ArcSight Enterprise Security Manager (ESM) Reviews

Name: ArcSight Enterprise Security Manager (ESM)
Brand: OpenText
Rating: 3.9 (97 reviews)

3.9 out of 5

97 reviews
88% willing to recommend

5,756 followers

What is ArcSight Enterprise Security Manager (ESM)?

ArcSight Enterprise Security Manager (ESM) is a powerful SIEM solution for analyzing, collecting, correlating, and reporting on security event information. ArcSight ESM analyzes information from all of your data sources while helping your organization maintain high security. In addition, the solution is very customizable and enables users to create their own company-specific rule sets to automatically trigger instant alerts.

Get the ArcSight Enterprise Security Manager (ESM) Buyer's Guide and find out what your peers are saying about ArcSight Enterprise Security Manager (ESM), Wazuh, Microsoft Sentinel and more!

ArcSight Enterprise Security Manager (ESM) is the #21 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give ArcSight Enterprise Security Manager (ESM) an average rating of 7.8 out of 10. ArcSight Enterprise Security Manager (ESM) is most commonly compared to Wazuh: ArcSight Enterprise Security Manager (ESM) vs Wazuh. ArcSight Enterprise Security Manager (ESM) is popular among the large enterprise segment, accounting for 61% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 20% of all views.

Buyer's Guide

ArcSight Enterprise Security Manager (ESM)

April 2025

Get the report

Helped 853,960 peers since 2012

Featured ArcSight Enterprise Security Manager (ESM) reviews

Gaurav Ranade

CTO at Rah Infotech Pvt Ltd

ArcSight is a legacy technology, and many customers want AI-powered technologies integrated with it. That hasn't been done yet, but ArcSight needs to catch up with the newer solutions and technologies available in the market. It can't just rely on the legacy technology from 2010 or 2012. You can't run that in 2024. It's a legacy technology with its own limitations. Customers often face issues that other software or newer solutions can resolve easily. That's the main challenge we face from customers right now. So, the only concerns are that AI needs to be integrated and scalability improved. Those are the main areas to be improved.

Read full review

Ramnesh Dubey

Solutions Architect at Ericsson

The first limitation is with the ArcSight Data Storage Manager (ADSM). ArcSight's total capacity is currently capped at 12 TB. This becomes an issue if a customer needs a longer real-time data retention period, such as exceeding 90 days or reaching a year or even ten months. Increasing the disk space beyond 12 TB is not currently possible. So, increasing the storage capacity is one area for improvement. Additionally, the real-time data retention is limited due to the 12 TB restriction. Depending on the Events Per Second (EPS) you receive, you might only be able to retain data for seven to ten days. Overall, the 12 TB limit is the main issue we face in terms of maximizing real-time data storage. Moreover, there are a few improvements I would like to see in future releases. My main suggestion for ArcSight is to simplify the deployment process. Currently, the installation process is quite complex. There are various components involved, including transformations, multiple installations, and containerization for various components. Ideally, I'd recommend that ArcSight allow the entire installation, including the ESM and database, to be completed within a single unified setup process for a streamlined experience. Additionally, having readily available and well-organized documentation for the step-by-step installation process would be incredibly helpful. I would also like to see better support.

Read full review

LENIN RAMIREZ

SIEM MANAGER at a comms service provider with 1,001-5,000 employees

It is easy to maintain the solution. The architecture can be somewhat complex because it uses specific components for different tasks, such as collecting data sources, parsing, generating reports, and displaying the main console. Each task has its dedicated component, which can make deployment more challenging. In contrast, our system uses fewer components, making deployment simpler and more efficient. This can save both time and money. Ultimately, customers want clear visibility and quick alerting to detect and respond to attacks as swiftly as possible. They also use machine learning and AI, which can be very helpful. For instance, AI can assist in filtering out false positives and providing more accurate information. When dealing with specific layers, AI can enhance the system's ability to identify relevant data and improve efficiency. IBM QRadar, for instance, uses machine learning with its UVA technology. On the other hand, Curator requires installing a specific agent on endpoints. Machine learning in Curator helps detect unusual activities, such as a user logging into a different computer than usual. This capability allows for early detection of potential security issues. Overall, I rate the solution an eight out of ten.

