ArcSight Enterprise Security Manager (ESM) vs ManageEngine EventLog Analyzer comparison

Cancel
You must select at least 2 products to compare!
Comparison Buyer's Guide
Executive Summary

We performed a comparison between ArcSight Enterprise Security Manager (ESM) and ManageEngine EventLog Analyzer based on real PeerSpot user reviews.

Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed ArcSight Enterprise Security Manager (ESM) vs. ManageEngine EventLog Analyzer Report (Updated: November 2022).
657,397 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"The most useful feature for us, because of some of the issues we had previously, was the simplicity of log integrations. It's much easier with this platform to integrate log sources that might not have standard logging and things like that.""Devo provides a multi-tenant, cloud-native architecture. This is critical for managed service provider environments or multinational organizations who may have subsidiaries globally. It gives organizations a way to consolidate their data in a single accessible location, yet keep the data separate. This allows for global views and/or isolated views restricted by access controls by company or business unit.""Those 400 days of hot data mean that people can look for trends and at what happened in the past. And they can not only do so from a security point of view, but even for operational use cases. In the past, our operational norm was to keep live data for only 30 days. Our users were constantly asking us for at least 90 days, and we really couldn't even do that. That's one reason that having 400 days of live data is pretty huge. As our users start to use it and adopt this system, we expect people to be able to do those long-term analytics.""The thing that Devo does better than other solutions is to give me the ability to write queries that look at multiple data sources and run fast. Most SIEMs don't do that. And I can do that by creating entity-based queries. Let's say I have a table which has Okta, a table which has G Suite, a table which has endpoint telemetry, and I have a table which has DNS telemetry. I can write a query that says, 'Join all these things together on IP, and where the IP matches in all these tables, return to me that subset of data, within these time windows.' I can break it down that way.""One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful.""It's very, very versatile.""The alerting is much better than I anticipated. We don't get as many alerts as I thought we would, but that nobody's fault, it's just the way it is.""The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events."

More Devo Pros →

"ArcSight ESM provides us the flexibility to write our own passwords and customize the solution. It lets us search and log a variety of SmartConnectors. It has 480-plus SmartConnectors.""It is a very useful tool for intelligence building because it has many use cases and many rule sets.""The most valuable features of ArcSight ESM are the dashboards, ease of management for anyone, and simple for teams to provide reports related to cyber security. There are a lot of good features that are provided.""What I found most valuable in ArcSight Enterprise Security Manager (ESM) is its good integration with third-party products. The solution also has good core capabilities.""Stable solution with good customer service support.""The most valuable feature of ArcSight ESM is its ease of use.""The most valuable features of ArcSight ESM are ease of use and readily usable components.""Very good real-time reporting with a good dashboard."

More ArcSight Enterprise Security Manager (ESM) Pros →

"What I found most useful in ManageEngine EventLog Analyzer is its integration with other ManageEngine applications. It seamlessly integrates throughout the ManageEngine suite, and that's beneficial. I also like that the solution has chain management capabilities, it has a modular approach, and it's easy to reach the support team.""The initial setup is straightforward""It is stable.""The user interface is very good.""I have made use of technical support and am certainly very satisfied with them.""ManageEngine EventLog Analyzer is easy to gather reports to give to management. My supervisor has access to the solution and he enjoys the graphs."

More ManageEngine EventLog Analyzer Pros →

Cons
"There is room for improvement in the ability to parse different log types. I would go as far as to say the product is deficient in its ability to parse multiple, different log types, including logs from major vendors that are supported by competitors. Additionally, the time that it takes to turn around a supported parser for customers and common log source types, which are generally accepted standards in the industry, is not acceptable. This has impacted customer onboarding and customer relationships for us on multiple fronts.""Technical support could be better.""Some third-parties don't have specific API connectors built, so we had to work with Devo to get the logs and parse the data using custom parsers, rather than an out-of-the-box solution.""An admin who is trying to audit user activity usually cannot go beyond a day in the UI. I would like to have access to pages and pages of that data, going back as far as the storage we have, so I could look at every command or search or deletion or anything that a user has run. As an admin, that would really help. Going back just a day in the UI is not going to help, and that means I have to find a different way to do that.""The biggest area with room for improvement in Devo is the Security Operations module that just isn't there yet. That goes back to building out how they're going to do content and larger correlation and aggregation of data across multiple things, as well as natively ingesting CTI to create rule sets.""I would like to have the ability to create more complex dashboards.""From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments.""Some of the documentation could be improved a little bit. A lot of times it doesn't go as deep into some of the critical issues you might run into. They've been really good to shore us up with support, but some of the documentation could be a little bit better."

