ArcSight Enterprise Security Manager (ESM) Reviews

ESM is primarily a logger, so we implement it for Security Operation Centers (SOCs) across various customers and domains. This includes government, banking, financial security, insurance, healthcare, defense, and homeland security departments. In our region, the public sector also uses ArcSight ESM for security purposes.

First of all, ArcSight is a renowned name. ArcSight's technology and use cases are well-established and widely utilized. Customers prefer experienced vendors with industry expertise. We have a team of over 20 pre-sales and post-sales resources who are experts in deploying ArcSight within crucial networks and infrastructures. So, it's the combination of a well-known name, a proven track record, and the expertise to deploy it effectively.

The most valuable feature is the correlation of different logs that are collected. Any application can collect logs, but ESM excels at performing regression and correlation on that data to display meaningful information for SOC analysts.

ArcSight ESM supports our team or department in meeting compliance requirements. It provides some industry-related use cases by default, which directly map to controls like those related to MITRE framework.

There are 800 to 1000 rules related to MITRE that help us to deploy ArcSight, as well as specific rules related to compliance frameworks like PCI.

These are considered "extenders" that extend compliance and other standards. They combine individual rules into packages that can be deployed in ArcSight. So, in one place, we can monitor logs according to industry standards within our ESM.

However, we still need to find the right approach for specific packages based on the types of devices and logs we receive. We need to enable or disable rules based on our actual customer traffic compared to the existing user rules.

That's why we first need to check our organization's traffic and compare it to our current user rules. If the rules are applicable, then we enable or disable them.

There's also a dashboard that provides a better understanding of the rules. You can see how many rules are created within 24 hours and which ones trigger most frequently. This information is helpful in managing the rules effectively.

ArcSight (ESM) streamlines or optimizes incident detection and response in our organization.

ArcSight collects logs from numerous sources, including firewalls, Check Point, Unix, and others. These logs are forwarded to a central log management hub, called the "Log Forwarding and Transformation Hub."

Once there, the logs are transformed and then forwarded to the ESM. Inside the ESM, there are two key components: the Persistor and the Correlator. The Persistor handles event processing, while the Correlator is where we use code to create correlation rules.

These rules allow us to monitor for specific threats in real-time, such as MitM attacks. We also have use cases for various scenarios, including events and compliance checks. These are all configured based on specific products and customer needs. When an event matches a correlation rule, the ESM triggers an alert on our dashboard in the "Active Channel."

For real-time threat monitoring, there's a tool called the ESM console. This tool automatically triggers the rules we've created when a matching event occurs, and the information is reflected on the console. So, our SOC team monitors it 24/7.

We use the solution for detection and alerting.

The quantity of technology that supports integration with it and the other analytics features are also powerful.

We primarily as a Security Information and Event Management (SIEM) solution.

I am a solution architect. I use it on project basis. 

It enhances our web detection and response capabilities.

It gives better overall visibility. Before, we didn't have a unified system for managing security alerts. ArcSight introduced various alerts, giving us a better visibility of potential problems.

It identifies the logs we send. It has identified many potential threats through various alerts.

Our use cases are for both a government-based entity and an international oil and gas entity, and so our use cases flow for security across both domains. Very similar threat cases are created, but they're targeted specifically for the client's operating environment, including standard access control, endpoint control, and things like that. The use cases themselves vary from active directory exploits to endpoint exploits. We use it for real-time alerting, so we run an alert-centric model that we partnered with a log service and we do a discovery centric model on the back end, so we have a hybrid.

Some of the benefits of using this solution are rapid correlation and near-time response on alerts.

ArcSight Enterprise Security Manager (ESM) is used in the customer side, specifically where there is an investment because the solution, when implemented, helps with integration. ArcSight Enterprise Security Manager (ESM) is able to ingest logs and integrate with all the third-party products, so its utility becomes higher. Integration is very important because if the solution isn't able to integrate with others, then data doesn't come under SIEM and becomes incomplete.

ArcSight Enterprise Security Manager (ESM) helped my company in terms of correlating alerts. The solution also helped in both alert-giving and understanding alerts. It also dismisses repeat alerts and removes false positives. ArcSight Enterprise Security Manager (ESM) also gives you the main reason for the alert so it saves time in terms of investigating all alerts, including false alerts, so it improved my company.

ArcSight ESM provides us the flexibility to write our own passwords and customize the solution. It lets us search and log a variety of SmartConnectors. It has 480-plus SmartConnectors. 

ArcSight's features are already ahead of many competitors, but may they could offer some more training about how to find tools, how to get them working, and how to optimize them. I'd also like to see a greater focus on cloud content and the ability to write rules from the browser.