ArcSight Logger vs Cribl comparison

Read 10 Cribl reviews

1,574 Views
1,210 Comparison Views

90% willing to recommend

ArcSight Logger

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 9, 2025

ArcSight Logger and Cribl compete in the realm of log management and security analytics. Cribl seems to have the upper hand due to its flexibility and real-time data transformation capabilities.

Features: ArcSight Logger offers scalability, efficient log management, and comprehensive security analytics, ideal for large-scale deployments. It also benefits from real-time correlation capabilities. Cribl focuses on real-time data transformation and routing, enhancing log collection from multiple sources. It stands out in flexibility and integration, benefiting from easy configuration.

Room for Improvement: ArcSight Logger is criticized for its complex use, outdated interface, and lack of support for certain log formats. Users report issues with speed and technical support. Cribl, while praised for simplicity, could improve its documentation and backward compatibility. Users also note the absence of comprehensive alerting features.

Ease of Deployment and Customer Service: ArcSight Logger, primarily on-premises, faces criticism for its complex deployment and mixed support, with declining support quality post-acquisition. Cribl offers more deployment options, including cloud and hybrid. It receives positive feedback for its supportive community, though there's room for improvement in documentation and support speed.

Pricing and ROI: ArcSight Logger is considered expensive, with complex licensing contributing to costs. It offers substantial ROI for large enterprises with specific requirements. Cribl is seen as cost-effective, especially for large data volumes, due to its efficiency and scalability, though it may not be the cheapest option. It supports credit-based billing and offers discounts, providing flexibility in costs.

To learn more, read our detailed ArcSight Logger vs. Cribl Report (Updated: April 2025).

ArcSight Logger vs. Cribl

April 2025

Download the complete report

Helped 850,028 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

ArcSight Logger

Ranking in Log Management

31st

Average Rating

7.8

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

No ranking in other categories

Cribl

Ranking in Log Management

13th

Average Rating

8.4

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Application Performance Monitoring (APM) and Observability (14th), Security Information and Event Management (SIEM) (13th), Observability Pipeline Software (1st)

Mindshare comparison

As of May 2025, in the Log Management category, the mindshare of ArcSight Logger is 0.8%, down from 1.1% compared to the previous year. The mindshare of Cribl is 1.6%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Geraldo Freitas

Analista de TI - suporte a redes e segurança at Tribunal de Contas da União

Enhances our security incident investigation but not good for correlation

Investigation is good when you know what you want to search for in Logger. The most difficult part is parsing the logs and configuring the parsers. For investigation, it's good. For correlation, it's not good. We use Sentinel, and Sentinel has pre-built use cases that are much easier to configure. So, it enhances our security incident investigation. We have inbound integration, but configuring the parsers is sometimes very difficult. We only have two use cases where we have a correlation set up. We send the information to Check Point to block IP addresses when we see a lot of blocks from the same source. We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist. So, it offers the ease of integration.

Read full review

Phanindra Ponnada

Splunk SME at Sbase Technologies India PVT Lmtd

Provides good documentation and worth the investment

As of now, there are some environments where some organizations are still on legacy infrastructure, so they are still in virtual environments and are using old versions of devices. Some companies bought Splunk, while others bought Cribl for a very low-priced license. There are some protocols to connect from Cribl to Splunk. I understand Cribl has come into the market very recently, but the tool might have had a picture in its mind where organizations might also have some legacy infrastructure. In the future, with our protocols or our level of architecture, Cribl should not come and say that it is not compatible with them. If Cribl is the reason because I have to change my environment, then I will have to end up investing more. There are some organizations where the end machines have forwarders that forward the data to Cribl, and from it, the data is forwarded to Splunk. This is how general architecture works. There are two methods of connection between Cribl and Splunk. One is the S2S protocol, which collects logs from Cribl or sends data between Cribl and Splunk. There is another method called HTTP Event Collector (HEC) and HTTPS protocol. With Cribl, connecting to Splunk mostly uses the S2S protocol. The tool supports all the latest devices and platform devices, like all the latest operating systems. There are some organizations where there is legacy infrastructure or if they are still on the old platforms. Companies using old platforms have to consider HTTP Event Collector (HEC), and then they have to change their infrastructure setup in order to fulfill that setup. In order to have Google and Splunk set up in my organization, if I have to change my existing infrastructure connectivity or setup, that might incur more cost or more investment for me to have Cribl and Splunk. Cribl should provide compatibility, or else the tool's developers should speak to the people of such organizations and understand the challenges. Cribl could have developed some version that can give backward compatibility.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It provides in-depth information on business activities once we log into the system."

