ArcSight Logger Reviews

We don't have a lot of use cases. We supposed the MSSP provider would have a lot of use cases, and this intelligence would be used in the contract, but it wasn't the case. 

We do have some specific situations like alerts in case of changes to extremely powerful accounts, administrative groups, and things like that.

Investigation is good when you know what you want to search for in Logger. The most difficult part is parsing the logs and configuring the parsers. For investigation, it's good. For correlation, it's not good. We use Sentinel, and Sentinel has pre-built use cases that are much easier to configure. So, it enhances our security incident investigation.

We have inbound integration, but configuring the parsers is sometimes very difficult. We only have two use cases where we have a correlation set up. We send the information to Check Point to block IP addresses when we see a lot of blocks from the same source. We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist.

So, it offers the ease of integration.

The product helps me see all the event logs in one place. When I look into the application, I can see different levels of alerts and make the required decision.

The solution provides information about the risk factors. It also provides information on our security exposure.

We use the product for Windows event management, custom application onboarding, and integration with firewalls and other security tools for log collection and security monitoring.

We encounter challenges when onboarding logs from cloud sources, so we are considering transitioning to a cloud-based solution. Additionally, we find that the search and access functionality is quite slow. It is not a scalable product, so we have to create and manage storage.

Additionally, they could include case management functionality. It would be beneficial to have both the Logger and the ESM (Enterprise Security Manager) accessible from a single interface.

The solution offers very good performance and is efficient.

The provider offered excellent training to help us successfully launch the project.

The interface is user-friendly.

The solution passed compliance thresholds and standard requirements which we hoped to satisfy at the time of launch. At our first audit, we presented the roadmap to our auditor and on the second audit, we presented plans to help us re-conduct our certification. They were able to verify the parameters and reporting. It was very successful.

The console in older versions is not user-friendly.

At one point, we experienced an RMA. However, they sent an expert to do an SDN check. Someone came to the company to verify the hardware and try to access the log just to verify what the root cause of the incident was. The hardware was replaced without incident for us.

The solution could benefit from adding in machine learning.

If deployed properly, the solution can collect logs well. The categories of logs are very high. It is very good. The solution is compatible with syslog servers. Our customers like the solution.

It is a proven technology. It is one of the best products available in the market. Loggers generally pull the logs and send them to the main orchestration device. Loggers connect to the SIEM tools, and the solutions speak to each other. It is pretty good.

If we want to increase the capacity of the SIEM tool, the events per second can be increased. Loggers are the only way to fetch the logs. It depends on the customers’ requirements. ArcSight Logger sends the logs. The SIEM system is the main component.

Less false positives will lead to a better solution. If there are more false positives, the solutions provided by the SIEM tool will be diluted. The data retention capabilities depend upon the size of the hard disk. The bigger the hard disk, the more the data can be stored. The integration with other security solutions is good. It's a proven solution in the market.

We primarily use it in our site for compliance.

The machine learning is a good feature. 

Our primary use case for this solution is incident response, investigations and log management. For example, risky network communications, communications with risky countries, and VPN connections from outside the country. We deploy the solution on-premises.

The log digestion features from threat intelligence platforms like Recorded Future or Talos are valuable.

We check a lot of logs in ArcSight Logger because we're running a massive database platform.

I had some latency issues for two months. I had to increase our storage capacity significantly to reduce the latency.