ArcSight Logger Reviews

The solution is used for searching and test reports.

The provisioning engine is a valuable feature of the solution.

It is really difficult to work in ArcSight Logger, as it is very slow. I have worked three times on these logs due to their slow functioning.

If it changes completely, I think there will be two issues. Firstly, if they are using big data, then it will be very costly, and it will be enhanced with service protocol. Secondly, I see a lot of customers in Saudi Arabia coming overseas to vendors to get the ArcSight Logger version which uses big data for searching.

I have been using ArcSight Logger for nine years.

It is a scalable solution. You can create tools and add more than one program to one board. A total of fifteen users are using ArcSight Logger at the moment.

The technical support team is good.

The initial setup is straightforward. The maintenance is good. We deployed the solution on-premises, as there is some restriction on the cloud, and customers prefer it on on-premises as it is cheaper.

If you are willing to work with ArcSight Logger, you must be aware of the security reasons as an institution. The security advantages should be known to understand the functionalities, and you also have to be familiar with VNX strategies.

I rate the overall solution a three out of ten.

We have several uses for this solution like retention storage. We use Logger for some queries since we are in Talco industries. We use it for IT, MSISDN, and mobile phone. For the SM we have communication for the infrastructures including security. Plus, we use ESM for prevention and for a couple of cases we use it for fraud prevention and some for the VIP members check.

The ESM use cases are the most valuable. It enables us to use the big data collection inside our company. We are able to create use cases for whatever it suits and I find that the most interesting part of any SIEM solution.

The speed of Logger indexing and searching for certain bugs for some queries that we provide could be improved. It can handle a huge number of logs but it can be improved.

They should improve the speed of the indexing and queries being dumped. Technical support's response time could also be slightly improved. Although these two issues are not something bad, it's just the only things that I think have any possibility to improve, but they're not necessarily something that is bad.

It is pretty much stable. From time to time we have cases of a connector crashing so the drama processing it is when it gets stuck but that is just an occasional case.

It's pretty much scalable. You can just add remote connectors and you can add remote log types. One of the best parts of the product is FlexConnector. Implementing them is easy to configure. 

We have twenty users using this solution that mostly compromise of information security guys and cybersecurity. There are IT infrastructure engineers like Windows Unix engineers and some Talco fraud prevention specialists.

We have two guys operating this solution in these three countries so we require two to three people to maintain the whole thing.

Their technical support is also good. Whenever we request anything they are arprompt and the guys are well trained. Any customer could say that it could be faster but I understand that we are not alone in this world. They have plenty of other customers so I completely understand. I would rate their support a nine out of ten. There is always room for more of a prompt response but I'm talking about hours, not days.

I was new to cybersecurity when I joined my company and they were implementing it at the time so the initial setup was a bit complex for me. When I got introduced to it for the first time and got thousands and thousands of pages of documentation it was a bit complex for me to fully understand how it works and how it functions. At this point, I don't think it's complex. It's pretty much straightforward and it's not complex for an experienced IT or security guy. 

The full implementation took one year, but there was a huge number of connectors that we implemented across three countries including Hungary, Serbia, and Montenegro. There were a huge number of connectors and a huge number of connector servers. I believe that that's why it took a year, it might have been a bit less. 

I would rate it a nine out of ten. I wouldn't give any solution a perfect ten. 

The tool helps us to collect, correlate and publish logs on our site. 

I am impressed with the product's ability to pick up logs. It also has UEBA which has reduced the time to take charge of the events. 

The product's connectors should work better and the user manuals need an update. 

I have been working with the product for three years. 

I would rate the tool's stability a nine out of ten. 

I would rate the product's scalability a ten out of ten. 

The level 3 engineers do not work in our time zone. Hence, we need to wait until late at night for support. You may get an answer not today but only tomorrow or the day after. 

Neutral

The tool's setup is neither simple nor difficult. 

I would rate the product a seven out of ten since it's an enterprise product. 

I would rate the tool a seven out of ten. 

The functionalities of this particular server is absolutely phenomenal. The server has the ability to provide in-depth, real-time awareness of all actives on the network.

