AlienVault OSSIM vs ArcSight Enterprise Security Manager (ESM) comparison

Cancel
You must select at least 2 products to compare!
Comparison Buyer's Guide
Executive Summary

We performed a comparison between AlienVault OSSIM and ArcSight Enterprise Security Manager (ESM) based on real PeerSpot user reviews.

Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed AlienVault OSSIM vs. ArcSight Enterprise Security Manager (ESM) Report (Updated: March 2024).
765,386 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"The standout feature of Sentinel is that, because it's cloud-based and because it's from Microsoft, it integrates really well with all the other Microsoft products. It's really simple to set up and get going.""There are some very powerful features to Sentinel, such as the integration of various connectors. We have a lot of departments that use both IaaS and SaaS services, including M365 as well as Azure services. The ability to leverage connectors into these environments allows for large-scale data injection.""Sentinel uses Azure Logic Apps for automation, which is really powerful. This allows us to easily automate responses to incidents.""It is able to connect to an ever-growing number of platforms and systems within the Microsoft ecosystem, such as Azure Active Directory and Microsoft 365 or Office 365, as well as to external services and systems that can be brought in and managed. We can manage on-premises infrastructure. We can manage not just the things that are running in Azure in the public cloud, but through Azure Arc and the hybrid capabilities, we can monitor on-premises servers and endpoints. We can monitor VMware infrastructure, for instance, running as part of a hybrid environment.""The automation rules and playbooks are the most useful that I've seen. A number of other places segregate the automation and playbook as separate tools, whereas Microsoft is a SIEM and SOAR tool in one.""You can fine-tune the SOAR and you'll be charged only when your playbooks are triggered. That is the beauty of the solution because the SOAR is the costliest component in the market today... but with Sentinel it is upside-down: the SOAR is the lowest-hanging fruit. It's the least costly and it delivers more value to the customer.""The dashboard that allows me to view all the incidents is the most valuable feature.""What is most useful, is that it has a good connection to the Microsoft ecosystem, and I think that's the key part."

More Microsoft Sentinel Pros →

"The paid version of the solution has reporting and better scalability options.""The most valuable features of this solution are the data correlation and vulnerability assessment.""Its user-friendliness is the most valuable. It is very easy to use and explore. The dashboard is very well packaged and integrated. You don't have to spend a lot of time in configuring it and checking out the RPM etc. It is also free and very powerful.""Better than other SIEM solutions because almost everything can be integrated.""The solution is very stable. Compared to Qradar and Splunk, it's very stable.""The most valuable features of AlienVault OSSIM are case management, ease of configuration, and investigation.""AlienVault OSSIM is an enterprise solution that sells easily. It is rated highly by organizations.""The solution is free to use."

More AlienVault OSSIM Pros →

"It makes maintenance very easy.""The solution is pretty stable.""SmartConnector: Normalization parses raw logs and converts them into CEF (common event format). This is the core of the product.""I would rate the ease of use for new users an eight out of ten, with ten being easy to use. It is a good tool.""We have been satisfied with the support.""This process has helped to improve our organization because we have centralized the intra-group security equipment logs.""The most useful features are directories, price, and live reporting.""Customization. ArcSight gives you a platform to on-board out-of-the-box devices with a more accurate way of collecting desired logs/events."

More ArcSight Enterprise Security Manager (ESM) Pros →

Cons
"The troubleshooting has room for improvement.""If Sentinel had a graphical user interface, it would be easier to use. I would also like it to be more customizable.""We're satisfied with the comprehensiveness of the security protection. That said, we do have issues sometimes where there have been global outages and we need to raise a ticket with Microsoft.""Sometimes, we are observing large ingestion delays. We expect logs within 5 minutes, but it takes about 10 to 15 minutes.""One key area that can be improved is by building a strong integration with our XDR platform.""The on-prem log sources still require a lot of development.""Sentinel can be used in two ways. With other tools like QRadar, I don't need to run queries. Using Sentinel requires users to learn KQL to run technical queries and check things. If they don't know KQL, they can't fully utilize the solution.""Sentinel's alerts and notifications are not fully optimized for mobile devices. The overall reporting and the analytics processes for the end user should also be improved. Also, the compatibility and availability of data sources and reports are not always perfect."

