ArcSight Intelligence Reviews

We use ArcSight Intelligence for some user behavioral analytics. The solution is used to integrate the logs properly with different Unix-based and Microsoft-based connectors. The solution gives us alerts on a single console to give us clear visibility of the total network and filter the unnecessary false positives.

The most valuable feature of ArcSight Intelligence is a single console where the entire dashboard gives all the connected details in a single place. Using ArcSight Intelligence, all the log sources we get from various sources can be integrated.

One of the most valuable features of ArcSight Intelligence is its ease of use. This is not just one functionality; multiple aspects contribute to it. For instance, it's easy to write rules, and as you do so, the rules get populated automatically, making it simple to understand the commands.

The product could be improved in several areas; it currently requires significant enhancement. Compared to QRadar and Splunk, ArcSight Intelligence falls behind, placing it as the third choice among these software options.

All network devices send their logs to the ArcSight logger as Syslog. Logs may include power failure, link failure, multiple failed login attempts, successful user login failure, and more. Security logs are stored in ArcSight's database for up to 90 days (this can be varied depending on the environment). Examples of security logs include authentication and authorization failures, incorrect logins, and wrong passwords; non-security logs such as link and device failure, module failure, STP logs, and unicast/multicast storm problems. These are some of the primary uses of the ArcSight Logger. 

It didn't. It requires a high expertise.

We have a subscription service to gather global intelligence from the cloud. Within that, we get various feeds. We can get notifications about various types of global attacks that are happening. We can also get updates for our correlation engines from these subscriptions. We are using its latest version.

We found the correlation engine to be very good. It takes logs from different types of devices and does the correlation in a good way.

We use the platform for monitoring purposes.

The product has a valuable interface. It provides easy access and can present all the analyses in a single report. Another key advantage is compartmentalization in terms of ease of understanding.