The platform also gives the administrators the ability to turn off some of the options displayed in case they don't need to see those specific sections.

The ability to query anything at any time using any specific field required, and the ability to automate the logger storage capabilities are great features.

Before the logger was installed on our network, we were very limited as to what type of information we could get back from our previous logger because the old one didn't have as many functionalities.

With ArcSight Logger, our ability to have a more in-depth look into the network traffic and the ability to save the reports for a set amount of time was a huge improvement.

The only thing I did not particularly like about the product was its speed on the web interface. It took very long for it to populate and perform the queries.

I used this product as a network administrator for two years.

The installation of the server and its agents on the network devices went extremely smoothly. The only issue we had was finding the correct agents to install on our older UNIX-based servers for which we had to contact HP to get information on how to go about acquiring the correct agents.

We have had no issues with the stability.

We had no issues scaling it for our needs.

We never actually had to call customer support because of the technical forums available to all ArcSight users who could share information and help troubleshoot in case anything was wrong or unclear about how to set up and use the system.

We were using a different product for our monitoring and logging services. The reason why we chose to switch over was the in-depth analysis capabilities provided by HP ArcSight which were not previously available to us.

Initially, we had some trouble finding the right agents to install on our servers since we were using some proprietary software on the network, but after we got past that step, everything else was pretty straightforward.

We had one agent come out to our office to assist us with the implementation.

Start using the available resources by registering your product immediately after deploying the unit and contributing to the ArcSight community.

Also, once you decide to go with ArcSight, make sure you go with the complete solution recommended by HP based on the size of your network because that could potentially cause the ArcSight server to perform extremely slow.

Most of our clients need security devices that can monitor events such as authentication failures, incorrect logins, link, module, device, and switch failures, security events and alarms, vulnerability events, and threat logs. We are currently using ArcSight Logger and many other Syslog devices to monitor these security events and logs.

ArcSight's robustness is its most valuable feature. The solution is specifically designed to manage and aggregate large amounts of log data, making it an ideal solution for Syslog servers with a large environment of network devices and servers (both VM and physical appliances).

Using the ArcSight Logger dashboard is not particularly intuitive or efficient, so it is important to be trained in its use. Unless you have experience with the dashboard, it is not something you can easily figure out. For optimal use, it is recommended to seek out training before attempting to use the dashboard. The dashboard has room for improvement, by making it more user-friendly with fewer commands. Maintenance and troubleshooting can be complicated and complex.

I have been using the solution for five years.

The solution is extremely stable.

The solution is highly scalable. When we need to expand our license or add more sources, it's simple to do.

We had a call with technical support today to discuss the issue of their dashboard not being user-friendly. Following the call, we are setting up a demo practice to help them generate their reports in a more accessible way. They have been very cooperative and accommodating throughout the process.

Positive

Setting up the initial configuration can be quite time-consuming, as there are roughly three components to address: the ESM, the Loggers, and the Management Center or Portal. For HPE, we may need to deploy two Logger, one Management Center, and two ESMs, which can take weeks to complete. Setting up the use cases is not a straightforward process and will require two weeks to complete. There are many variables that must be adjusted and fine-tuned for optimal results.

ArcSight is an expensive solution and is difficult to setup.

I give the solution an eight out of ten.

Only a few people have access to ArcSight Logger due to the technical know-how required to use it. Not everyone is able to use the virtual as it involves sensitive information, so access is restricted to those with a technical background.

ArcSight is not recommended for small environments. ArcSight is designed for large environments and requires specialized training. Furthermore, the community of users is not as vast as other vendors, such as Cisco, and VMware. There are better options available than ArcSight, which may better suit an organization's environment.

We have just upgraded to Splunk, so we're currently in the process of converting everything over from ArcSight to Splunk.

ArcSight provides the basic information that we want.

The support structure is not very good.

They are not 100% up to date with the current technology.

ArcSight does not provide the advanced details that we require.

AI and analytics are one of the major things that are needed for better analysis.

The integration with other systems could be improved.

The interface could be improved with a better GUI.

The company has been using ArcSight Logger for between six and seven years. I joined the company six months ago, which was my first experience with it.

