Coming October 25: PeerSpot Awards will be announced! Learn more
2020-06-23T11:15:00Z
MV
User at First Abu Dhabi Bank P.j.s.c
  • 9
  • 425

Which is the best SIEM tool for a mid-sized financial services firm: Arcsight or Securonix?

I work at mid-sized enterprise bank. I am researching SIEM solutions. Which is the best tool for security information and event management: Arcsight or Securonix?

11
PeerSpot user
11 Answers
AW
President at iSECURE
MSP
2021-11-16T10:25:52Z
16 November 21

Since you are in financial services and your risk is high and there is compliance that your firm should be following. We would need to at least have a conversation before we recommend anything.  


I agree with the other responses this is a specific question and I would need more information to give you the best advice.  

Aji Joseph - PeerSpot reviewer
Sales Director at Clouds Dubai
Reseller
Top 10
2020-08-05T19:19:33Z
05 August 20

QRadar, Splunk, or LogRythm could be better options. The success of SIEM solutions depends a lot on the expertise of the SOC team that will be managing the alerts generated by SIEM solutions. It is also worthwhile to evaluate the forensics capability of these solutions before buying.  

JS
Sales & Commercial Director - EMEA with 51-200 employees
Vendor
2020-06-24T13:55:45Z
24 June 20

To be upfront 


I am a security vendor and we are the authors and developers of Snare our SIEM-agnostic Enterprise solution for log collection and log management. 


We work with lots of Siem vendors and Snare deploys and integrates with all major SIEM platforms e.g. Arcsight, Qradar, Splunk, RSA. We have over 500 Banks and financial services companies using Snare Agents and Snare central where we have been able to contain and reduce their Siem ingestion charges by up to 60% where the Siem vendor charges for log data ingestion by EPS, GB or any metered basis - https://www.youtube.com/channel/UCr8sLTVcI7oivIjEQBfu7UA.


Snare collaborates and compliments SIEM solutions. Snare Agents provide Granular Filtering @ Source, Truncation of Noise out of logs @ Source in a lightweight Agent. Snare Central provides dashboard analytics to monitor log traffic from windows, Linux, Unix, OSX, Syslog feeds etc.while also providing "Out of the Box Compliance Reporting, Alerts" and ability to reflect logs to multiple destinations simultaneously. 


From our experience, Arcsight is a good SIEM, very feature-rich but does require a lot of resources and is generally very expensive one-time and ongoing ingestion of logs into Arcsight (unless you have Snare). Arcsight connectors provide an agentless collection process but this has many issues as it is not as secure as Agents and can invite log tampering, no encryption, unable to set group policy etc...


I have lots of my customers using Snare Agents with logs going to Arcsight and can provide a reference point if required. My largest financial services customer has over 100,000 Snare agents filtering, reflecting logs to Arcsight. Please take a look at https://www.snaresolutions.com/siem-integration/

Andrés Batista - PeerSpot reviewer
Executive Account Manager
Vendor
2021-11-16T15:34:55Z
16 November 21

Securonix is a good SIEM tool, even if you want to use it as a service (SaaS) solution. 


UTMStack is another Next-Gen SIEM that delivers cybersecurity services like Penetration Testing, Vulnerability Assessment, SOC-as-a-Service, and others at a cost-effective price.


Both are recommendable, and your election depends on what you need.

Abhishek RVRK Sharma - PeerSpot reviewer
Senior Technical Marketing Engineer at Securonix Solutions
Real User
2020-09-25T21:16:29Z
25 September 20

That is kind of like asking - I want a car, what would you recommend? your choice of SIEM should be determined by - your use cases, your budget and your available resources. 


Securonix (I work here) is a cloud-native full functionality SIEM recognized by Gartner as a top 3 leader in their MQ for 2020. As a pioneer for UEBA tech, the Securonix SIEM platform deeply integrates advanced UEBA into SIEM functionality. The platform also offers custom content for financial institutions, with pre-built content for use cases such as SWIFT system protection and trade surveillance.


I don't know much about ArcSight, so I won't comment, but it always helps to have a SIEM that has custom content for your industry, which is regularly updated and maintained. Being cloud-native also enables better public cloud integration.