More Microsoft Sentinel Cons →

"AlienVault OSSIM on-premise version is more difficult to implement than the cloud version. Additionally, they should add integration between several different environments at once and improve their online knowledge base.""The price of this solution is very high and it could be cheaper.""AlienVault OSSIM is costly.""I don't like to work on OSSIM because it is unpredictable.""AlienVault OSSIM gives unwanted notifications.""We need more dashboards and we need more customization for dashboards.""The user interface could be improved.""It takes some time. It does not give me a prompt response for any such [malicious] traffic. It takes time to get that alert from the AlienVault system."

More AlienVault OSSIM Cons →

"ArcSight ESM is not easy to use and it should be integrated with other tools that have infrastructure capabilities.""ArcSight ESM could improve by adding more features and documentation. There needs to be more documentation.""I am having issues with report generation with older versions. I don't know if this is because of compatibility issues, but report generation has been a little bit difficult in older versions. It is not similar to the newer and current versions. We are looking at moving to the cloud. It would be good if ArcSight ESM can move to the cloud. They already seem to be working on this. It would also be very helpful and great if we can integrate external threat intelligence, machine learning, and AI into this solution. It has good dashboards, but they can always be better. Its stability can also be improved.""The dashboard looks a bit cumbersome.""The weakness in this system comes about because, with so many different logs, it is possible that the security analyst will lose information.""The product should include a lot more predefined scenarios so the adopted company will have knowledge and a broader skill set in security and network.""The solution could be more stable.""Customer service during the transition from HPE to Micro Focus was abysmal where it became disruptive to our service delivery."

More ArcSight Enterprise Security Manager (ESM) Cons →

Pricing and Cost Advice
  • "It comes with a Microsoft subscription which the customer has, so they don't have to invest somewhere else."
  • "It is a consumption-based license model. bands at 100, 200, 400 GB per day etc. Azure Sentinel Pricing | Microsoft Azure"
  • "Good monthly operational cost model for the detection and response outcomes delivered, M365 logs don't count toward the limits which is a good benefit."
  • "I have had mixed feedback. At one point, I heard a client say that it sometimes seems more expensive. Most of the clients are on Office 365 or M365, and they are forced to take Azure SIEM because of the integration."
  • "It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."
  • "I am just paying for the log space with Azure Sentinel. It costs us about $2,000 a month. Most of the logs are free. We are only paying money for Azure Firewall logs because email logs or Azure AD logs are free to use for us."
  • "Sentinel is a bit expensive. If you can figure a way of configuring it to meet your needs, then you can find a way around the cost."
  • "Azure Sentinel is very costly, or at least it appears to be very costly. The costs vary based on your ingestion and your retention charges."
  • More Microsoft Sentinel Pricing and Cost Advice →

  • "AlienVault pricing is the best. Whatever cost you are paying, you are getting a return on every penny... It's not like your IBM, your QRadar, or Splunk, where the cost is too high."
  • "The solution is open source, so it's free to use."
  • "OSSIM is free."
  • "The licensing fees for the non-community edition are paid on an annual basis, and there are no costs in addition to this."
  • "AlienVault OSSIM is free."
  • "We are using the community version, which can be used for free."
  • "We are using a free version of the solution. If you purchase a license there are more features available but the price is a little high. The solution should be cheaper to allow more customers to be able to afford it."
  • "The price of AlienVault OSSIM is too high sometimes for us to present to our customers. The price should be lower. We are on a three-year license to use the solution. We had to pay extra for the support."
  • More AlienVault OSSIM Pricing and Cost Advice →

