No more typing reviews! Try our Samantha, our new voice AI agent.

Cribl vs OpenText Enterprise Security Manager comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
5.1
Cribl reduces data ingestion costs and improves efficiency, resulting in significant ROI with up to 70% log reduction.
Sentiment score
4.9
OpenText Enterprise Security Manager aids compliance and threat detection, though ROI clarity varies due to costs and licensing model.
What we've seen is really an overall reduction of just shy of 40% in our ingest into our SIM platform versus prior to having Cribl.
Senior Security Engineer at a university with 10,001+ employees
The second thing is that data aggregation, sampling, and reduction that we're able to do of the data, lowering our overall data volume, both traversing the network as well as what's being stored inside of our final solutions.
Director, Performance Engineering at a tech services company with 10,001+ employees
In terms of reduction, we were able to save almost ~40% of our total cost.
Sr. Lead Security Engineer at a tech vendor with 10,001+ employees
I find that using ArcSight Enterprise Security Manager (ESM) provides a valuable return on investment as it serves as a single point of glass for logs and data analysis.
Cloud Security Archirect at IBM
 

Customer Service

Sentiment score
6.4
Cribl's customer service is praised for its expertise, though some users seek quicker response times and better understanding of needs.
Sentiment score
5.4
OpenText Enterprise Security Manager receives mixed reviews, with inconsistent technical support and reliance on self-resolution despite improvements.
They had extensive expertise with the product and were able to facilitate everything we needed.
Security Consultant at Integrity360
Usually, within an hour, we get a response, and we are able to work with them back and forth until we resolve the issues.
Engineering Fellow at Pegasystems
Sometimes by hearing the problem itself, they will know what the solution is, and they will let us know how to resolve it, and we do it immediately.
Senior Specialist at a tech vendor with 10,001+ employees
If I raise a P1 or P0 ticket, the response time is often delayed by four to eight hours.
Senior Security Engineer at Valuepoint Systems
I would rate the technical support of ArcSight Enterprise Security Manager (ESM) a nine as they are always available and responsive whenever we open a case.
Cloud Security Archirect at IBM
 

Scalability Issues

Sentiment score
6.6
Cribl is praised for scalable, flexible data management, efficiently integrating diverse sources while minimizing operational complexity and maintaining performance.
Sentiment score
5.9
OpenText Enterprise Security Manager is adaptable but costly, with licensing concerns affecting budget forecasting despite user satisfaction.
The infrastructure behind Cribl Search is also scalable as it uses a CPU and just spawns horizontally more instances as it demands and requires.
Engineering Fellow at Pegasystems
Compared to other SIEM tools I use, any slight change on the operating system end impacts a lot on our SIEM tools and other things, but Cribl performs well in that regard.
Senior Software Engineer at a retailer with 1,001-5,000 employees
Cribl performs effectively across both market segments.
Principal at a hospitality company with 10,001+ employees
It lacks some capabilities compared to other tools available in the market.
Senior Security Engineer at Valuepoint Systems
It is easy to scale, and I have not encountered any issues when we require more storage or deployment.
Cloud Security Archirect at IBM
 

Stability Issues

Sentiment score
7.3
Cribl is praised for reliability and scalability, though some users face occasional performance issues and downtimes.
Sentiment score
5.1
OpenText Enterprise Security Manager's stability varies by environment, requiring proper setup; recent patches improve performance but challenges persist.
Migrating from those SC4S servers to Cribl worker nodes has truly been a game-changer.
Sr. Lead Security Engineer at a tech vendor with 10,001+ employees
Regarding scalability, we started with zero servers and have around 285 servers now.
Senior Specialist at a tech vendor with 10,001+ employees
Cribl is designed to deal with certain kinds of loads and is not designed to handle any scenario in the market.
Security Delivery Senior Analyst at Accenture
I would rate the stability of ArcSight Enterprise Security Manager (ESM) a nine because I have not encountered significant issues, unlike other solutions that sometimes have database errors.
Cloud Security Archirect at IBM
The stability of ArcSight Enterprise Security Manager (ESM) is not very robust.
Senior Security Engineer at Valuepoint Systems
 

