Item: Arcsight by OpenText
Rating: 6
Author: Verified User

Use Cases and Deployment Scope

As a managed SOC provider, ArcSight is the base of our SOC team. We deploy event receivers (connectors and brokers) in each of our clients and the data is aggregated on our ESM. We then are able to monitor the client environment from our SOC and investigate incidents in the client environment.

Pros and Cons

Really robust tool, as it can expand to millions of EPS.
Support clustering.

ArcSight is a really complex tool, but it's not that easy to implement and maintain.
Troubleshooting issues on ArcSight can be hard if you have a large environment.

Return on Investment

ArcSight allows us to monitor all of our clients in a centralized environment.
We had to hire two engineers just to maintain/troubleshoot the Arcsight environment.

Support Rating

I personally haven't reached the support team, however, the engineers never complained about the Arcsight support team. We had some issues with the tool in the past but every time we reached the support, all issues were resolved in a timely manner.

Key Insights

Do you think Arcsight by OpenText delivers good value for the price?

Yes

Are you happy with Arcsight by OpenText's feature set?

Yes

Did Arcsight by OpenText live up to sales and marketing promises?

Did implementation of Arcsight by OpenText go as expected?

Would you buy Arcsight by OpenText again?

Other Software Used

Slack, Cisco Webex Teams (formerly Cisco Spark), Cisco Webex Meetings, Zscaler Web Security

Likelihood to Recommend

I do recommend Arcsight for clients that have a large environment and requires tons of customization. For example, if you have 10.000+ log sources, and you want to do a custom integration with ElasticSearch, then Arcsight is for you. If you have a medium-sized company, with no requirements for complex customizations, and if you're looking for an easy tool to deploy and maintain, then you should check another solution.

A good, but complex, SIEM tool

Overall Satisfaction with Arcsight Enterprise Security Manager (formerly HP Arcsight)