We have used other products, but they were not as good as ArcSight Logger. We decided to use ArcSight Logger because we wanted a unified tool that captures all the logs across all devices.

I didn't use logging tools previously, but I used Elasticsearch to prepare to use Logger, and I have the ability to build query support in ArcSight Logger.

We were using a different product for our monitoring and logging services. The reason why we chose to switch over was the in-depth analysis capabilities provided by HP ArcSight which were not previously available to us.

We are now using Splunk and are moving away from ArcSight.

We didn't previously use a different solution.

I previously used a significant RSA Envision installation that had extremely poor performance with complex queries. It was routine to wait an hour or more for a more complex query. HP ArcSight was introduced by a CISO with previous experience at a previous employer and the improvement was immediately obvious. It was a wise decision that I took with me to my next organization.

This was the first solution we've used, and I believe it will be the last solution we need.

We used an older version that was going to be replaced.

There was no previous solution in place.

We evaluated Splunk and IBM QRadar before choosing this solution.

It provides the level of flexibility and options specially to define custom use-case scenarios like no other SIEM tool, though I have experience with only one other.

Our first SIEM product is this. We chose it because it's a major player in the SIEM technology market and it's mature, even as it's in the earlier stages.