We execute some of the implementation steps and take help from our vendor for a few.

Implementation was done in-house.

We had one agent come out to our office to assist us with the implementation.

We implemented the solution through an integrator.

We got help from the vendor during implementation. Without the vendor's help, I would say it's very, very difficult to implement ArcSight Logger and maintain. It's a very complex tool, so we need to have vendor support for implementation.

It can be difficult to set up connectors to ingest and normalize different log types initially.

We worked with a partner for the implementation.

My current deployment was not a complex environment. It was very easy to deploy and connect with the different connectors. I had deployed the solution approximately three times in my career. 

With a complex environment, the deployment was approximately two days whereas with a really complex environment the setup would require around 15-20 connectors.

We used a subcontractor for the first part of the installation, and finished it off in-house.

Implementation of anything this size and scope in a large company requires a lot of work. So getting outside assistance or additional staffing for deployment and support is recommended.

We're using a vendor team.

We implement arcsight solution for the customers. We posses skill set for the implementation.

We deployed this solution ourselves.

We did it through a vendor team. Proper planning in place ensures smooth execution.

We have our own in-house SIEM administration and implementation team which handles all the activities for multiple customers.