Find out what your peers are saying about ArcSight Enterprise Security Manager (ESM) vs. Securonix Next-Gen SIEM and other solutions. Updated: August 2022.
635,513 professionals have used our research since 2012.
TS
Consultant at a tech services company with 11-50 employees
Reseller
2020-06-25T12:02:06Z
25 June 20

Neither, or both. 


Having done literally thousands of SIEM deployments, I can tell you from experience that the technology choice isn't the most important choice. The critical choice is in the resources and commitment to manage and use the system. I've seen countless SIEM implementations fail over the longer term, including all of the big names, because too many people treat it like a "set it and forget it" system. It is most definitely not. A SIEM or UEBA platform is a tool that must be monitored, tuned, and used every day. So I would recommend to you that you spend less time figuring out which technology is the "best" and more time building a plan to integrate it, manage it, and fully utilize it. Or selecting a good team to do that for you.

Himanshu Shah - PeerSpot reviewer
Partner at Opticom Data Products
Real User
Top 20
2020-06-25T07:06:37Z
25 June 20

Arcsight is a legacy SIEM a Ro-bust log management tool however works on EPS ( Events per second) costing, which mounts recurring cost on year on year basis. However Securonix SIEM based on Data Lake and Advanced Analytics or  UEBA suite which provides rich context of any insider threat. You can also have Incident Responder and Threat hunting along with automated response with Play books with add on SOAR tool. I think for a mid-ranged bank Securonix may suite better , also one can have this as service by Cloud service for above tools if options available for the same.

SS
Systems Engineer at a tech services company with 201-500 employees
User
2020-06-29T06:27:11Z
29 June 20

I would agree that besides the technology you also need the manpower behind it. And with regards to technology, you asked Securonix vs Arcsight. I would go with Arcsight, to gain the visibility into the logs first. I have worked with Arcsight for 8 years now as a partner and as a customer. We were able to ingest logs from anywhere, we were able to ingest logs from anything - custom applications, custom logs - not to mention the logs from the usual security devices - and you also get the OOB support for a lot of devices - Sales claims they have the broadest support with regards to other SIEM vendors. 


Yes it was said that it was dated, but they are really making strides to modernize the solution and they will also integrate a Machine Learning UEBA from Interset. My suggestion would be to deploy a SIEM first, which can then be upgraded with an UEBA solution. 


Angel Rivera Baez - PeerSpot reviewer
Information Systems Director with 501-1,000 employees
Real User
2020-06-24T14:29:07Z
24 June 20

We didn’t use any of the products but I include you a link to Gartner comparison. https://www.gartner.com/review.

Rishan-Ahmed - PeerSpot reviewer
Channel Manager (Engineer) at Dataguard MEA
MSP
Top 5Leaderboard
2020-06-25T08:02:05Z
25 June 20

I recommend ArcSight as it has many proven advantages. in terms pricing and technology. 

