ArcSight Logger Reviews

Name: ArcSight Logger
Brand: OpenText
Rating: 3.9 (31 reviews)

3.9 out of 5

31 reviews
80% willing to recommend

686 followers

What is ArcSight Logger?

HPE ArcSight Data Platform (ADP) offers a future-ready data solution that enriches data in real time and supports open standards for better threat detection. Using security data connectors, ADP collects data and enriches it in real-time to give analysts organized information that can be acted upon instantly.

Get the ArcSight Logger Buyer's Guide and find out what your peers are saying about ArcSight Logger, Wazuh, Dynatrace and more!

ArcSight Logger is the #30 ranked solution in Log Management Software. PeerSpot users give ArcSight Logger an average rating of 7.8 out of 10. ArcSight Logger is most commonly compared to Wazuh: ArcSight Logger vs Wazuh. ArcSight Logger is popular among the large enterprise segment, accounting for 62% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 20% of all views.

Helped 851,823 peers since 2012

Featured ArcSight Logger reviews

Nagendra Nekkala.

Senior Manager ICT & at Bangalore International Airport Limited

The technical support team is very slow. The support persons do not take prompt action. They take too much time to implement new changes. Even if we tell them that we are not able to get critical logs, they take almost three to four days to provide a resolution. The support is not good.

Read full review

Geraldo Freitas

Analista de TI - suporte a redes e segurança at Tribunal de Contas da União

Investigation is good when you know what you want to search for in Logger. The most difficult part is parsing the logs and configuring the parsers. For investigation, it's good. For correlation, it's not good. We use Sentinel, and Sentinel has pre-built use cases that are much easier to configure. So, it enhances our security incident investigation. We have inbound integration, but configuring the parsers is sometimes very difficult. We only have two use cases where we have a correlation set up. We send the information to Check Point to block IP addresses when we see a lot of blocks from the same source. We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist. So, it offers the ease of integration.

Read full review

Hassan Moussafir

Information Security Senior Expert at Wafaassurance

The solution is scalable, but it depends on the license you acquire. You can expand your license as needed if you need to integrate more infrastructure. For us, our goal was to integrate all the infrastructure so we acquired a license with the expansion option so that we could integrate all the infrastructure that we wanted to. In order to expand, users should expect to pay additional fees. We are in the digital transformation space. This transformation means that very quickly we may need to be able to add more and more servers into our infrastructure. It was important that the solution we chose had a license that covered that capability.

Read full review

ArcSight Logger mindshare

As of May 2025, the mindshare of ArcSight Logger in the Log Management category stands at 0.8%, down from 1.1% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Log Management

PeerResearch reports based on ArcSight Logger reviews

Type	Title	Date
Category	Log Management	May 20, 2025	Download
Product	Reviews, tips, and advice from real users	May 20, 2025	Download
Comparison	ArcSight Logger vs Wazuh	May 20, 2025	Download
Comparison	ArcSight Logger vs Splunk Enterprise Security	May 20, 2025	Download
Comparison	ArcSight Logger vs Datadog	May 20, 2025	Download

Title	Rating	Mindshare	Recommending
Wazuh	3.7	14.8%	79%	46 interviews Add to research
Dynatrace	4.4	5.0%	95%	347 interviews Add to research

Valuable Features

ArcSight Logger is an impressive tool for collecting and analyzing large amounts of log data. The UEBA feature has reduced event response time, while the provisioning engine is highly valued. The solution is specifically designed to manage large environments of network devices and servers. The log digestion features from threat intelligence platforms are valuable, and it is capable of handling massive database platforms. Users appreciate the speed of search operations and ease of exporting and forwarding logs to other products.

"We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist."
"Our return on investment for implementing ArcSight Logger over the past 12 months has been positive."
"The machine learning is a good feature."

Room for Improvement

Areas for improvement in ArcSight Logger include better functioning connectors and updated user manuals. Some find the product slow, making it difficult to work with, and the dashboard is not intuitive or efficient, requiring training to use effectively. There have also been issues with storage capacity, and the search mechanism is complicated for new users. There are also performance issues noted by some when ingesting and forwarding data.

"ArcSight has been sold two or three times, and the quality has decreased."
"We find that the search and access functionality is quite slow."
"The next release should have AI capabilities."

ROI

ArcSight Logger is user-friendly, reducing operational time for technical teams to focus on other tasks. It helps identify fraud and outage causes. While expensive, with a licensing limit of 80 servers, it serves enterprise customers needing compliance and security. Outcomes depend on user case utilization. Positive returns have been reported over 12 months.

Pricing

ArcSight Logger is seen to be an expensive and difficult enterprise product to set up. Licensing costs are charged yearly and are standard.

"We have a lifetime license, so we don't pay a monthly fee."
"Pricing is reasonable compared to similar tools on the market. They offer perpetual licenses."
"I rate the product’s pricing a seven out of ten, where one is inexpensive, and ten is expensive."

Popular Use Cases

ArcSight Logger is primarily utilized for monitoring perimeters, storing logs, incident response, and investigations. Organizations in the telecom, enterprise, and service provider sectors deploy it on-premises for log management, compliance, and security event logs. Users value its capabilities for structured log storage, analysis, security monitoring, and integrating with firewalls and syslog servers. It assists in detecting malicious activities, managing authentication failures, and supporting VIP member checks and Windows event management.

Service and Support

Users report positive experiences with ArcSight Logger's customer service and technical support. The support is considered good, with some users praising their cooperation and accommodation during the problem-solving process.

There have been complaints about the availability of level-3 engineers in certain time zones, leading to delays in receiving support.

Deployment

Some found the initial setup straightforward and easy, while others found it to be time-consuming and complex. There are multiple components to address, and setting up the use cases can also take a significant amount of time.

Scalability

The scalability of ArcSight Logger is highly praised by its users, with many rating it a 10 out of 10. The solution is easy to expand and add more sources to, with some users having up to 6,000 machines sending logs.

Proper identification of areas that require more resources is important for successful scaling, as the architecture of ArcSight Logger can become complex for larger organizations.