Room For Improvement

Cribl needs improved performance, better Git integration, and enhanced usability to address user experience and scalability concerns.
Users seek better reporting, UX, licensing, enhanced performance, integration, automation, AI advancements, and improved support and training.
A more stringent role-based access control feature would enhance security and allow granular control over what users can see and access.
Manager for Monitoring and Logging at Velera
When passing query logs or DNS logs, if certain malicious query patterns need to be identified or if fast-flux attacks are happening, Cribl can report that and those would definitely be a plus for them.
Product Manager at UnDisclosed
I would advise others looking to implement Cribl that if they are evolving Cribl Search, it would be very interesting to see more capability, more flexibility, and more ways to share the data similar to Splunk.
Senior Manager at Deloitte
I would like to see the detection and response features included in the next release of ArcSight Enterprise Security Manager (ESM), as security orchestration and automation are increasingly important.
Cloud Security Archirect at IBM
The integration aspect of ArcSight Enterprise Security Manager (ESM) needs improvement.
Senior Security Engineer at Valuepoint Systems
 

Setup Cost

Cribl offers cost-effective pricing and efficient large data handling, attracting enterprises despite slightly higher costs than competitors.
OpenText Enterprise Security Manager is considered costly, with varied licensing options, and negotiation advised for potential discounts.
Over time, the licensing cost has increased.
SIEM Engineer at National Australia Bank (NAB)
It was cheaper than the Splunk license.
Security Engineering Programme Manager at a government with 1,001-5,000 employees
Splunk is more expensive, and Cribl appears to be more affordable.
Principal at a hospitality company with 10,001+ employees
ArcSight Enterprise Security Manager (ESM) is very cheap compared to other tools.
Senior Security Engineer at Valuepoint Systems
I would rate the pricing of ArcSight Enterprise Security Manager (ESM) around seven, as it varies based on features and demand, making it more affordable for larger organizations, while smaller ones might find it expensive.
Cloud Security Archirect at IBM
 

Valuable Features

Cribl offers intuitive UI, real-time data transformation, seamless integration, cost savings, flexible processing, and versatile deployment for efficient data management.
OpenText Enterprise Security Manager offers versatility, strong vendor support, effective event correlation, and user-friendly integration for enhanced security analysis.
The data reduction and preprocessing capabilities make Cribl really unique.
Security Consultant at Integrity360
Cribl has a feature called JSON Unroll or Unroll function that allows you to differentiate the events; each event will come ingested as a single log instead of piling it up with multiple events.
Security Engineer at Tecplix
The Cribl UI is very simple and easy to use, particularly when working with data from various sources; it makes it very easy to create pipelines, add complex logic to those pipelines, and then gives you a preview of what your data looks like before applying that pipeline and what you get after.
Senior Security Engineer at a university with 10,001+ employees
The ability to interpret data is highly valued.
Senior Security Engineer at Valuepoint Systems
The log analysis feature is particularly valuable as it allows analysts to interpret intrusion-related logs efficiently.
Cloud Security Archirect at IBM
 

Categories and Ranking

Cribl
Ranking in Security Information and Event Management (SIEM)
5th
Average Rating
8.6
Reviews Sentiment
6.8
Number of Reviews
65
Ranking in other categories
Application Performance Monitoring (APM) and Observability (6th), Log Management (3rd), Observability Pipeline Software (1st)
OpenText Enterprise Securit...
Ranking in Security Information and Event Management (SIEM)
21st
Average Rating
7.8
Reviews Sentiment
6.7
Number of Reviews
99
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of October 2026, in the Security Information and Event Management (SIEM) category, the mindshare of Cribl is 1.4%, up from 1.3% compared to the previous year. The mindshare of OpenText Enterprise Security Manager is 1.6%, down from 1.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM) Mindshare Distribution
ProductMindshare (%)
Cribl1.4%
OpenText Enterprise Security Manager1.6%
Other97.0%
Security Information and Event Management (SIEM)
 

