Try our new research platform with insights from 80,000+ expert users

ArcSight Enterprise Security Manager (ESM) vs Cribl comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
8.9
ArcSight ESM can offer high ROI through threat detection, compliance, audits, and brand protection despite its costs and implementation challenges.
Sentiment score
6.3
Cribl enhanced data management efficiency, delivering cost savings, improved processing speed, system performance, and operational flexibility for users.
 

Customer Service

Sentiment score
5.7
ArcSight ESM customer service is mixed, with efficient initial responses but inconsistent, often slow technical support causing dissatisfaction.
Sentiment score
6.8
Cribl customer service is praised for prompt responses, effective support, and community assistance, with a high satisfaction rating.
If I raise a P1 or P0 ticket, the response time is often delayed by four to eight hours.
The community, including the engineering and sales teams, is available on Slack and is very supportive.
 

Scalability Issues

Sentiment score
7.1
ArcSight ESM offers scalability and cloud support but faces high costs and EPS licensing challenges for growing event volumes.
Sentiment score
7.9
Cribl is scalable and easily integrates with CI/CD pipelines, receiving praise for efficient deployment and seamless cloud management.
It lacks some capabilities compared to other tools available in the market.
 

Stability Issues

Sentiment score
7.1
ArcSight ESM is stable with configuration efforts, though deployment challenges and occasional issues arise under high-load conditions.
Sentiment score
7.3
Cribl is generally rated 7-8 for stability, with minor bugs quickly addressed and continuous development enhancing reliability.
The stability of ArcSight Enterprise Security Manager (ESM) is not very robust.
 

Room For Improvement

ArcSight ESM needs interface updates, better integration, improved performance, reporting, scaling, error handling, and enhanced technical support.
Cribl needs better legacy compatibility, intuitive logging, enhanced documentation, improved onboarding, and desktop server functionality for developers.
The integration aspect of ArcSight Enterprise Security Manager (ESM) needs improvement.
Perhaps more flexibility in terms of metrics would be helpful.
 

Setup Cost

ArcSight ESM is costly but justifiable, with pricing based on EPS, scalable features, and possible bulk discounts.
Cribl offers a cost-effective, scalable pricing model with up to 30% cost reductions, appealing to mid-level and large enterprises.
ArcSight Enterprise Security Manager (ESM) is very cheap compared to other tools.
 

Valuable Features

ArcSight ESM offers seamless integration, scalability, customizable features, real-time monitoring, and extensive analytics for effective threat detection and response.
Cribl streamlines real-time data transformation, log collection, and routing with user-friendly features, security, and extensive integration support.
The ability to interpret data is highly valued.
The community on Slack is excellent for solving questions and getting ideas.
 

Categories and Ranking

ArcSight Enterprise Securit...
Ranking in Security Information and Event Management (SIEM)
19th
Average Rating
7.8
Reviews Sentiment
7.5
Number of Reviews
97
Ranking in other categories
No ranking in other categories
Cribl
Ranking in Security Information and Event Management (SIEM)
13th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
10
Ranking in other categories
Application Performance Monitoring (APM) and Observability (14th), Log Management (13th), Observability Pipeline Software (1st)
 

Mindshare comparison

As of April 2025, in the Security Information and Event Management (SIEM) category, the mindshare of ArcSight Enterprise Security Manager (ESM) is 1.1%, down from 1.6% compared to the previous year. The mindshare of Cribl is 0.5%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM)
 

