ArcSight Enterprise Security Manager (ESM) Reviews

Name: ArcSight Enterprise Security Manager (ESM)
Brand: OpenText
Rating: 4 (96 reviews)

3.9 out of 5

96 reviews
88% willing to recommend

6,337 followers

What is ArcSight Enterprise Security Manager (ESM)?

ArcSight Enterprise Security Manager (ESM) is a powerful SIEM solution for analyzing, collecting, correlating, and reporting on security event information. ArcSight ESM analyzes information from all of your data sources while helping your organization maintain high security. In addition, the solution is very customizable and enables users to create their own company-specific rule sets to automatically trigger instant alerts.

Get the ArcSight Enterprise Security Manager (ESM) Buyer's Guide and find out what your peers are saying about ArcSight Enterprise Security Manager (ESM), Wazuh, Splunk Enterprise Security and more!

ArcSight Enterprise Security Manager (ESM) is the #14 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give ArcSight Enterprise Security Manager (ESM) an average rating of 7.8 out of 10. ArcSight Enterprise Security Manager (ESM) is most commonly compared to Wazuh: ArcSight Enterprise Security Manager (ESM) vs Wazuh. ArcSight Enterprise Security Manager (ESM) is popular among the large enterprise segment, accounting for 63% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 19% of all views.

Buyer's Guide

ArcSight Enterprise Security Manager (ESM)

November 2024

Get the report

Helped 814,649 peers since 2012

Featured reviews

Ramnesh Dubey

Solutions Architect at Ericsson

The first limitation is with the ArcSight Data Storage Manager (ADSM). ArcSight's total capacity is currently capped at 12 TB. This becomes an issue if a customer needs a longer real-time data retention period, such as exceeding 90 days or reaching a year or even ten months. Increasing the disk space beyond 12 TB is not currently possible. So, increasing the storage capacity is one area for improvement. Additionally, the real-time data retention is limited due to the 12 TB restriction. Depending on the Events Per Second (EPS) you receive, you might only be able to retain data for seven to ten days. Overall, the 12 TB limit is the main issue we face in terms of maximizing real-time data storage. Moreover, there are a few improvements I would like to see in future releases. My main suggestion for ArcSight is to simplify the deployment process. Currently, the installation process is quite complex. There are various components involved, including transformations, multiple installations, and containerization for various components. Ideally, I'd recommend that ArcSight allow the entire installation, including the ESM and database, to be completed within a single unified setup process for a streamlined experience. Additionally, having readily available and well-organized documentation for the step-by-step installation process would be incredibly helpful. I would also like to see better support.

Read full review

Irfan Ali

Lead Principal Architect at Injazat Data Systems

The deployment does require some effort. ArcSight is one of the most complex, complicated solutions to deploy. It's a large-scale deployment. So, it has full modules to be deployed. The footprint is larger compared to some other platforms where the footprint is in single or two virtual machines, which is not the case in ArcSight. On average, two weeks or three weeks of time for deployment matters. Moreover, deployment involves more than just installing the tools. Integration with it is a second step. That takes longer than just the tool deployment. Then, after integration, you have to onboard the different log sources. Even for that, the combined time of deployment and integration is less than onboarding the different source environments. Once you do all this and then establish the correlation, only then from the customer's point of view, it's a complete deployment. From a product perspective, it is different. Some products are easier to have a fresh installation but difficult to integrate, and then they're very difficult to onboard the log sources. So, from the product point of view, when you consider a deployment, it should be considered an end-to-end deployment from zero to production-ready. And here, ArcSight is a longer platform to deploy. Moreover, it is quite difficult to maintain it because of the different components, and it can be because of the licensing model; it takes longer. It will take more effort to maintain it. Sometimes, the hardware fails, and sometimes the virtual machine fails. Sometimes, the operating system and sometimes the database separately. The more components you have, the more knobs you have to keep an eye on. Two people are required to maintain it.

Read full review

Gaurav Ranade

CTO at Rah Infotech Pvt Ltd

ArcSight is a legacy technology, and many customers want AI-powered technologies integrated with it. That hasn't been done yet, but ArcSight needs to catch up with the newer solutions and technologies available in the market. It can't just rely on the legacy technology from 2010 or 2012. You can't run that in 2024. It's a legacy technology with its own limitations. Customers often face issues that other software or newer solutions can resolve easily. That's the main challenge we face from customers right now. So, the only concerns are that AI needs to be integrated and scalability improved. Those are the main areas to be improved.

