Contributed a review of ArcSight Enterprise Security Manager (ESM): It has flexible and rich correlation capabilities. It has the capability to manipulate every parameter - sub-strings, indexes, and custom functions.