"The log digestion features from threat intelligence platforms like Recorded Future or Talos are valuable."

"The most valuable feature is the search capability, which is simple to use."

"The most valuable feature is the level of detail that you can see about certain events, even when they do not come up in the console."

"Our return on investment for implementing ArcSight Logger over the past 12 months has been positive."

"We check a lot of logs in ArcSight Logger because we're running a massive database platform."

"The machine learning is a good feature."

"The ESM use cases are the most valuable. It enables us to use the big data collection inside our company. We are able to create use cases for whatever it suits and I find that the most interesting part of any SIEM solution."

More ArcSight Logger pros

"The capability to reduce logs in a user-friendly manner is a standout feature. Cribl allows us to view logs live as they are being processed, giving us quick feedback on the changes made."

"When it comes to the product's installation phase, it is not tough for people who have good knowledge...The tool is worth the investment."

"Cribl offers other valuable features. For instance, you can replay data from an edge device, store your daily data in a stream, and replay specific event data into Splunk if a security incident occurs"

"The support team was very helpful and managed to get everything production-ready."

"My favorite option in Cribl is the Stream product."

"Features such as Cribl Stream, Cribl LogStream, and Cribl Edge have been the most beneficial. The Cribl LogStream, in particular, is valuable for routing data, creating firewalls on pipelines, and putting security measures in place to ensure data reaches its destination without issues."

"The platform's most valuable feature is the ability to transform data in real-time within the pipeline without sending it to a destination."

"The product's most valuable features include the internal management of events, coding perspective, data processing, and serialization."

More Cribl pros

Cons

"The platform is quite expensive. They should reduce its cost."

"ArcSight has been sold two or three times, and the quality has decreased."

"The integration with other systems could be improved."

"I would like to see better scheduling in the next release of this solution."

"The solution should make it possible to integrate network analysis features."

"The speed of Logger indexing and searching for certain bugs for some queries that we provide could be improved. It can handle a huge number of logs but it can be improved."

"The console in older versions is not user-friendly."

"The initial setup was a little bit complex."

More ArcSight Logger cons

"There have been several administrative issues. Another point is that the browsing functions aren't very intuitive."

"Cribl doesn't have as many packs available"

"Cribl should consider adding more features that are applicable to smaller firms, allowing broader access to their data migration through Cribl."

"Cribl could have developed some version that can give backward compatibility."

"The sys logging could be enhanced to make it easier to identify errors, especially when dealing with multiple functions."

"There is no alerting mechanism for the leader/worker nodes status."

"There is room for improvement in the documentation and knowledge base, particularly regarding configurations like sources where logs are being ingested"

"Perhaps more flexibility in terms of metrics would be helpful."

More Cribl cons

Pricing and Cost Advice

"It's not cheap at all as it's a big product and has been in the market for quite some time now."

"ArcSight Logger is very expensive compared to their competitors, but when we talk to the customer and explain what the features are and how we can scale, they understand. Still, ArcSight is more expensive than the competition."

"We have a lifetime license, so we don't pay a monthly fee."

"ArcSight is an expensive solution."

"Pricing is reasonable compared to similar tools on the market. They offer perpetual licenses."

"The pricing is quite harsh."

"I rate the product’s pricing a seven out of ten, where one is inexpensive, and ten is expensive."

"I would rate the product a seven out of ten since it's an enterprise product."

"I would not say it is a cheaply priced tool as it has been doing wonders in the market. The tool has been budget-friendly for organizations."

