I implemented different open source solutions before switching to ArcSight Analytics. Open source solutions were not able to meet the requirements in terms of event correlation, log parsing, normalization, integration, and alerts.

I'm also familiar with QRadar and Splunk. Most SIEM tools to me have similar qualities. For example, QRadar compared to ArcSight is probably a little more user-friendly. Splunk is a more robust version of ArcSight's Logger Platform. All of them have different qualities for different components.

We used previouly Loglogic. We acquired it for investigation purposes so that we can learn more about who is connected to the server.

We sometimes use different solutions. We have RSA and ArcSight implementations. We use RSA to do networking and the use of ArcSight depends on the need of the customer. Sometimes there are customers who ask for RSA. Sometimes there are customers who have knowledge about ArcSight and they like what it provides and the features it has but they want to improve how they use it in their system. There is no need to have a new system to implement a new solution. 

We did not switch. This is the first time we have done such an installation.

I have used other log management solutions including Splunk and Elasticsearch. I also use QRadar as a more general SIEM.

This is the first solution of its kind that we deployed.

We did not use another solution prior to this one.