ArcSight Logger - Log Management

Log Management is typically used to streamline compliance audits, enhance security posture, and adhere to service level agreements. Effective log management requires broad event collection, efficient storage and straightforward analysis of large amounts of log data. ArcSight Logger uniquely addresses those challenges along with simplicity in deployment and management, small to enterprise scale, and elimination of tradeoffs between performance and efficiency.

By leveraging the event normalization abilities of ArcSight Connectors, ArcSight Logger can manage and report on log data from hundreds of types of commercial products. It can also easily manage raw events in syslog or other formats based on customer preference.

Many customers capture logs for compliance reporting, and so efficient storage is important. ArcSight Logger can store an effective 35 TB of log data on a single appliance, and can also be deployed to work with SAN-based storage. In either case, ArcSight Logger provides a variety of means to ensure audit-quality log data storage.

A key differentiator for ArcSight Logger is the ability to drill down from alerts and reports directly to the source events behind each alert and report. As a result, customers using ArcSight Logger enjoy the ability to perform "forensics on the fly", without the need to run new reports to understand why an alert occurred. The benefit is faster response and less time spent researching alerts. High performance search and reporting can reduce hours of manual effort down to minutes or seconds, but too many solutions deliver analysis performance only by compromising collection rates and storage efficiency. Only ArcSight offers Log Management without compromising performance or efficiency!

Alerts and reports can be presented through a personalized portal, or sent to other systems such as email or SNMP consoles. Through ArcSight Compliance Reporting modules, customers gain the benefit of best practices for specific regulations, packaged as pre-built rules, reports, alerts, and dashboards.

ArcSight Logger appliances are available in a range of performance options and price points for organizations of any size. Specialized configurations, such as the ArcSight PCI Logger, offer all-in-one turnkey appliance for collection, storage, and pre-packaged audit content for small merchants to jumpstart their PCI initiative with minimal effort. Large distributed organizations benefit from the ability to scale collection and storage layers across remote locations and data centers.

ArcSight Logger
Appliance Specifications*

Actual performance will depend on factors specific to a user’s environment