the WebUI is not very user-friendly.

For how long have I used the solution?

We've been using it for 10 months and the program is still in the development phase.

What was my experience with deployment of the solution?

There were no issues with the deployment.

What do I think about the stability of the solution?

There have been no stability issues.

What do I think about the scalability of the solution?

We have had no issues scaling it to our needs.

How are customer service and technical support?

The level of technical support is low. I think HP should invest money to train support people. Furthermore, sometimes I feel they are overworked because they used to sending notifications about cases without closing them.

Which solution did I use previously and why did I switch?

Previously, I worked with IBM QRadar.

How was the initial setup?

SIEM in general is not straightforward. I think the initial setup was simple, but to get value from this product, you have to do something more than the initial setup.

What about the implementation team?

We did it in-house with help from the vendor's professional services. My advice is to think first where you would like to put your collectors. Assess if your network will be able to lift extra loads, assess what logging level will be required, and if log sources are capable of delivering it.

Which other solutions did I evaluate?

ArcSight was chosen by my new company management without asking me for my opinion.

**Disclosure: I am a real user, and this review is based on my own experience and opinions.
Add a Comment
Guest