Read full review

ArcSight Enterprise Security Manager (ESM) mindshare

As of June 2025, the mindshare of ArcSight Enterprise Security Manager (ESM) in the Security Information and Event Management (SIEM) category stands at 1.1%, down from 1.5% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

PeerResearch reports based on ArcSight Enterprise Security Manager (ESM) reviews

Type	Title	Date
Category	Security Information and Event Management (SIEM)	Jun 3, 2025	Download
Product	Reviews, tips, and advice from real users	Jun 3, 2025	Download
Comparison	ArcSight Enterprise Security Manager (ESM) vs Splunk Enterprise Security	Jun 3, 2025	Download
Comparison	ArcSight Enterprise Security Manager (ESM) vs Wazuh	Jun 3, 2025	Download
Comparison	ArcSight Enterprise Security Manager (ESM) vs Microsoft Sentinel	Jun 3, 2025	Download

Title	Rating	Mindshare	Recommending
Wazuh	3.7	13.3%	80%	48 interviews Add to research
Microsoft Sentinel	4.1	7.1%	93%	97 interviews Add to research

Valuable Features

ArcSight Enterprise Security Manager's most valuable features include versatile vendor support, scalability, powerful log collection mechanisms, robust correlation engine, and flexible integration capabilities. Users favor its customizable rules, real-time monitoring, dashboards, incident response tools, and advanced threat detection. ArcSight's adaptability and ease of use help organizations manage logs and security events effectively. Additionally, its ability to handle complex scenarios, extensive device support, and comprehensive data parsing are recognized as key strengths.

"ArcSight Enterprise Security Manager (ESM) is very cheap compared to other tools."
"The most valuable feature is the correlation of different logs that are collected."
"On the positive side, ArcSight ESM's performance was excellent. It was very fast when writing queries. It provided good performance monitoring and had built-in rules to show which rules triggered most often and impacted performance. This performance monitoring was well-implemented."

Room for Improvement

ArcSight Enterprise Security Manager (ESM) requires enhancements in reporting, vendor log support, and technical support. Improvements are needed in high availability and the simplification of network modeling. The complexity of deployment, a challenging user interface, and outdated documentation pose challenges. Performance issues with Oracle DB and slowness in search functions need addressing. ArcSight's lack of real-time data retention, integration challenges with other devices, and limited cloud solutions highlight areas for improvement. Enhanced AI and machine learning capabilities are also desired.

"The stability of ArcSight Enterprise Security Manager (ESM) is not very robust."
"The only concern is that AI needs to be integrated"
"I faced some problems implementing certain attacks, which was my biggest concern. The visualization wasn't very good, and I couldn't create good monitoring dashboards."

ROI

Users find it challenging to measure ROI from ArcSight Enterprise Security Manager (ESM) due to high costs and variable value generation timelines. Some praise its ability to detect security threats and aid compliance, enhancing business security and compliance outcomes. Many view its real-time alert capabilities as essential for threat mitigation. Others note that though ROI isn't immediately clear, it offers value in preventing major incidents and meeting compliance standards, depending on the industry dynamics.

Pricing

ArcSight Enterprise Security Manager (ESM) pricing varies significantly based on deployment size, licensing models, and enterprise needs. Users frequently describe it as expensive, especially for large deployments, though some find it competitive against alternatives like Splunk and QRadar. Licensing is often structured around EPS (Events Per Second). Despite costs, many appreciate its robust features, scalability, and straightforward licensing options. While initial setup can be costly, enterprise discounts and flexible licensing can mitigate some expenses.

"Price-wise, ArcSight ESM was a bit high compared to competitors, which factored into our decision to switch to Splunk. It couldn't cover all our business needs for what we wanted to implement."
"Pricing is good, I'd rate the pricing a seven out of ten, with ten being low price. It's better than Splunk and IBM QRadar because their pricing is based on EPS."
"The pricing model is expensive compared to open-source alternatives."

Popular Use Cases

ArcSight Enterprise Security Manager (ESM) is utilized for security information management, monitoring, cyber threat detection, and log consolidation. Organizations leverage its capabilities for compliance, real-time alerts, and incident response, integrating with various platforms for improved data handling. The platform's multi-tenant and integration features support managed services, helping diverse industries, including banking and government, maintain secure infrastructures. ESM aids in forensic investigations and prioritizes security measures across on-premises and cloud environments.

Service and Support

ArcSight Enterprise Security Manager (ESM) customer service displays mixed feedback. Some users report efficient response times and history tracking, while others experience delays and inadequate resolution. Technical support quality varies, often criticized for slow response and lack of depth in troubleshooting. HP support requires improvement in problem management processes, although some find them enthusiastic and globally accessible. Experiences indicate room for enhancing speed and effectiveness in handling user issues.