Featured Reviews

Ramnesh  Dubey - PeerSpot reviewer
Allows for monitoring logs according to industry standards within ESM but has a total capacity capped at 12 TB, limiting real-time data retention periods
The first limitation is with the ArcSight Data Storage Manager (ADSM). ArcSight's total capacity is currently capped at 12 TB. This becomes an issue if a customer needs a longer real-time data retention period, such as exceeding 90 days or reaching a year or even ten months. Increasing the disk space beyond 12 TB is not currently possible. So, increasing the storage capacity is one area for improvement. Additionally, the real-time data retention is limited due to the 12 TB restriction. Depending on the Events Per Second (EPS) you receive, you might only be able to retain data for seven to ten days. Overall, the 12 TB limit is the main issue we face in terms of maximizing real-time data storage. Moreover, there are a few improvements I would like to see in future releases. My main suggestion for ArcSight is to simplify the deployment process. Currently, the installation process is quite complex. There are various components involved, including transformations, multiple installations, and containerization for various components. Ideally, I'd recommend that ArcSight allow the entire installation, including the ESM and database, to be completed within a single unified setup process for a streamlined experience. Additionally, having readily available and well-organized documentation for the step-by-step installation process would be incredibly helpful. I would also like to see better support.
Phanindra Ponnada - PeerSpot reviewer
Provides good documentation and worth the investment
As of now, there are some environments where some organizations are still on legacy infrastructure, so they are still in virtual environments and are using old versions of devices. Some companies bought Splunk, while others bought Cribl for a very low-priced license. There are some protocols to connect from Cribl to Splunk. I understand Cribl has come into the market very recently, but the tool might have had a picture in its mind where organizations might also have some legacy infrastructure. In the future, with our protocols or our level of architecture, Cribl should not come and say that it is not compatible with them. If Cribl is the reason because I have to change my environment, then I will have to end up investing more. There are some organizations where the end machines have forwarders that forward the data to Cribl, and from it, the data is forwarded to Splunk. This is how general architecture works. There are two methods of connection between Cribl and Splunk. One is the S2S protocol, which collects logs from Cribl or sends data between Cribl and Splunk. There is another method called HTTP Event Collector (HEC) and HTTPS protocol. With Cribl, connecting to Splunk mostly uses the S2S protocol. The tool supports all the latest devices and platform devices, like all the latest operating systems. There are some organizations where there is legacy infrastructure or if they are still on the old platforms. Companies using old platforms have to consider HTTP Event Collector (HEC), and then they have to change their infrastructure setup in order to fulfill that setup. In order to have Google and Splunk set up in my organization, if I have to change my existing infrastructure connectivity or setup, that might incur more cost or more investment for me to have Cribl and Splunk. Cribl should provide compatibility, or else the tool's developers should speak to the people of such organizations and understand the challenges. Cribl could have developed some version that can give backward compatibility.
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
848,396 professionals have used our research since 2012.
 

Comparison Review

VS
Jun 28, 2015
Qradar vs. ArcSight
Continuing with the SIEM posts we have done at Infosecnirvana, this post is a Head to head comparison of the two Industry leading SIEM products in the market – HP ArcSight and IBM QRadar Both the products have consistently been in the Gartner Leaders Quadrant. Both HP and IBM took over niche SIEM…
 

Top Industries

By visitors reading reviews
Financial Services Firm
19%
Computer Software Company
15%
Manufacturing Company
10%
Government
8%
Financial Services Firm
17%
Computer Software Company
10%
Healthcare Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Which is the best SIEM tool for a mid-sized financial services firm: Arcsight or Securonix?
In my market, a lot of financial companies had or have an ArcSight installation. Just because in former times it was pretty good. Now a lot of them are looking for a more effective solution due to ...
What do you like most about ArcSight Enterprise Security Manager (ESM)?
We utilize ArcSight ESM for real-time threat detection in our organization. We have custom rules that we've developed on top of the WAN services, along with scheduled licensing activities.
What is your experience regarding pricing and costs for ArcSight Enterprise Security Manager (ESM)?
ArcSight Enterprise Security Manager (ESM) is very cheap compared to other tools. It is worth the investment if you are considering the cost.
What is your experience regarding pricing and costs for Cribl?
I am not aware of the pricing details, however, I know they use a credit format for billing.
What needs improvement with Cribl?
At the moment, I don't have specific feedback on what can be improved as I do not work with Cribl daily. Perhaps more flexibility in terms of metrics would be helpful.
What is your primary use case for Cribl?
I am using Cribl to have everything centralized in one tool in terms of data collection. We were working with different Splunk customers, and Cribl helps collect data and then send it to an S3 buck...
 

Also Known As

Micro Focus ArcSight, HPE ArcSight, ArcSight
No data available
 

Overview

 

Sample Customers

Lake Health, U.S. Department of Health and Human Services, Bank AlJazira, Banca Intesa, and Obrela.
Information Not Available
Find out what your peers are saying about ArcSight Enterprise Security Manager (ESM) vs. Cribl and other solutions. Updated: April 2025.
848,396 professionals have used our research since 2012.