ArcSight Analytics Reviews

We primarily use the solution for logging sources. It's for analysis.

I like their filtering and their reporting tools. 

I like their integration with many other different tool sets, which is similar to other products as well.

The solution is easy to implement.

I've found the product to be quite stable.

It's scalable.

I use ArcSight Analytics to make use cases, create rules in our SIEM, and provide services.

The most valuable features are that you get lots of connectors, which make it easy to log in to my ASM, and lots of prebuilt roles from the company. The community base also has a lot of information to configure and adapt the product. 

ArcSight Analytics is used to get a deep insight about the network.

ArcSight Analytics is used to get a deeper insight and threat analysis about the network. The solution's threat analysis gives a good view of the network. We can then compare those vulnerabilities and CVS scores worldwide and get a good understanding of how likely the network is to be hit. The kind of report ArcSight Analytics gives is really good.

ArcSight Analytics is a very scalable solution that is easy to deploy.

We use ArcSight to collect logs from our customers and allocate services.

The correlation engine is good.

The features I have found most valuable are its capabilities for behavioral analytics and anomaly detection.

ArcSight's features that can be improved include anything related to its visualization capabilities and user-friendliness.

The product is complex. The algorithm is not so complex to implement, but when you want to get anything else out of it, it is complex, actually. ArcSight is difficult to implement, you need to know what you are doing. The algorithm is easy to implement but difficult to get exactly what you want. It depends on the nature of the organization and the skill of the people who are using the tool. If there are good, skilled people using it, ArcSight is the best. If there are medium-skilled people using it, then it is less good. ArcSight needs real skills to get the information out of it.

We use this solution for monitoring our network. It does authentication failure monitoring, VPN log monitoring, internal threat monitoring, and outside threat monitoring. It also looks for IOCs and malicious activity that is originating from internet connections.

The most valuable feature is the log monitoring.

We are primarily using the solution for security alerts and correlation of security events and logs.

The ability to correlate different logs is the solution's most valuable feature.

Our primary use for this product is to cover on DCI (Data Center Interconnect) requirement and design excerpts. It is used to connect all the links from different systems and environments. We also use it to do accommodations between the systems and environments and have multiple use cases between the systems.

Our organization has improved because ArcSight allows multiple integrations with multiple systems which we did not do before using the product. There can be multiple integrations with different parts of systems that process them. This can include files, XML, how the parts of the system receive connection, a specific API, other different products like anti-virus packages, or risk prediction.

We needed a predictive function that worked with other systems. It is supposed to be possible by using different agents. There is an agent called Smart Connector. Each connector has a specific role and function and launches with specific technologies.