Read full review

ArcSight Enterprise Security Manager (ESM) mindshare

As of November 2024, the mindshare of ArcSight Enterprise Security Manager (ESM) in the Security Information and Event Management (SIEM) category stands at 1.2%, down from 1.8% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Key learnings from peers

Last updated Sep 18, 2024

Valuable Features

The most valuable features of ArcSight Enterprise Security Manager (ESM) include:

- easy integrations

- flexible network monitoring

- good visibility over traffic and logs

- easy management and good dashboards

- compatibility with various platforms and network devices

- the ability to take logs from the cloud

- customizable options

- out-of-the-box rules for configuring functioning rules

- robust threat intelligence and templates

- event correlation capabilities- ease of use

- integration with third-party products

"The most valuable feature is the correlation of different logs that are collected."
"On the positive side, ArcSight ESM's performance was excellent. It was very fast when writing queries. It provided good performance monitoring and had built-in rules to show which rules triggered most often and impacted performance. This performance monitoring was well-implemented."
"Support is very good."

Room for Improvement

Areas for improvement in ArcSight Enterprise Security Manager (ESM) include enhancing the user interface (UI) and improving data searchability. The query language should be simplified, and the UI interface should be less complex. Users desire graphical dashboards and reporting capabilities, as well as the ability to customize fields captured in logs.

Training and documentation should be improved, and the solution could benefit from better API integration and more machine-learning capabilities. Integration with other security products and network solutions should be enhanced, and reporting should provide insightful reports for senior management.

The complexity of configuring and deploying ArcSight can be challenging for organizations, and more dynamic reporting and a modern interface are desired. AI and ML features, as well as user and identity behavior analytics, would be valuable additions.

The dashboard could be optimized and integrated more effectively with devices. Cloud scalability and improved analytics with AI/ML correlation are also desired. The initial setup should be more straightforward, and additional training and focus on cloud content would be beneficial.

The onboarding process needs improvement, and a better GUI and inclusion of intelligence tools are desired. The interface should have a more modern design, and capabilities for behavioral analytics should be integrated. The merging of Logger and ESM models is suggested for improved deployment and database management.

"The only concern is that AI needs to be integrated"
"I faced some problems implementing certain attacks, which was my biggest concern. The visualization wasn't very good, and I couldn't create good monitoring dashboards."
"It would be nice to have it on the cloud so that you can deploy it easily, saving time and resources."

ROI

ROI from ArcSight Enterprise Security Manager (ESM) is valuable and beneficial. The ability to quickly detect and respond to events is highly valued as it allows analysts to promptly engage, isolate, and mitigate potential threats. While the ROI may not be significant in monetary terms, implementing at least one SIEM in the infrastructure is often necessary for compliance purposes.

Pricing

The pricing for ArcSight Enterprise Security Manager (ESM) varies depending on the client and is in the same price range as other solutions. The cost is considered reasonable and affordable by some users. However, others find the licensing costs to be high and believe that the price of the license could be lower.

"Price-wise, ArcSight ESM was a bit high compared to competitors, which factored into our decision to switch to Splunk. It couldn't cover all our business needs for what we wanted to implement."
"Pricing is good, I'd rate the pricing a seven out of ten, with ten being low price. It's better than Splunk and IBM QRadar because their pricing is based on EPS."
"The pricing model is expensive compared to open-source alternatives."

Popular Use Cases

The primary use case of ArcSight Enterprise Security Manager (ESM) is for correlation, aggregation, and collection of data. It is used for compliance, log retention, and general security operations.

The product can be deployed both on-premises and on the cloud. It is utilized by enterprise companies, government-based entities, and international oil and gas entities.

The use cases vary from active directory exploits to endpoint exploits, real-time alerting, and monitoring. It is also used for security information and event management (SIEM), log analysis, threat analysis, incident management, and cyber security attack detection. Integration with third-party products is important for data completeness.

It is used by administrators, security reporting and action teams, banks, and for data analytics and monitoring web traffic sources.

Service and Support

The customer service and support for ArcSight Enterprise Security Manager (ESM) have received mixed reviews. Some users have had positive experiences, mentioning that the support is very good and helpful. They appreciate the availability of 24/7 standby support and quick follow-up on logged tickets.

However, there are also negative reviews, with users stating that the support is not as good as it used to be and that it can be challenging to get timely assistance. Some users have faced challenges with ironing out specific details about technical support and payments. Additionally, there have been complaints about the quality of professional services or engineers provided by Micro Focus, the company that now owns ArcSight ESM.

