Arcsight by OpenText vs. Trellix Enterprise Security Manager

In the current lot of hundreds of SIEM solutions out there in the market, ArcSight ESM is fairly less expensive with strong fundamentals in place. The log ingestion, correlation are very well performing and totally worth ROI. However, the tool has lost its way when it comes to staying abreast with current feature curve of SIEM technology and the evolution has not been done by MicroFocus. Search times are high and there is no major plug-in that has been introduced as part of the product life cycle.

Incentivized

McAfee is a good solution if you're in a medium/large company and if you're looking for a solution that can be customized and expanded. I also recommend if you have the most common log sources on your environment, since McAfee supports the major log sources (but lack a lot of small vendors). In my opinion, I wouldn't recommend McAfee for small companies, since it's not that easy to manage and maintain.

Incentivized

• User friendly interface.
• Easy to create queries and rules to make all the things automatic.
• Backup, maintenance and support of this product are always nearly perfect.

Incentivized

• McAfee Enterprise Security Manager has a large library of pre-made correlations that reduces the amount of work needed to make it functional.
• This is a core McAfee product that is still getting support.
• It has a substantial amount of compatibility and integration with other products.

Incentivized

• ArcSight is a really complex tool, but it's not that easy to implement and maintain.
• Troubleshooting issues on ArcSight can be hard if you have a large environment.

Incentivized

• If there is a requirement to integrate into other vendor products i.e. (log sharing) then this was very cumbersome.
• Integration of vulnerability scanning that is available in other vendor products would be a good addition.
• When integrating all of Intel's products a third party consultancy is usually required, where other vendor products can be configured without this additional cost.

Incentivized

Overall, it is a good investment in order for an organization to stay compliant and stay secure from all the wild things happening. It is definitely a cost effective tool with some good features including correlation, log storage, reporting and dashboards. If a customer is looking for advanced set of features, then I would highly not recommend this.

Incentivized

If you go for platinum support, it's good as you have priority for support. They will take remote control of your machines and troubleshoot. Also, they arrange requirement SEM depending on the issue.

Incentivized

Dealing with the McAfee support is a lottery. Sometimes you reach them and it's a really experienced engineer, but sometimes it's a person with no clue on the tool. We had few cases where our internal engineers knew more about the tool than the McAfee support. However, sometimes we get hold of some really good engineers that know the tool from inside out

Incentivized

We are currently using Elastic search as well for better management of our devices and to keep all the loopholes filled that have been created around the non-upgraded version of Arcsight Enterprise Manager. Elastic searches have the latest mechanism to fetch logs and correlated data, as well as process them in a more useful way.

Incentivized

McAfee Enterprise Security Manager is a better option than other security software because it's both inexpensive and extremely effective. Norton and other security software boast a high price tag but don't always back it up when it comes to performance. With McAfee Enterprise Security Manager, I know I'm getting a quality product for a fair price.

Incentivized

• It is recommended for handle small enterprises.
• Cant integrate any threat intel tool so we majorly works through filters.
• It is slow takes time for large searches.

Incentivized

• It effectively blocks potential attacks from outside.
• It aids us in doing more effective root-cause analysis whenever an incident occurs, since it gives us enough details to understand what went wrong.

Incentivized