Featured Reviews

JigarHirani - PeerSpot reviewer
Splunk Engineer at a recruiting/HR firm with 11-50 employees
Log pipelines have reduced daily data volume and now simplify traffic analysis
Overall, the pipelines and all the features are good with Cribl. The UI is good. Just sometimes, when I actually started using Cribl, I faced the issue where I was not able to connect the nodes. The pipeline is structured in a certain way, then the data will be routed to there, and something of that nature. I was very much confused about their whole products, such as Data Lake and pipelines. It's possible that at that time I didn't take any university courses, which is why I did not know much. But if they can give an intro on how we can connect nodes, or they can provide simple use cases showing what you can do with Cribl, it would help. If you just need to add the source and the destination and pre-build some proper workflow, then it will be easy for new customers to navigate through Cribl.
SM
Cloud Security Archirect at IBM
Unified log analysis has strengthened incident detection and supports continuous attack simulation
I do not have any areas for improvement in ArcSight Enterprise Security Manager (ESM) as I have not delved deeply into it; overall, it is a good package. I would like to see the detection and response features included in the next release of ArcSight Enterprise Security Manager (ESM), as security orchestration and automation are increasingly important.
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
915,341 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Jun 28, 2015
Qradar vs. ArcSight
Continuing with the SIEM posts we have done at Infosecnirvana, this post is a Head to head comparison of the two Industry leading SIEM products in the market – HP ArcSight and IBM QRadar Both the products have consistently been in the Gartner Leaders Quadrant. Both HP and IBM took over niche SIEM…
 

Top Industries

By visitors reading reviews
Financial Services Firm
19%
Manufacturing Company
11%
Healthcare Company
6%
Government
5%
Outsourcing Company
15%
Financial Services Firm
12%
Construction Company
11%
Comms Service Provider
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise8
Large Enterprise35
By reviewers
Company SizeCount
Small Business37
Midsize Enterprise14
Large Enterprise59
 

Questions from the Community

What is your experience regarding pricing and costs for Cribl?
I find the pricing of Cribl to be cost-efficient because it has helped us save costs for data storage by removing unwanted logs.
What needs improvement with Cribl?
Currently, Cribl is perfectly fine for us, and we have not observed any such issues. However, if we find anything later on, we will document it and share it with you. Cribl could respond more quick...
What is your primary use case for Cribl?
We are using Cribl for log trimming with a vast majority of log sources that have different log patterns or log types. Some logs come in syslog format, some are in JSON, and some are in other HTML ...
Which is the best SIEM tool for a mid-sized financial services firm: Arcsight or Securonix?
In my market, a lot of financial companies had or have an ArcSight installation. Just because in former times it was pretty good. Now a lot of them are looking for a more effective solution due to ...
What is your experience regarding pricing and costs for ArcSight Enterprise Security Manager (ESM)?
I would rate the pricing of ArcSight Enterprise Security Manager (ESM) around seven, as it varies based on features and demand, making it more affordable for larger organizations, while smaller one...
What needs improvement with ArcSight Enterprise Security Manager (ESM)?
I do not have any areas for improvement in ArcSight Enterprise Security Manager (ESM) as I have not delved deeply into it; overall, it is a good package. I would like to see the detection and respo...
 

Also Known As

No data available
Micro Focus ArcSight, HPE ArcSight, ArcSight
 

Overview

 

Sample Customers

Information Not Available
Lake Health, U.S. Department of Health and Human Services, Bank AlJazira, Banca Intesa, and Obrela.
Find out what your peers are saying about Cribl vs. OpenText Enterprise Security Manager and other solutions. Updated: September 2026.
915,341 professionals have used our research since 2012.