More Devo Cons →

"ArcSight ESM is lacking cloud scalable technology.""ArcSight ESM's UI is a little cumbersome and complex, especially for first-time and occasional users using the console manager.""The way that scaling is set up isn't very cost-effective.""The visualization is not very good compared to Splunk.""Could benefit from a more modern interface.""I am having issues with report generation with older versions. I don't know if this is because of compatibility issues, but report generation has been a little bit difficult in older versions. It is not similar to the newer and current versions. We are looking at moving to the cloud. It would be good if ArcSight ESM can move to the cloud. They already seem to be working on this. It would also be very helpful and great if we can integrate external threat intelligence, machine learning, and AI into this solution. It has good dashboards, but they can always be better. Its stability can also be improved.""Currently lacks SOAR feature.""When we need to consume old events, we have to wait for a long time. ArcSight should improve the database capability to reply to queries faster. It would also be interesting if they implemented network visibility. For example, they could add a feature like NetWitness with a model just for looking through the packets."

More ArcSight Enterprise Security Manager (ESM) Cons →

"The customization of reports could be a lot easier. It is not difficult but it could be made easier.""The first tier of customer service and support is not great.""The scalability is limited.""What I'd like to see as an improvement to ManageEngine EventLog Analyzer is for it to be more AI-driven. Having more automation would also make the solution better.""The solution should improve on its log capturing capabilities.""The solution is stable. However, there are limits. For example, we can do 2,500 Syslog events per second, but if we want to do more we have to install the distributor structure, and then we can expand how many events we can do. They could improve the stability."

More ManageEngine EventLog Analyzer Cons →

Pricing and Cost Advice
  • "I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."
  • "Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."
  • "[Devo was] in the ballpark with at least a couple of the other front-runners that we were looking at. Devo is a good value and, given the quality of the product, I would expect to pay more."
  • "Be cautious of metadata inclusion for log types in pricing, as there are some "gotchas" with that."
  • "Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products."
  • "Our licensing fees are billed annually and per terabyte."
  • "I like the pricing very much. They keep it simple. It is a single price based on data ingested, and they do it on an average. If you get a spike of data that flows in, they will not stick it to you or charge you for that. They are very fair about that."
  • "Pricing is based on the number of gigabytes of ingestion by volume, and it's on a 30-day average. If you go over one day, that's not a big deal as long as the average is what you expected it to be."
  • More Devo Pricing and Cost Advice →

  • "ArcSight can be a little bit expensive because of the area that we work in and the cost. Licensing is mostly on a yearly basis, not monthly."
  • "There is a license required for this solution."
  • "We have a license to use this solution. The price of ArcSight Enterprise Security Manager is expensive."
  • "The licensing cost is affordable if you get an enterprise license. The licensing is based on EPS, so you can probably provide a package of license for multiple ESMs with their correlational end fees. It is cost-effective."
  • "ArcSight ESM is an affordable solution, it cost approximately $200,000 for three years. This price was at a substantial discount."
  • "We're paying a fee for an MSSP, and the cost of the total cost of ArcSight ESM was approximately three to four million dollars a year. The price was less than similar solutions. We did not have additional fees."
  • More ArcSight Enterprise Security Manager (ESM) Pricing and Cost Advice →