"The product pricing is reasonable compared to other solutions."

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

850,028 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

19%

Computer Software Company

17%

Government

Educational Organization

Financial Services Firm

17%

Computer Software Company

10%

Healthcare Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about ArcSight Logger?

We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist.

What is your experience regarding pricing and costs for ArcSight Logger?

The pricing isn't the problem. We have a lifetime license, so we don't pay a monthly fee.

What needs improvement with ArcSight Logger?

The solution has room for improvement. We're currently upgrading to the newer version, where they have something like Kafka, a hub for all solutions feeding information into Logger. However, I thin...

What is your experience regarding pricing and costs for Cribl?

I am not aware of the pricing details, however, I know they use a credit format for billing.

What needs improvement with Cribl?

At the moment, I don't have specific feedback on what can be improved as I do not work with Cribl daily. Perhaps more flexibility in terms of metrics would be helpful.

What is your primary use case for Cribl?

I am using Cribl to have everything centralized in one tool in terms of data collection. We were working with different Splunk customers, and Cribl helps collect data and then send it to an S3 buck...

Splunk Enterprise Security vs ArcSight Logger

Comparisons

Compared 37% of the time

IBM Security QRadar vs ArcSight Logger

Compared 35% of the time

Elastic Security vs ArcSight Logger

Compared 8% of the time

Wazuh vs ArcSight Logger

Compared 8% of the time

Grafana Loki vs ArcSight Logger

Compared 5% of the time

More ArcSight Logger Competitors

BindPlane OP vs Cribl

Compared 13% of the time

Elastic Stack vs Cribl

Compared 9% of the time

Logstash vs Cribl

Compared 8% of the time

DataBahn vs Cribl

Compared 8% of the time

Splunk Enterprise Security vs Cribl

Compared 5% of the time

More Cribl Competitors

Product Reports

Download ArcSight Logger product report

ArcSight Logger

May 2025

Download Cribl product report

May 2025

Also Known As

Micro Focus Arcsight Logger, HPE Arcsight Logger

No data available

Overview

HPE ArcSight Data Platform (ADP) offers a future-ready data solution that enriches data in real time and supports open standards for better threat detection. Using security data connectors, ADP collects data and enriches it in real-time to give analysts organized information that can be acted upon instantly.

OpenText

Cribl optimizes log collection, data processing, and migration to Splunk Cloud, ensuring efficient data ingestion and management for improved operational efficiency.

Cribl offers seamless log collection directly from cloud sources, allowing users to visually extract necessary data and replay specific events for in-depth analysis. It provides robust management of events, parsing, and enrichment of data, along with effective log size reduction. Cribl is particularly beneficial for migrating enterprise logs, optimizing usage, and reducing costs while streamlining the transition between different log management tools.

What are Cribl's most important features?

Real-Time Data Transformation: Enables immediate data processing for accurate insights.
Simplified Log Collection: Gathers data from diverse sources effortlessly.
Powerful Data Reduction: Reduces log size without losing critical information.
Inbuilt Packs: Ready-to-use functions simplify complex tasks.
Live Testing: Allows testing before production deployment for reliability.
Master Node Updates: Manages worker groups efficiently for consistent performance.
Advanced Data Processing: Offers robust data serialization and coding perspectives.
Easy Plugin Configurations: Facilitates direct integration with reduced setup time.

What benefits and ROI should users look for?

Optimized Usage: Ensures effective resource management and cost reduction.
Streamlined Migration: Simplifies the transition between log management tools.
Enhanced Data Management: Improves data quality and processing efficiency.
Reduced Time and Effort: Direct-to-production capabilities save operational time.

Cribl is widely implemented in industries requiring extensive data management, such as technology and finance. Users leverage Cribl to handle log collection, processing, and migration efficiently, ensuring smooth operation and effective data analysis. It aids in managing temporary data storage during downtimes and better handling historical data, preventing data loss and allowing extended periods for viewing statistics and monitoring trends.

Sample Customers

China Merchants Bank, Bank AlJazira, Banca Intesa

Information Not Available