ArcSight Logger Reviews

What other advice do I have?

Arcsight was a technology we used for CM security information event management. We deployed it when I was an Information Security Senior Engineer in a company that provided electricity and water for Casablanca and neighboring cities. Arcsight was a requirement for the ISO27001 standard. It was a requirement because the company was certified. For the first audit, we presented the roadmap that contained the deployment of that kind of solution. After that, we launched an offering to different information system providers. We choose Arcsight as the CM solution. A requirement of our local…

What is our primary use case?

We have several uses for this solution like retention storage. We use Logger for some queries since we are in Talco industries. We use it for IT, MSISDN, and mobile phone. For the SM we have communication for the infrastructures including security. Plus, we use ESM for prevention and for a couple of cases we use it for fraud prevention and some for the VIP members check.

What other advice do I have?

I would rate it a nine out of ten. I wouldn't give any solution a perfect ten.

What is our primary use case?

We use the on-premise version of ArcSight Logger.

What other advice do I have?

I would rate this solution as ten out of ten. Whenever I talk about the product I tell the user to start easy, not to take the whole package and to try to use it quickly. Start with the basics, then you can ramp up fluidly. Sometimes the client or customer wants to take it urgently so at that moment it will be more difficult to use. I prefer to take the product step by step.

What is our primary use case?

We focus mainly on the enterprise market where the customers have the requirement for log management and compliance. And most of the time we propose ESM along with the logger for SIEM requirements. We have multiple Logger customers here in Sri Lanka where we've implemented and maintained solutions for them.

What other advice do I have?

I would advise anyone looking to implement this solution to have a good understanding of your infrastructure and to verify your architecture. You should be able to get an idea of their road map for the next five years to just verify what sort of effect it will be making on your system. On a scale of one to ten, I would rate it an eight.

What is our primary use case?

ArcSight logger was used for storing your logs, long-term, in a structured way. You can search in it, you can structure your data in it, and you can generate simple reports.

What other advice do I have?

We are involved with technology that allows us to solve problems for clients that they cannot solve themselves. These are often complex environments. This solution has still been in use over the past year. We have a client who has the full ArcSight Suite. We are working on a solution to phase out Logger in the coming year and replace it with Elastic or Splunk. We can replace ArcSight entirely by Splunk and use Elastic for fast search. We think that there is more progress in that platform. I would rate this solution a six out of ten.

What is our primary use case?

We primarily use the solution for monitoring all of our perimeter - from critical assets to less critical ones. It covers IT assets, networks, databases, servers, endpoints, etc.

What other advice do I have?

We are using the on-premises deployment model. There are people who say "Oh, ArcSight is losing its position and it's complex or it's not a good solution." I do not agree. I know that the biggest companies in the world are still working with ArcSight. It's the most comprehensive solution. It contains many features that are useful for enterprise-level organizations. If a company has a team that wants to go deeper and get the most features out of developing a real SOC, they should look for a very robust, scalable, multi-tenant solution. The solution should also be able to manage data analytics…

What is our primary use case?

We are a service provider and this solution is deployed on-premises for some of our customers. It is primarily used for firewall and Windows events.

What other advice do I have?

This is a solution that is straightforward and easy to use. It is user-friendly and not complex. I would rate this solution an eight out of ten.

What is our primary use case?

We use this solution for archiving log feeds.

What other advice do I have?

I am the technical support person for all of our on-site components. My advice for anybody who is implementing this solution is to use ArcSight ESM to correlate the logs and display them on the dashboard. I would rate this solution an eight out of ten.