Contributed a review of ArcSight Enterprise Security Manager (ESM): The CORR engine and ability to build complex correlations from simple 'building blocks' are the most valuable features for us.