What It Does

ArcSight ESM is the brain of the ArcSight SIEM platform. It analyzes and correlates every event that occurs across the organization – every login, logoff, file access, database query, etc. – to deliver accurate prioritization of security risks and compliance violations. The powerful correlation engine of ArcSight ESM sifts through millions of log records to find the critical incidents that matter. These incidents are then presented through real-time dashboards, notifications or reports to the security administrator.

How It's Different

With deep understanding of network activities and flows, users, and roles, ArcSight ESM is uniquely able to understand who is on the network, what data they are seeing, which actions they are taking with that data, and how that affects business risk. Unlike competing products, ArcSight ESM can collect from any and every system or device on the network, categorize the data for powerful analysis, and apply modern techniques including pattern recognition and behavioral analysis to detect the sophisticated threats that are hurting organizations every day. Once threats and risks are identified, ArcSight ESM uses its built-in workflow engine to manage incidents and prevent damage.

What's New

• The most sophisticated correlation techniques for accurate incident prioritization
• Behavior-based pattern detection to identify advanced persistent threats (APTs)
• Security against bots, worms, viruses, zero day attacks and hacking attempts
• IT Policy compliance for bandwidth usage and network resource allocation
• Regulatory compliance readiness for government and industry audits