ArcSight

ArcSight
Name	ArcSight
Developer	Hewlett Packard Enterprise; Micro Focus
Initial release	2000s
Latest release	proprietary
Operating system	Cross-platform
Genre	Security information and event management

ArcSight is a commercial security information and event management (SIEM) platform aimed at collecting, normalizing, correlating, and analyzing security event data from diverse enterprise sources. The product has been used by large organizations, government agencies, and managed security service providers to detect threats, support incident response, and meet compliance mandates. ArcSight competes in the same market space as vendors and projects such as Splunk, IBM QRadar, McAfee Enterprise Security Manager, LogRhythm, and AlienVault.

Overview

ArcSight provides centralized log management, event correlation, and real-time alerting to support security operations centers (SOCs), computer security incident response teams, and risk management functions. The platform ingests logs from network devices like Cisco Systems routers and switches, endpoint agents from vendors such as Microsoft and Symantec Corporation, and cloud platforms including Amazon Web Services and Microsoft Azure. Analysts often integrate ArcSight with threat intelligence feeds from organizations such as MITRE and VirusTotal and case management systems like ServiceNow to support triage and forensic investigation workflows.

History and Development

ArcSight originated as a startup founded in the early 2000s and grew during a period of rapid expansion in enterprise security tooling alongside companies like RSA Security and Tenable, Inc.. The product became notable for scalable event correlation engines that drew comparisons to earlier log-analysis efforts by projects at DARPA and research at institutions like MIT. ArcSight was acquired by larger technology firms during consolidation waves in the cybersecurity industry, appearing in portfolios alongside Hewlett-Packard enterprise offerings and later within suites managed by Micro Focus. Over time the platform evolved to address changes driven by the rise of cloud computing, regulatory frameworks such as the Sarbanes–Oxley Act and HIPAA, and the emergence of advanced persistent threat campaigns attributed to actors exposed in reports by Mandiant.

Architecture and Components

ArcSight's architecture typically comprises collectors, a rules-based correlation engine, a central management server, and a data store for indexed events. Collectors interface with devices from vendors such as Juniper Networks, Palo Alto Networks, and Fortinet to harvest syslog, Windows Event Log, and application logs. The correlation engine implements pattern matching and statistical analysis reminiscent of techniques used in academic work at Carnegie Mellon University and Stanford University on anomaly detection. Management consoles provide dashboards and reporting, analogous in purpose to solutions developed by Oracle and SAP for enterprise monitoring. Back-end storage strategies have ranged from proprietary databases to integrations with big-data platforms popularized by projects like Hadoop.

Features and Capabilities

Key capabilities include real-time correlation, historical search, customizable dashboards, and compliance reporting. ArcSight supports rule authoring and content packs comparable to threat content distributed by security vendors such as Cisco Talos and CrowdStrike. The platform also offers user and entity behavior analytics (UEBA) features that borrow concepts from machine learning research at Google and IBM Research. Reporting modules target regulatory frameworks overseen by bodies like the Payment Card Industry Security Standards Council and European Data Protection Board. Integration points allow enrichment with indicators from community projects such as AbuseIPDB and proprietary providers like Recorded Future.

Deployment and Integration

Deployments vary from on-premises appliances used by financial institutions like JPMorgan Chase to cloud-hosted instances consumed by technology companies such as Netflix and managed security services offered by firms like Secureworks. Integration patterns include connectors for Active Directory environments maintained by enterprises, APIs for orchestration with automation tools like Ansible and Puppet, and SIEM-forwarding to centralized logging platforms like Elastic Stack. High-availability architectures often reference best practices from vendors such as VMware for virtualization and Dell EMC for storage.

Use Cases and Industry Adoption

Common use cases encompass threat detection for incidents similar to campaigns investigated by FireEye and Kaspersky Lab, insider threat detection in public sector agencies, fraud analysis in banking, and operational troubleshooting for telecommunications firms like Verizon Communications. ArcSight has been adopted across sectors including healthcare institutions that must respond to incidents reported to HHS Office for Civil Rights and utilities that coordinate with agencies like the North American Electric Reliability Corporation. Managed service providers use ArcSight to deliver 24/7 monitoring and compliance reporting to clients in regulated industries.

Security and Compliance Considerations

Operational security for SIEM deployments requires secure collection channels (e.g., TLS), hardened management access practices inspired by guidance from NIST and CIS. Data retention policies must align with statutes such as GDPR and regional data localization rules enforced by national authorities. Proper tuning is essential to reduce false positives, a challenge discussed in literature from SANS Institute and ENISA. Patch management and secure configuration are guided by vendor advisories historically issued by organizations like CERT Coordination Center to mitigate vulnerabilities in logging and correlation components.

Category:Security software