The stability is alright.

Scaling this product is painful.

Staff-wise, we're not very big but scale-wise, we're right across the whole world. We operate in EMEA, Mexico, and APAC.

We are not satisfied with the support.

We are now using Splunk and are moving away from ArcSight.

The pricing is quite harsh.

I would rate this solution a five out of ten.

ArcSight logger was used for storing your logs, long-term, in a structured way. You can search in it, you can structure your data in it, and you can generate simple reports. 

It's a robust, mature product and you can do some complex operations and analytics.

For correlation and structuring data, it's very good.

It's a secure platform.

ArcSight Logger is an outdated product. It hasn't been changed in the last ten years. I think that it's a product that will disappear and there are better platforms that you can use.

You have limited reporting capabilities and I wouldn't choose ArcSight Logger for this purpose. I would prefer to go with Elastic or Splunk.

You can do reporting but it's not up to date in terms of interactive reports that are presented well.

I was looking for a SIEM solution. ArcSight has ArcSight VSM, which is a pretty good product, but what I see on the market now is that is it being caught up by newer, more intuitive applications like Splunk. I wanted to have some deep technical insight in comparison of the two platforms.

If you have a product that hasn't evolved in 10 to 12 years then you have to start looking at other products. Many solutions were implemented and were useful at the time, but are outdated now.

In terms of features such as anomaly detection, or machine learning, or building apps on top of it, it's either not there or it's very limited.

With technical support, in the past when it was ArcSight, it was very good. However, when it moved to HP, then Micro Focus, the quality deteriorated. You could see that the knowledge was disappearing in the company.

They would benefit from having real clustering with some kind of high availability setup, but it's not clustering as it is in Elastic, where you put in a node and cluster and it all works together. It needs improvement and it should be much better. Also, the user interface is outdated, the search could be faster, and the integration with big data solutions isn't great for input and output.

I am an expert with ArcSight, in all of their products. I have been working with them for 15 years.

It's a stable product.

I don't call support as I have 15 years of experience. I have more experience than support, but it used to be good.

We are involved with technology that allows us to solve problems for clients that they cannot solve themselves. These are often complex environments.

This solution has still been in use over the past year. We have a client who has the full ArcSight Suite. We are working on a solution to phase out Logger in the coming year and replace it with Elastic or Splunk. We can replace ArcSight entirely by Splunk and use Elastic for fast search. We think that there is more progress in that platform.

I would rate this solution a six out of ten.

We primarily use the solution for monitoring all of our perimeter - from critical assets to less critical ones. It covers IT assets, networks, databases, servers, endpoints, etc.

The ability to customize the solution in great detail is its most valuable feature. We can customize the use cases and also have the ability to do scripting. We can personalize our dashboard as well. The scalability the solution offers is quite impressive. 

They should enhance and improve everything related to the graphical user interface. It needs to be more fluid and easy to use. Many think that ArcSight is complex and difficult. This is not something that my team feels but that's because we have acquired experience and expertise over time.

The solution should make it possible to integrate network analysis features.

The stability of the solution is good. There are very few bugs.

The scalability of the solution is very, very good.

Technical support is very responsive.

We didn't previously use a different solution.

The initial setup was straightforward. Deployment varies according to the scope of your technical parameters. Maintenance is a daily activity. I have a team of two people that are focused on the administration of the outside platform.

We implemented the solution through an integrator.

We evaluated QRadar before we implemented this solution.

We are using the on-premises deployment model.

There are people who say "Oh, ArcSight is losing its position and it's complex or it's not a good solution." I do not agree. I know that the biggest companies in the world are still working with ArcSight. It's the most comprehensive solution. It contains many features that are useful for enterprise-level organizations. 

If a company has a team that wants to go deeper and get the most features out of developing a real SOC, they should look for a very robust, scalable,  multi-tenant solution. The solution should also be able to manage data analytics and to offer User Behavior Analytics. Arcsight offers this. 

This particular solution is perfect for big companies. Smaller companies should look for integrated solutions that do not necessarily scale.

I would rate the solution nine out of ten.