Related Questions
Julia Frohwein - PeerSpot reviewer
Senior Director of Delivery at PeerSpot (formerly IT Central Station)
Jul 14, 2022
Hi, We all know it's really hard to get good pricing and cost information. Please share what you can so you can help your peers.
2 out of 10 answers
LH
User at NOOSC Global
16 June 19
The cost of the solution is not very high, although hiring a qualified analyst to work with the product is expensive.
AB
Associate Vice President at a consumer goods company with 201-500 employees
21 September 20
I don't have too much information about the licensing costs at this time. I don't really handle them. I'm not sure if there are additional costs over and above the license itself.
Julia Frohwein - PeerSpot reviewer
Senior Director of Delivery at PeerSpot (formerly IT Central Station)
Jul 31, 2022
If you were talking to someone whose organization is considering ArcSight Enterprise Security Manager (ESM), what would you say? How would you rate it and why? Any other tips or advice?
2 out of 25 answers
RR
Senior Officer IT at a financial services firm with 10,001+ employees
13 June 19
This is a really good solution and I would recommend it. If you know how to work it, and how to configure it properly, then it can give you lots and lots of information. On the other hand, it provides so much detail that people can miss things. If the interface and reports were minimized and consolidated then it would be better. I would rate this solution a seven out of ten.
LH
User at NOOSC Global
16 June 19
In summary, this solution requires a dedicated person that has specific competency in this product. It is not a plug and play product that allows you to simply focus on the analytics. It is not easy for an amateur. The suitability of this solution depends on the complexity of the system. If the organization is very large, for example nationwide, then a log-based approach such as this one will be very difficult to implement. Obviously, if the device does not generate a log then it is not supported by this solution. Our client has successfully deployed it for use with several devices, including firewalls and IPS, but they have no support for some in-house applications. I would rate this solution a five out of ten.
Related Articles
Netanya Carmi - PeerSpot reviewer
Content Manager at PeerSpot (formerly IT Central Station)
May 12, 2022
PeerSpot’s crowdsourced user review platform helps technology decision-makers around the world to better connect with peers and other independent experts who provide advice without vendor bias. Our users have ranked these solutions according to their valuable features, and discuss which features they like most and why. You can read user reviews for the Top User Behavior Analytics - UEBA Tools...
Rony_Sklar - PeerSpot reviewer
Community Manager at PeerSpot (formerly IT Central Station)
Oct 27, 2020
Members of the IT Central Station community are always happy to take a few minutes to help other users by answering questions posted on our site. In this Q&A round-up, we’re focusing on our users’ answers about SIEM, Identity and Access Management, and the Differences between Hyper-converged Infrastructure vs Converged Infrastructure. Which is the best SIEM tool for a mid-sized enter...
See 1 comment
Rony_Sklar - PeerSpot reviewer
Community Manager at PeerSpot (formerly IT Central Station)
27 October 20
@Himanshu Shah ​@Consulta85d2 ​@Aji Joseph ​@Mark Adams ​@Steffen Hornung ​@Dan Reynolds ​
Navcharan Singh - PeerSpot reviewer
Senior Seo Executive at Ace Cloud Hosting
Aug 25, 2022
Security Information and Event Management (SIEM) solutions differ significantly from firewalls. While both security solutions are integral components of cybersecurity infrastructure, they have different capabilities, functions, and roles. Do you need SIEM if you already have a firewall? If you have questions about the difference between SIEM and firewall, you have come to the right place....
Evgeny Belenky - PeerSpot reviewer
Director of Community at PeerSpot (formerly IT Central Station)
Jul 05, 2022
Dear PeerSpot community members, This is our latest Community Spotlight for YOU. Here we've summarized and selected the latest posts (professional questions, articles and discussions) contributed by PeerSpot community members.  Check them out! Trending See what your peers are discussing at the moment! What were your main pain points during the SIEM product purchase process? What...
Evgeny Belenky - PeerSpot reviewer
Director of Community at PeerSpot (formerly IT Central Station)
Apr 04, 2022
Hi peers, This is our new Community Spotlight that includes recent contributions (questions, articles and discussions) by the PeerSpot community members. Trending Is RPA beneficial for a healthcare organization? With the increasing risk of cyber attacks in the west, due to the war in Ukraine, how safe is your data in the cloud? Articles 8 Business Automation Ideas to Save Time and...
Moderator
davidstrom - PeerSpot reviewer
Owner at David Strom Inc.
Related Articles
Netanya Carmi - PeerSpot reviewer
Content Manager at PeerSpot (formerly IT Central Station)
May 12, 2022
Top 7 User Behavior Analytics (UEBA) Tools 2022
PeerSpot’s crowdsourced user review platform helps technology decision-makers around the world to...
Rony_Sklar - PeerSpot reviewer
Community Manager at PeerSpot (formerly IT Central Station)
Oct 27, 2020
Q&A roundup: SIEM, Identity and Access Management, and Hyper-converged vs. Converged Infrastructure
Members of the IT Central Station community are always happy to take a few minutes to help ...
Download Free Report
Download our free ArcSight Enterprise Security Manager (ESM) Report and get advice and tips from experienced pros sharing their opinions. Updated: October 2022.
DOWNLOAD NOW
635,513 professionals have used our research since 2012.