ArcSight Enterprise Security Manager (ESM) Reviews

ArcSight ESM supports our team or department in meeting compliance requirements. It provides some industry-related use cases by default, which directly map to controls like those related to MITRE framework.

There are 800 to 1000 rules related to MITRE that help us to deploy ArcSight, as well as specific rules related to compliance frameworks like PCI.

These are considered "extenders" that extend compliance and other standards. They combine individual rules into packages that can be deployed in ArcSight. So, in one place, we can monitor logs according to industry standards within our ESM.

However, we still need to find the right approach for specific packages based on the types of devices and logs we receive. We need to enable or disable rules based on our actual customer traffic compared to the existing user rules.

That's why we first need to check our organization's traffic and compare it to our current user rules. If the rules are applicable, then we enable or disable them.

There's also a dashboard that provides a better understanding of the rules. You can see how many rules are created within 24 hours and which ones trigger most frequently. This information is helpful in managing the rules effectively.

ArcSight (ESM) streamlines or optimizes incident detection and response in our organization.

ArcSight collects logs from numerous sources, including firewalls, Check Point, Unix, and others. These logs are forwarded to a central log management hub, called the "Log Forwarding and Transformation Hub."

Once there, the logs are transformed and then forwarded to the ESM. Inside the ESM, there are two key components: the Persistor and the Correlator. The Persistor handles event processing, while the Correlator is where we use code to create correlation rules.

These rules allow us to monitor for specific threats in real-time, such as MitM attacks. We also have use cases for various scenarios, including events and compliance checks. These are all configured based on specific products and customer needs. When an event matches a correlation rule, the ESM triggers an alert on our dashboard in the "Active Channel."

For real-time threat monitoring, there's a tool called the ESM console. This tool automatically triggers the rules we've created when a matching event occurs, and the information is reflected on the console. So, our SOC team monitors it 24/7.

Our use cases are for both a government-based entity and an international oil and gas entity, and so our use cases flow for security across both domains. Very similar threat cases are created, but they're targeted specifically for the client's operating environment, including standard access control, endpoint control, and things like that. The use cases themselves vary from active directory exploits to endpoint exploits. We use it for real-time alerting, so we run an alert-centric model that we partnered with a log service and we do a discovery centric model on the back end, so we have a hybrid.

Some of the benefits of using this solution are rapid correlation and near-time response on alerts.

ArcSight monitors any down time with patch management. Whenever any project is on-boarded such as in our security core or asset and wealth management technology, the hardware goes through ArcSight. That is basically our use case whether we're doing the patch management, or the upgrades on that tool, or managing the centralized desktop. ArcSight monitors the failures in the cloud. We have the tech classifications in the CMDB which is integrated with ArcSight and ArcSight pulls out everything on the CMDB and I'm able to see it all - the CMDB database and the CVS scores which are also integrated in ArcSight. I can know that for a particular monitoring track or detected incident, this is the particular CVS score. I'm a VP and enterprise architect, and we're customers of ArcSight. 

The user interfaces are quite good and speedy, and I like the consoles too. The typology and the setup are also good. It's very similar to QRadar, so it's user friendly although I believe QRadar rates better. 

ESM is primarily a logger, so we implement it for Security Operation Centers (SOCs) across various customers and domains. This includes government, banking, financial security, insurance, healthcare, defense, and homeland security departments. In our region, the public sector also uses ArcSight ESM for security purposes.

First of all, ArcSight is a renowned name. ArcSight's technology and use cases are well-established and widely utilized. Customers prefer experienced vendors with industry expertise. We have a team of over 20 pre-sales and post-sales resources who are experts in deploying ArcSight within crucial networks and infrastructures. So, it's the combination of a well-known name, a proven track record, and the expertise to deploy it effectively.

The most valuable feature is the correlation of different logs that are collected. Any application can collect logs, but ESM excels at performing regression and correlation on that data to display meaningful information for SOC analysts.

We primarily as a Security Information and Event Management (SIEM) solution.

I am a solution architect. I use it on project basis. 

It enhances our web detection and response capabilities.

It gives better overall visibility. Before, we didn't have a unified system for managing security alerts. ArcSight introduced various alerts, giving us a better visibility of potential problems.

It identifies the logs we send. It has identified many potential threats through various alerts.

It is our SIEM of choice in our managed SIEM services offering. Its multi-tenant capability, virtually universal connector framework, and licensing model made it the clear choice to deliver a value-add as an MSSP.

Without it, we would not have a managed SIEM offering to speak of. We spent over a year evaluating leading competitors and ArcSight was the clear winner. It opened up a completely new line of business for us.

We use this solution as a SIEM monitoring tool in our enterprise and for customers who have been using it, like shared operations. It's mostly used for cyber security by cyber security professionals for incident management and analysis.

The solution can be deployed on-prem and on the cloud. It depends on the requirements. We mainly use AWS, but Azure is also used.

We have analysts and architects using this solution. There are more than 20 people who are specialists and are using it. The team can be as large as more than 100 people. It all depends upon infrastructure and the clients that the particular infrastructure is supporting.

Usability is the most valuable feature. The accessibility is quite good. If a new person wants to be trained in this product, it's easy for them to be trained, as opposed to other products like Splunk or Sentinel.

ArcSight is good, and it's also scaling up.

We use the solution for detection and alerting.

The quantity of technology that supports integration with it and the other analytics features are also powerful.