  • "HPE ArcSight pricing might be more expensive than other SIEM solutions, but in my opinion it has powerful features and great flexibility in developing complex use cases."
  • "ArcSight is pretty expensive compared with its competitors. I believe that is fine as it provides value."
  • "Aggregation can help a lot in pushing down licensing costs."
  • "​It is best to be an institutional buyer and directly contact the sales team, as they can provide over-the-top discounts for bulk orders.​"
  • "Thanks to Micro Focus's licensing model, as an MSSP, we are able to see a complete return on our investment almost immediately."
  • "Customers without a ton of resources to dedicate to deployment may be better served by a managed ArcSight service."
  • "The pricing is great compared to others."
  • "The cost of the solution is not very high, although hiring a qualified analyst to work with the product is expensive."
  • More ArcSight Enterprise Security Manager (ESM) Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
    765,386 professionals have used our research since 2012.
    Comparison Review
    Vinod Shankar
    Questions from the Community
    Top Answer:Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and… more »
    Top Answer:It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for… more »
    Top Answer:We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is… more »
    Top Answer:The tool's security detection is good. It helps us with login tracking and generating reports. We aim to identify… more »
    Top Answer:AlienVault OSSIM is expensive compared to its competitors.
    Top Answer:AlienVault OSSIM gives unwanted notifications.
    Top Answer:In my market, a lot of financial companies had or have an ArcSight installation. Just because in former times it was… more »
    Top Answer:We utilize ArcSight ESM for real-time threat detection in our organization. We have custom rules that we've developed on… more »
    Top Answer:The pricing model is expensive compared to open-source alternatives, especially as your needs grow.
    Comparisons
    Also Known As
    Azure Sentinel
    OSSIM
    Micro Focus ArcSight, HPE ArcSight, ArcSight
    Learn More
    Overview

    Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

    - Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

    - Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

    - Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

    - Respond to incidents rapidly with built-in orchestration and automation of common tasks

    To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

    AlienVault OSSIM, Open Source Security Information and Event Management (SIEM), provides you with a feature-rich open source SIEM complete with event collection, normalization and correlation. Launched by security engineers because of the lack of available open source products, AlienVault OSSIM was created specifically to address the reality many security professionals face: A SIEM, whether it is open source or commercial, is virtually useless without the basic security controls necessary for security visibility.

    ArcSight Enterprise Security Manager (ESM) is a powerful SIEM solution for analyzing, collecting, correlating, and reporting on security event information. ArcSight ESM analyzes information from all of your data sources while helping your organization maintain high security. In addition, the solution is very customizable and enables users to create their own company-specific rule sets to automatically trigger instant alerts.

    ArcSight Enterprise Security Manager (ESM) Features

    • Real-time threat detection
    • Visualization and reporting capabilities
    • Patented log management
    • Personalized dashboards
    • Scalable event monitoring
    • Seamless integration with your existing SOC tools
    • Behavior profiling
    • Data and user monitoring
    • Application monitoring
    • Analytics
    • Deployment/support simplicity

    ArcSight Enterprise Security Manager (ESM) Benefits

    Some of the benefits of using ESM include:

    • Real-time information: ArcSight ESM can correlate data from any source in real-time to detect incidents before they become a breach.
    • Compliance: Optional compliance packs enable packaged reports for PCI, SOX, and IT Governance.
    • Security analytics: With ArcSight ESM, you can build and maintain a security operation center (SOC) through big data security analytics.
    • Integration: ArcSight ESM allows you to integrate SOC with network operations, service desk, CMDB, business intelligence, Hadoop, email security, application security, threat feeds, and more. 
    • Speed: ArcSight ESM provides excellent speed of event collection with patented log management tools. 
    • Advanced detection: ArcSight ESM can detect unusual or unauthorized activities as they occur, preventing business disruptions. 
    • Decrease threat exposure: By implementing ArcSight ESM, you reduce threat exposure because the solution detects threats in real time.  
    • Operational efficiency: ArcSight ESM makes it possible for you to automate responses with ArcSight’s native SOAR, which saves your organization time, and therefore increases your operational efficiency.

    Reviews from Real Users

    Below are some reviews and helpful feedback written by ArcSight Enterprise Security Manager (ESM) users.