Deployment

Many found ArcSight Enterprise Security Manager (ESM) setup complex with numerous components requiring expertise and planning. While some experienced it as straightforward, others noted that customization and ongoing management are necessary for optimal performance. The duration varied, with installations taking from days to several months, contingent on organizational needs and infrastructure. Despite challenges in integration and deployment, proper documentation, skilled technicians, and customer cooperation eased the process for some.

Scalability

ArcSight Enterprise Security Manager (ESM) demonstrates strong scalability but comes with high costs. Users find it suitable for large-scale environments, though the pricing model presents challenges. It efficiently scales across different organization sizes, with some noting a need for skilled personnel. While generally reliable, its cost and complexity can hinder its appeal compared to other market options. The system offers flexibility in deployment but may require detailed planning and adequate resources to reach optimal scalability.

Stability

Users find ArcSight Enterprise Security Manager (ESM) generally stable, though initial deployment can be complex. Stability issues often arise from virtualization, lack of tuning, and improper setup. Proper physical hardware and sufficient resources enhance performance. Some stability problems are linked to specific components, such as connectors. Recent improvements have increased reliability, but support expertise is occasionally lacking. Users rate stability from six to ten, reflecting varied experiences. Regular maintenance and appropriate sizing are essential.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our ArcSight Enterprise Security Manager (ESM) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

20%

Computer Software Company

15%

Manufacturing Company

Government

Real Estate/Law Firm

Educational Organization

Legal Firm

Comms Service Provider

Healthcare Company

Retailer

Construction Company

Media Company

Energy/Utilities Company

University

Outsourcing Company

Non Profit

Logistics Company

Insurance Company

Transportation Company

Recreational Facilities/Services Company

Performing Arts

Aerospace/Defense Firm

Security Firm

Wholesaler/Distributor

Consumer Goods Company

Hospitality Company

Pharma/Biotech Company

Compare ArcSight Enterprise Security Manager (ESM) with alternative products

Learn more about ArcSight Enterprise Security Manager (ESM)

ArcSight Enterprise Security Manager (ESM) Features

Real-time threat detection
Visualization and reporting capabilities
Patented log management
Personalized dashboards
Scalable event monitoring
Seamless integration with your existing SOC tools
Behavior profiling
Data and user monitoring
Application monitoring
Analytics
Deployment/support simplicity

ArcSight Enterprise Security Manager (ESM) Benefits

Some of the benefits of using ESM include:

Real-time information: ArcSight ESM can correlate data from any source in real-time to detect incidents before they become a breach.

Compliance: Optional compliance packs enable packaged reports for PCI, SOX, and IT Governance.

Security analytics: With ArcSight ESM, you can build and maintain a security operation center (SOC) through big data security analytics.

Integration: ArcSight ESM allows you to integrate SOC with network operations, service desk, CMDB, business intelligence, Hadoop, email security, application security, threat feeds, and more.

Speed: ArcSight ESM provides excellent speed of event collection with patented log management tools.

Advanced detection: ArcSight ESM can detect unusual or unauthorized activities as they occur, preventing business disruptions.

Decrease threat exposure: By implementing ArcSight ESM, you reduce threat exposure because the solution detects threats in real time.

Operational efficiency: ArcSight ESM makes it possible for you to automate responses with ArcSight’s native SOAR, which saves your organization time, and therefore increases your operational efficiency.

Reviews from Real Users

Below are some reviews and helpful feedback written by ArcSight Enterprise Security Manager (ESM) users.

A Head of Professional Services at a computer software company says, “The simplicity of the solution is the most valuable aspect of the product. The product is quite mature. It's been around for a long time. The integration is easy for the most part.”

A Managing partner at a tech services company states that the solution is “Good at consolidating logs, fairly stable, and can scale.”

PeerSpot user Abbasi P., Vice President Derivatives Ops IT at a financial services firm, explains, “The user interfaces are quite good and speedy, and I like the consoles too. The typology and the setup are also good.”

A Chief Technological Officer at a tech services company says, "It is a very useful tool for intelligence building because it has many use cases and many rule sets."

An Associate Vice President at a consumer goods company comments, “We primarily use the solution for its technology including its independent logs, and those types of things. The solution offers very good monitoring. The product's log management and event management capabilities are excellent. There are a lot of really good analytical components. It helps us focus on analysis.”

ArcSight Enterprise Security Manager (ESM) was previously known as Micro Focus ArcSight, HPE ArcSight, ArcSight .