ArcSight Enterprise Security Manager (ESM)

What differentiates ArcSight Enterprise Security Manager (ESM) from other similar products?

1. Scalability: ArcSight ESM is known for its scalability, making it suitable for organizations of various sizes, from small and medium businesses to large enterprises. It can handle a high volume of data and events, making it a robust choice for organizations with diverse IT environments. 2. Real-Time Correlation: ArcSight ESM offers advanced real-time correlation capabilities that allow security teams to detect and respond to threats as they happen. It can correlate and analyze a wide range of security events, logs, and data sources to identify patterns and anomalies.

What is your favorite aspect of this product?

1. Customizable Dashboards: Users can create customized dashboards and reports tailored to their specific security monitoring and reporting needs. This flexibility allows security teams to focus on the most critical information. 2. Threat Intelligence Integration: The platform integrates with external threat intelligence feeds, enriching security event data with contextual information about known threats and vulnerabilities.

What do you dislike most about this product?

1. Cost: The total cost of ownership for ESM, including licensing, hardware, and personnel, can be high. Smaller organizations with limited budgets may find it challenging to justify the costs associated with ESM. 2. Deployment Time: Deploying ESM can take time, especially for large enterprises with complex IT environments. The initial setup and configuration may require a significant investment in terms of time and effort. 3. Alert Fatigue: ESM can generate a large volume of alerts and events, potentially leading to alert fatigue within security teams. It's crucial to fine-tune the system to prioritize and reduce false positives.

What recommendations would you give to someone considering this product?

1. Determine Your Budget: Understand the total cost of ownership for ESM, which includes licensing, hardware, personnel, and ongoing maintenance costs. Ensure that your budget aligns with the resources required for the successful deployment and operation of the platform. 2. Evaluate Expertise: Assess your organization's in-house expertise in cybersecurity and SIEM solutions. Consider whether you have the necessary personnel with the skills to configure, manage, and optimize ESM effectively. Training may be required.

What differentiates ArcSight Enterprise Security Manager (ESM) from other similar products?

So the possibility to have functionality like active lists which inturn can be used to used to avoid redundant alerts is one of the best functionality I feel which makes ArcSight Enterprise Security Manager different from other products.

What is your favorite aspect of this product?

The Favourite aspect is the ease of use of the product and the amazing functionality to create co-relation rules from multiple log sources is one of the best aspect of ArcSight SIEM.

What do you dislike most about this product?

There is nothing as such that I dislike. however, if there can be improvements in the accessibility speeds of the logs then it could be really beneficial for the analysts.

What recommendations would you give to someone considering this product?

Yeah if you are someone who is really looking to start their career as a security analyst or willing to get into the SIEM Analyst or SOC operations role then ArcSight could be one of the best options for you as it has that ease of use that can really quickly make you fall in love with the SIEM tool.

What differentiates ArcSight Enterprise Security Manager (ESM) from other similar products?

We employ Arcsight as a whole. Arcsight may be connected with any piece of technology and utilised for monitoring from a security perspective. We may monitor warning patterns and set up rules according to our needs. The ability to create whitelists is another excellent feature. An excellent tool all around. It is also possible to create specialised connections for software and technology that other SIEM solutions do not support.

What is your favorite aspect of this product?

Handling of data. Security regulations Reports can be scheduled and fetched. Role and user management. A strong interaction with IT infrastructure, including ticketing systems, websites, and threat feeds, etc.

What do you dislike most about this product?

Even if there are many new, widely used apps that Arcsight can't directly link with, integration is still not perfect. UI can be made better. The user terminal is rather large and takes some time to load.

What recommendations would you give to someone considering this product?

According to your company's needs, regulations and trends can be adjusted. If a smart connection is not available for a certain device, you can still incorporate it. A list for changeable needs is another option. Instead of always having to dive into the intricacies of an event, we have constructed bespoke fieldsets and filled them with the data we want in a variety of data formats to make monitoring simple.