    A Head of Professional Services at a computer software company says, “The simplicity of the solution is the most valuable aspect of the product. The product is quite mature. It's been around for a long time. The integration is easy for the most part.”

    A Managing partner at a tech services company states that the solution is “Good at consolidating logs, fairly stable, and can scale.” 

    PeerSpot user Abbasi P., Vice President Derivatives Ops IT at a financial services firm, explains, “The user interfaces are quite good and speedy, and I like the consoles too. The typology and the setup are also good.”

    A Chief Technological Officer at a tech services company says, "It is a very useful tool for intelligence building because it has many use cases and many rule sets."

    An Associate Vice President at a consumer goods company comments, “We primarily use the solution for its technology including its independent logs, and those types of things. The solution offers very good monitoring. The product's log management and event management capabilities are excellent. There are a lot of really good analytical components. It helps us focus on analysis.”

    Sample Customers
    Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
    Council Rock School District
    Lake Health, U.S. Department of Health and Human Services, Bank AlJazira, Banca Intesa, and Obrela.
    Top Industries
    REVIEWERS
    Financial Services Firm22%
    Computer Software Company11%
    Manufacturing Company8%
    Comms Service Provider8%
    VISITORS READING REVIEWS
    Computer Software Company16%
    Financial Services Firm10%
    Government9%
    Manufacturing Company7%
    REVIEWERS
    Insurance Company15%
    Recruiting/Hr Firm8%
    Transportation Company8%
    Media Company8%
    VISITORS READING REVIEWS
    Computer Software Company18%
    Comms Service Provider9%
    Government8%
    Financial Services Firm7%
    REVIEWERS
    Financial Services Firm33%
    Comms Service Provider19%
    Computer Software Company17%
    Insurance Company5%
    VISITORS READING REVIEWS
    Financial Services Firm17%
    Computer Software Company12%
    Manufacturing Company9%
    Government9%
    Company Size
    REVIEWERS
    Small Business33%
    Midsize Enterprise21%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business25%
    Midsize Enterprise16%
    Large Enterprise59%
    REVIEWERS
    Small Business53%
    Midsize Enterprise30%
    Large Enterprise17%
    VISITORS READING REVIEWS
    Small Business30%
    Midsize Enterprise19%
    Large Enterprise51%
    REVIEWERS
    Small Business32%
    Midsize Enterprise14%
    Large Enterprise54%
    VISITORS READING REVIEWS
    Small Business22%
    Midsize Enterprise15%
    Large Enterprise63%
    Buyer's Guide
    AlienVault OSSIM vs. ArcSight Enterprise Security Manager (ESM)
    March 2024
    Find out what your peers are saying about AlienVault OSSIM vs. ArcSight Enterprise Security Manager (ESM) and other solutions. Updated: March 2024.
    765,386 professionals have used our research since 2012.

    AlienVault OSSIM is ranked 16th in Security Information and Event Management (SIEM) with 26 reviews while ArcSight Enterprise Security Manager (ESM) is ranked 11th in Security Information and Event Management (SIEM) with 93 reviews. AlienVault OSSIM is rated 7.4, while ArcSight Enterprise Security Manager (ESM) is rated 7.8. The top reviewer of AlienVault OSSIM writes "An easy-to-scale open-source solution used for monitoring events on devices ". On the other hand, the top reviewer of ArcSight Enterprise Security Manager (ESM) writes "Allows for monitoring logs according to industry standards within ESM but has a total capacity capped at 12 TB, limiting real-time data retention periods". AlienVault OSSIM is most compared with Wazuh, Elastic Security, USM Anywhere, Splunk Enterprise Security and Fortinet FortiSIEM, whereas ArcSight Enterprise Security Manager (ESM) is most compared with Splunk Enterprise Security, ArcSight Intelligence, Trellix ESM, IBM Security QRadar and Elastic Security. See our AlienVault OSSIM vs. ArcSight Enterprise Security Manager (ESM) report.

    See our list of best Security Information and Event Management (SIEM) vendors.

    We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.