  • "There is a license required for these solutions. The customer can choose the license type, such as an annual license purchase or a perpetual license. If the customer wants maintenance they will have to pay annually."
  • "There is a yearly subscription for the solution."
  • "ManageEngine EventLog Analyzer is a low-cost solution. It costs approximately $1,000 per month per server for a perpetual license."
  • "Licensing for ManageEngine EventLog Analyzer is paid yearly."
  • More ManageEngine EventLog Analyzer Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
    657,397 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:Devo, like other vendors, doesn't charge extra for playbooks and automation. That way, you are only paying for the side… more »
    Top Answer:I need more empowerment in reporting. For example, when I'm using Qlik or Power BI in terms of reporting for the… more »
    Top Answer:In my market, a lot of financial companies had or have an ArcSight installation. Just because in former times it was… more »
    Top Answer:It is a robust product and has multiple valuable features.
    Top Answer:The first tier of customer service and support is not great, and additional upgrades could be included.
    Top Answer:Our primary use case for this solution is detecting issues to provide customers with information.
    Comparisons
    Also Known As
    Micro Focus ArcSight, HPE ArcSight, ArcSight
    EventLog Analyzer
    Learn More
    Overview

    Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

    ArcSight Enterprise Security Manager (ESM) is a powerful SIEM solution for analyzing, collecting, correlating, and reporting on security event information. ArcSight ESM analyzes information from all of your data sources while helping your organization maintain high security. In addition, the solution is very customizable and enables users to create their own company-specific rule sets to automatically trigger instant alerts.

    ArcSight Enterprise Security Manager (ESM) Features

    • Real-time threat detection
    • Visualization and reporting capabilities
    • Patented log management
    • Personalized dashboards
    • Scalable event monitoring
    • Seamless integration with your existing SOC tools
    • Behavior profiling
    • Data and user monitoring
    • Application monitoring
    • Analytics
    • Deployment/support simplicity

    ArcSight Enterprise Security Manager (ESM) Benefits

    Some of the benefits of using ESM include:

    • Real-time information: ArcSight ESM can correlate data from any source in real-time to detect incidents before they become a breach.
    • Compliance: Optional compliance packs enable packaged reports for PCI, SOX, and IT Governance.
    • Security analytics: With ArcSight ESM, you can build and maintain a security operation center (SOC) through big data security analytics.
    • Integration: ArcSight ESM allows you to integrate SOC with network operations, service desk, CMDB, business intelligence, Hadoop, email security, application security, threat feeds, and more. 
    • Speed: ArcSight ESM provides excellent speed of event collection with patented log management tools. 
    • Advanced detection: ArcSight ESM can detect unusual or unauthorized activities as they occur, preventing business disruptions. 
    • Decrease threat exposure: By implementing ArcSight ESM, you reduce threat exposure because the solution detects threats in real time.  
    • Operational efficiency: ArcSight ESM makes it possible for you to automate responses with ArcSight’s native SOAR, which saves your organization time, and therefore increases your operational efficiency.

    Reviews from Real Users

    Below are some reviews and helpful feedback written by ArcSight Enterprise Security Manager (ESM) users.

    A Head of Professional Services at a computer software company says, “The simplicity of the solution is the most valuable aspect of the product. The product is quite mature. It's been around for a long time. The integration is easy for the most part.”

    A Managing partner at a tech services company states that the solution is “Good at consolidating logs, fairly stable, and can scale.” 

    PeerSpot user Abbasi P., Vice President Derivatives Ops IT at a financial services firm, explains, “The user interfaces are quite good and speedy, and I like the consoles too. The typology and the setup are also good.”

    A Chief Technological Officer at a tech services company says, "It is a very useful tool for intelligence building because it has many use cases and many rule sets."

    An Associate Vice President at a consumer goods company comments, “We primarily use the solution for its technology including its independent logs, and those types of things. The solution offers very good monitoring. The product's log management and event management capabilities are excellent. There are a lot of really good analytical components. It helps us focus on analysis.”

    Your organizations IT infrastructure generate huge amount of logs every day and these machine generated logs have vital information that can provide powerful insights and network security intelligence into user behaviors, network anomalies, system downtime, policy violations, internal threats, regulatory compliance, etc. However, the task of analyzing these event logs and syslogs without automated log analyzer tools can be both time-consuming and painful if done manually.

