ArcSight Intelligence vs Trellix ESM comparison

"The most valuable feature of ArcSight Intelligence is a single console where the entire dashboard gives all the connected details in a single place."

"We found the correlation engine to be very good. It takes logs from different types of devices and does the correlation in a good way."

"The platform helps us improve threat detection capabilities."

"The product has a valuable interface."

"The ability to tailor an environment to suit our specific use cases is a major advantage of ArcSight compared to other logging servers such as Splunk."

"It has performed well and delivered the results that I have been looking for."

"Compared to other solutions, the user interface is good."

"The most valuable feature for us is that it comes with many correlations, reports, and dashboards already available. It's also very easy to use."

"The ease of use is the most valuable feature. Over the years I have always been using this solution and have become comfortable with it."

"I rate the tool's deployment an eight out of ten. The deployment is completed in two days."

"The most valuable feature is for the security operation center because it provides visibility of all traffic within the company infrastructure."

"This solution integrates easily and very well with other technologies."

"The most valuable feature is the capability to correlate different events from different platforms that we feed into it."

"We haven't found the product fully scalable."

"The frequency of the updates that we are getting can be improved because the number and types of incidents that are happening at the global level are far more than what we are receiving. The frequency of updates feeds related to our rules should be increased. There should be more frequent information about the new rules that are coming and the global threats that are happening. There should be better options for dashboard creation. At present, the dashboards are good, but there is scope to make them better."

"ArcSight Intelligence's pricing needs improvement."

"ArcSight Intelligence is a bit slower, and its speed should be improved."

"The dashboard is not user-friendly and is in black and white."

"The only drawback is that they don't have any packet capturing or network behavior analysis."

"I would like to see fingerprint recognition included in the next release of this solution."

"The product is mature and needs little improvement, but we could enhance the customized dashboarding based on use cases."

"The disk space needed for events is not clear. In all clients, we had at least more than 100GB free that we could not use."

"The only issue I have with McAfee is the amount of computer resources that it takes... it's definitely impacting some of the other applications that are running on a computer at the same time."

"Customized reports and alerting functionality could be included in the dashboard."

"It is not a very advanced solution, and it is for very generic use cases. It cannot cope with the advanced requirements that we're going to have. For example, for multiple authentication failures, it is still based on Windows events for detecting multiple login failures, whereas other companies are going beyond and working on implementing two-factor authentication. It is time to correlate the two-factor authentication results with authentification failures, which is not happening with McAfee ESM. The performance of the tool should be improved because it is very slow. The data display on the console is very slow in McAfee ESM. Its data storage is still old-fashioned, and it should be improved and upgraded to the latest versions. They have to come up with some new ideas to match what other leaders in the same domain are doing. For example, in Splunk, when you search for information for the last 60 days or five months, it quickly shows the information, but that is not the case with McAfee. The results should be quicker and faster on the console. They should integrate some additional features such as User Behavior Analytics (UBA) and automation. The threat intelligence part should also be improved on McAfee."

"Tech support is required each time there is a system update of the solution."

"The solution is expensive and only suitable for enterprise environments."

"Its price is average and not very high. Splunk might be a bit cheaper than this. Its licensing is on a monthly basis."

"ArcSight Intelligence is an expensive solution."

"It is an expensive platform."

"They offer perpetual licenses for the product."

"The price is good. It's moderate. We follow a pay-as-you-go model. There are different models available, and they can also be monthly. You can choose monthly or yearly. It's very flexible. If our existing customers exceed the current plan, you can just call McAfee and get it extended."

"The licensing cost is based on EPS."

"The price of McAfee ESM is higher than some of the other solutions. There are additional features that can be added at an additional fee."

"We renew our license annually."

"The product is slightly expensive."

"Regarding pricing, Trellix ESM is not that expensive. It's less than half the cost of IBM QRadar."

"It is an inexpensive product. We purchase its yearly license."

"The pricing is fair."