ArcSight Enterprise Security Manager (ESM)

What differentiates ArcSight Enterprise Security Manager (ESM) from other similar products?

It is having good correlation engine for making beautiful dashboards for events

What is your favorite aspect of this product?

Customise the dashboard with multiple events and type of correlation between events

What do you dislike most about this product?

Manually updating the use cases no advance use case is available with product

What recommendations would you give to someone considering this product?

Yes they can opt for having good correlation of events and results

What differentiates ArcSight Enterprise Security Manager (ESM) from other similar products?

1. Scalability: ArcSight ESM is known for its scalability, making it suitable for organizations of various sizes, from small and medium businesses to large enterprises. It can handle a high volume of data and events, making it a robust choice for organizations with diverse IT environments. 2. Real-Time Correlation: ArcSight ESM offers advanced real-time correlation capabilities that allow security teams to detect and respond to threats as they happen. It can correlate and analyze a wide range of security events, logs, and data sources to identify patterns and anomalies.

What is your favorite aspect of this product?

1. Customizable Dashboards: Users can create customized dashboards and reports tailored to their specific security monitoring and reporting needs. This flexibility allows security teams to focus on the most critical information. 2. Threat Intelligence Integration: The platform integrates with external threat intelligence feeds, enriching security event data with contextual information about known threats and vulnerabilities.

What do you dislike most about this product?

1. Cost: The total cost of ownership for ESM, including licensing, hardware, and personnel, can be high. Smaller organizations with limited budgets may find it challenging to justify the costs associated with ESM. 2. Deployment Time: Deploying ESM can take time, especially for large enterprises with complex IT environments. The initial setup and configuration may require a significant investment in terms of time and effort. 3. Alert Fatigue: ESM can generate a large volume of alerts and events, potentially leading to alert fatigue within security teams. It's crucial to fine-tune the system to prioritize and reduce false positives.

What recommendations would you give to someone considering this product?

1. Determine Your Budget: Understand the total cost of ownership for ESM, which includes licensing, hardware, personnel, and ongoing maintenance costs. Ensure that your budget aligns with the resources required for the successful deployment and operation of the platform. 2. Evaluate Expertise: Assess your organization's in-house expertise in cybersecurity and SIEM solutions. Consider whether you have the necessary personnel with the skills to configure, manage, and optimize ESM effectively. Training may be required.

What differentiates ArcSight Enterprise Security Manager (ESM) from other similar products?

So the possibility to have functionality like active lists which inturn can be used to used to avoid redundant alerts is one of the best functionality I feel which makes ArcSight Enterprise Security Manager different from other products.

What is your favorite aspect of this product?

The Favourite aspect is the ease of use of the product and the amazing functionality to create co-relation rules from multiple log sources is one of the best aspect of ArcSight SIEM.

What do you dislike most about this product?

There is nothing as such that I dislike. however, if there can be improvements in the accessibility speeds of the logs then it could be really beneficial for the analysts.

What recommendations would you give to someone considering this product?

Yeah if you are someone who is really looking to start their career as a security analyst or willing to get into the SIEM Analyst or SOC operations role then ArcSight could be one of the best options for you as it has that ease of use that can really quickly make you fall in love with the SIEM tool.