Deployment

ArcSight Enterprise Security Manager (ESM) setup can range from easy to very complex, depending on the infrastructure and client's needs. Skilled technicians may complete deployment in a few days to several weeks. Some users describe it as straightforward, while others find it technical and challenging, requiring specialized knowledge. Deployment duration varies widely from days to months, influenced by environment specifics and integration requirements. Proper documentation and expertise are crucial for a smooth setup process.

Scalability

ArcSight Enterprise Security Manager (ESM) is highly scalable. Scaling up ArcSight is not a challenge and can be easily done through vertical and horizontal scaling. The solution allows for the integration of various technologies, although there were some limitations with integrating EDR.

While on-premises scaling can be a challenge, the cloud option is considered to be quite robust.

Scaling up ArcSight ESM can be costly, requiring additional investments in storage, licenses, and log processing.

Stability

The stability of the ArcSight Enterprise Security Manager (ESM) solution is generally positive. Users have mentioned that the tool is rock solid. Some users have rated the stability as eight or ten out of ten. However, there are also a few users who mentioned that stability could be better, with occasional crashes for the connector or server.

It is noted that stability depends on how well the solution is deployed and managed, and there may be challenges with complex correlations.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our ArcSight Enterprise Security Manager (ESM) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

19%

Computer Software Company

14%

Manufacturing Company

10%

Government

10%

Educational Organization

Real Estate/Law Firm

Retailer

University

Comms Service Provider

Legal Firm

Media Company

Energy/Utilities Company

Insurance Company

Healthcare Company

Construction Company

Outsourcing Company

Non Profit

Performing Arts

Wholesaler/Distributor

Logistics Company

Hospitality Company

Transportation Company

Non Tech Company

Recreational Facilities/Services Company

Aerospace/Defense Firm

Compare ArcSight Enterprise Security Manager (ESM) with alternative products

Learn more about ArcSight Enterprise Security Manager (ESM)

ArcSight Enterprise Security Manager (ESM) Features

Real-time threat detection
Visualization and reporting capabilities
Patented log management
Personalized dashboards
Scalable event monitoring
Seamless integration with your existing SOC tools
Behavior profiling
Data and user monitoring
Application monitoring
Analytics
Deployment/support simplicity

ArcSight Enterprise Security Manager (ESM) Benefits

Some of the benefits of using ESM include:

Real-time information: ArcSight ESM can correlate data from any source in real-time to detect incidents before they become a breach.

Compliance: Optional compliance packs enable packaged reports for PCI, SOX, and IT Governance.

Security analytics: With ArcSight ESM, you can build and maintain a security operation center (SOC) through big data security analytics.

Integration: ArcSight ESM allows you to integrate SOC with network operations, service desk, CMDB, business intelligence, Hadoop, email security, application security, threat feeds, and more.

Speed: ArcSight ESM provides excellent speed of event collection with patented log management tools.

Advanced detection: ArcSight ESM can detect unusual or unauthorized activities as they occur, preventing business disruptions.

Decrease threat exposure: By implementing ArcSight ESM, you reduce threat exposure because the solution detects threats in real time.

Operational efficiency: ArcSight ESM makes it possible for you to automate responses with ArcSight’s native SOAR, which saves your organization time, and therefore increases your operational efficiency.

Reviews from Real Users

Below are some reviews and helpful feedback written by ArcSight Enterprise Security Manager (ESM) users.

A Head of Professional Services at a computer software company says, “The simplicity of the solution is the most valuable aspect of the product. The product is quite mature. It's been around for a long time. The integration is easy for the most part.”

A Managing partner at a tech services company states that the solution is “Good at consolidating logs, fairly stable, and can scale.”

PeerSpot user Abbasi P., Vice President Derivatives Ops IT at a financial services firm, explains, “The user interfaces are quite good and speedy, and I like the consoles too. The typology and the setup are also good.”

A Chief Technological Officer at a tech services company says, "It is a very useful tool for intelligence building because it has many use cases and many rule sets."

An Associate Vice President at a consumer goods company comments, “We primarily use the solution for its technology including its independent logs, and those types of things. The solution offers very good monitoring. The product's log management and event management capabilities are excellent. There are a lot of really good analytical components. It helps us focus on analysis.”

ArcSight Enterprise Security Manager (ESM) was previously known as Micro Focus ArcSight, HPE ArcSight, ArcSight .