ArcSight Analytics Reviews

I use ArcSight Analytics to make use cases, create rules in our SIEM, and provide services.

The most valuable features are that you get lots of connectors, which make it easy to log in to my ASM, and lots of prebuilt roles from the company. The community base also has a lot of information to configure and adapt the product. 

Currently, there are no compatible connectors for this solution, which means we have to depend on FlexConnectors. If ArcSight could launch smart, compatible connectors, it would improve trust in the product. In the next release, ArcSight should include user end-behavior analytics.

I've been working with this solution for three months.

This is a stable solution.

I've had no problems with scalability.

ArcSight's technical support is ok, but our salesperson provides personal support for touch problems, and he always has lots of solutions and resolves our problems easily. 

Positive

This solution is expensive.

I'd give ArcSight Analytics a rating of seven out of ten.

We use it as a SIEM. We're using the enterprise edition.

We have seen a measurable decrease in the mean time to detect and respond to threats. It has also definitely added to what our customer had. We are integrating a lot of tools for one of our customers and it has really helped to improve their current security posture.

The data collection and the integration with different products are valuable features.

I would like to see some advanced analytics.

The solution is scalable but it is not easy to use.

Technical support is average.

We did not switch. This is the first time we have done such an installation.

The initial setup was complex.

The monthly licensing fee is around $20,000. There aren't any costs in addition to the standard licensing fee.

We looked at Splunk and HelpSystems. There were a few more vendors but I don't recollect all their names. Because of the number of integrations that ArcSight has, it was more applicable to our use case.

You can use this solution for limited use cases. But for more advanced use cases, there are other solutions which are better than ArcSight.

I would rate this solution at five out of ten because of the complexity in maintaining it and managing it. It's not easy to use. It requires a lot of training. It needs better technical support and help with onboarding.

The features I have found most valuable are its capabilities for behavioral analytics and anomaly detection.

ArcSight's features that can be improved include anything related to its visualization capabilities and user-friendliness.

The product is complex. The algorithm is not so complex to implement, but when you want to get anything else out of it, it is complex, actually. ArcSight is difficult to implement, you need to know what you are doing. The algorithm is easy to implement but difficult to get exactly what you want. It depends on the nature of the organization and the skill of the people who are using the tool. If there are good, skilled people using it, ArcSight is the best. If there are medium-skilled people using it, then it is less good. ArcSight needs real skills to get the information out of it.

I have been using ArcSight Analytics for two years.

The stability is very good, too. Relative to LogRythm, I cannot comment much because I don't have rich experience working with LogRhythm except doing some POC’s. So it would be not great on my part to comment. But my research showed that stability-wise both are the same, LogRhythm maybe a little bit less stable. ArcSight is about a nine and LogRhythm about an eight.

The scalability is very good.

I have contacted support and would rate them about 7.5. That's because response time and resolution are good. They are fine.

The initial setup is not complex, but it does require skill. If somebody says that they can set it up in the span of weeks, I don't believe that it will not work out. If they say they can implement within and go live in one week, to what extent?

I don't want to just look at the console, we need to start giving actual values and giving actual alerts where I can start taking some actions and start showing some proper implementation in the security portion from using this tool.

The advice I would give to people who want to use ArcSight is to have patience and use the complete innovations of the tool, don't go by the superficial features. Do a total analytics of the tool to understand what value it can provide.

On a scale of one to ten I would rate ArcSight an eight.

We use this solution for monitoring our network. It does authentication failure monitoring, VPN log monitoring, internal threat monitoring, and outside threat monitoring. It also looks for IOCs and malicious activity that is originating from internet connections.

The most valuable feature is the log monitoring.

ArcSight is not a user-friendly solution and the interface needs to be improved. It is a bit tough to use for people who are inexperienced.

ArcSight needs better support for integration with third-party applications. It should be able to handle logs from all kinds of different sources.

The API needs to be improved.

I have used other log management solutions including Splunk and Elasticsearch. I also use QRadar as a more general SIEM.

This is not a solution that I would recommend. Instead, I would recommend Splunk or QRadar. In the case of an organization with a small budget, I would recommend AlientValut or Elasticsearch.

I would rate this solution a six out of ten.

Our primary use case for this solution is as a SIEM.

We're leveraging it to detect incidents and attacks. We have seen a measurable decrease, by about 20 percent, in the mean time to detect and respond to risks. It has also helped to increase staff productivity, saving 20 percent in terms of time.

One of the most valuable features is the alerts.

I would like to see orchestration.

It's very stable.

The scalability is poor. We need the ability to capture larger amounts of data.

Technical support is average.

This is the first solution of its kind that we deployed.

The initial setup was complex. It's a difficult product to navigate, it's complex. And the service was poor, back when we started with the product.

In addition to the costs of standard licensing fees, there is the cost of labor for maintenance.

Understand your data first and then find a solution that handles the data you have.

I rate the solution at four out of ten because of the complexity and the lack of ability to capture large amounts of data.

We use ArcSight to collect logs from our customers and allocate services.

The correlation engine is good.

ArcSight's features are starting to get stale. They haven't added any new features in quite a long time. They could add an easier way for a person to customize log sources. It needs more user analytics and aggregation user queries. And it's slow. When you query over ArcSight, it is very slow. 

I've been using ArcSight analytics for more than five years.

In terms of stability, ArcSight is not very good. I would say it's about average. We've had some issues but overall it's about average. This is the main issues are with reporting. Sometimes on the service end, we stop receiving logs.

ArcSight is a scalable solution.

Tech support is average. Not bad. Not good.

We haven't had any complications with the setup, and it is low maintenance. 

I would rate ArcSight six out of 10. If you are going to use ArcSight, I would recommend using it alongside another solution. ArcSight is good for correlation, but you should have another solution to handle the queries. For queries, you need a faster solution and ArcSight will not provide you with that.

We use this solution for the authentication of software.

This solution makes it easy to create use cases, and it is easy to move queries from use cases to the report to the dashboard.

The parallel logic to create queries is very helpful. 

The GUI and dashboards are very basic and need to be improved.

The product does not have continuous updates.

I would like to see easy integration with the Intelligence Suite.

I would like to see integration with automation products, such as Phantom Automation.

This is a very stable solution. It is the most stable ESM that I have worked with.

Scalability of this solution is very good.

We have twenty analysts using this solution, and we do not plan on expanding our usage at this time.

Technical support for this solution has been very helpful.

We did not use another solution prior to this one.

The initial setup of this solution is straightforward.

We used a consultant to assist us with the deployment.

This is a solution that I recommend.

I would rate this solution a seven out of ten.