    EventLog Analyzer provides the most cost-effective Security Information and Event Management (SIEM) software on the market. Using this Log Analyzer software, organizations can automate the entire process of managing terabytes of machine generated logs by collecting, analyzing, correlating, searching, reporting, and archiving from one central location. This event log analyzer software helps to monitor file integrity, conduct log forensics analysis, monitor privileged users and comply to different compliance regulatory bodies by intelligently analyzing your logs and instantly generating a variety of reports like user activity reports, historical trend reports, and more.

    Offer
    See Devo in Action

    See how Devo allows you to free yourself from data management, and make machine data and insights accessible.

    Learn more about ArcSight Enterprise Security Manager (ESM)
    Learn more about ManageEngine EventLog Analyzer
    Sample Customers
    United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel
    Lake Health, U.S. Department of Health and Human Services, Bank AlJazira, Banca Intesa, and Obrela.
    Moody National Bank, EnCircle, Goldleaf Financial Solutions, Inc, IBM, Ernst & Young, Micro Linear, Silverbeck-Rymer Solicitors, Provincial Court of British Columbia, Eleventh Judicial Circuit of Florida, OGILVY & MATHER, E! Entertainment, Tribune-Review Publishing Co.
    Top Industries
    REVIEWERS
    Computer Software Company50%
    Comms Service Provider10%
    Retailer10%
    Insurance Company10%
    VISITORS READING REVIEWS
    Computer Software Company21%
    Comms Service Provider12%
    Government9%
    Financial Services Firm9%
    REVIEWERS
    Financial Services Firm32%
    Comms Service Provider21%
    Computer Software Company16%
    Insurance Company5%
    VISITORS READING REVIEWS
    Computer Software Company20%
    Comms Service Provider15%
    Financial Services Firm11%
    Government9%
    VISITORS READING REVIEWS
    Computer Software Company23%
    Government11%
    Comms Service Provider10%
    Financial Services Firm5%
    Company Size
    REVIEWERS
    Small Business21%
    Midsize Enterprise21%
    Large Enterprise58%
    VISITORS READING REVIEWS
    Small Business23%
    Midsize Enterprise16%
    Large Enterprise62%
    REVIEWERS
    Small Business29%
    Midsize Enterprise14%
    Large Enterprise57%
    VISITORS READING REVIEWS
    Small Business22%
    Midsize Enterprise15%
    Large Enterprise62%
    REVIEWERS
    Small Business25%
    Midsize Enterprise63%
    Large Enterprise13%
    VISITORS READING REVIEWS
    Small Business26%
    Midsize Enterprise19%
    Large Enterprise55%
    Buyer's Guide
    ArcSight Enterprise Security Manager (ESM) vs. ManageEngine EventLog Analyzer
    November 2022
    Find out what your peers are saying about ArcSight Enterprise Security Manager (ESM) vs. ManageEngine EventLog Analyzer and other solutions. Updated: November 2022.
    657,397 professionals have used our research since 2012.

    ArcSight Enterprise Security Manager (ESM) is ranked 10th in Security Information and Event Management (SIEM) with 23 reviews while ManageEngine EventLog Analyzer is ranked 14th in Security Information and Event Management (SIEM) with 6 reviews. ArcSight Enterprise Security Manager (ESM) is rated 7.4, while ManageEngine EventLog Analyzer is rated 7.6. The top reviewer of ArcSight Enterprise Security Manager (ESM) writes "Used for cyber security by cyber security professionals for incident management and for analysis". On the other hand, the top reviewer of ManageEngine EventLog Analyzer writes "Easy to adopt and easy to learn but doesn't expand very well". ArcSight Enterprise Security Manager (ESM) is most compared with Splunk, IBM QRadar, McAfee ESM, LogRhythm SIEM and ArcSight Interset / Intelligence, whereas ManageEngine EventLog Analyzer is most compared with ManageEngine Log360, Splunk, SolarWinds Kiwi Syslog Server, Fortinet FortiAnalyzer and Wazuh. See our ArcSight Enterprise Security Manager (ESM) vs. ManageEngine EventLog Analyzer report.

    See our list of best Security Information and Event Management (SIEM) vendors.

    We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.