ArcSight Review

It has good options for shaping data and using them in very complex rules. Performance is the product's Achilles' heel.

Valuable Features

I think the ability to create rules more flexible than in other products (i.e. IBM QRadar) is its most valuable feature. It has good options for shaping data and using them in very complex rules.

Improvements to My Organization

It has increased our detective capabilities in the cybersecurity landscape. We're able to build SOC around it, and make it a central tool for detecting network compromises.

Room for Improvement

Performance is the product's Achilles' heel. The aggregation can't be done for a long period of time, i.e. one week. On top of that, in comparison to the competition, ArcSight works very slowly and the WebUI is not very user-friendly.

Use of Solution

We've been using it for 10 months and the program is still in the development phase.

Deployment Issues

There were no issues with the deployment.

Stability Issues

There have been no stability issues.

Scalability Issues

We have had no issues scaling it to our needs.

Customer Service and Technical Support

The level of technical support is low. I think HP should invest money to train support people. Furthermore, sometimes I feel they are overworked because they used to sending notifications about cases without closing them.

Previous Solutions

Previously, I worked with IBM QRadar.

Initial Setup

SIEM in general is not straightforward. I think the initial setup was simple, but to get value from this product, you have to do something more than the initial setup.

Implementation Team

We did it in-house with help from the vendor's professional services. My advice is to think first where you would like to put your collectors. Assess if your network will be able to lift extra loads, assess what logging level will be required, and if log sources are capable of delivering it.

Other Solutions Considered

ArcSight was chosen by my new company management without asking me for my opinion.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Add a Comment
Sign Up with Email