We just raised a $30M Series A: Read our story

Compare ArcSight Enterprise Security Manager (ESM) vs. Securonix Security Analytics

Cancel
You must select at least 2 products to compare!
Comparison Summary
Question: Which is the best SIEM tool for a mid-sized financial services firm: Arcsight or Securonix?
Answer: Neither, or both.  Having done literally thousands of SIEM deployments, I can tell you from experience that the technology choice isn't the most important choice. The critical choice is in the resources and commitment to manage and use the system. I've seen countless SIEM implementations fail over the longer term, including all of the big names, because too many people treat it like a "set it and forget it" system. It is most definitely not. A SIEM or UEBA platform is a tool that must be monitored, tuned, and used every day. So I would recommend to you that you spend less time figuring out which technology is the "best" and more time building a plan to integrate it, manage it, and fully utilize it. Or selecting a good team to do that for you.
Featured Review
Find out what your peers are saying about ArcSight Enterprise Security Manager (ESM) vs. Securonix Security Analytics and other solutions. Updated: November 2021.
552,305 professionals have used our research since 2012.
Quotes From Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros
"One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful.""The user experience [is] well thought out and the workflows are logical. The dashboards are intuitive and highly customizable.""It's very, very versatile.""The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events.""In traditional BI solutions, you need to wait a lot of time to have the ability to create visualizations with the data and to do searches. With this kind of platform, you have that information in real-time.""The thing that Devo does better than other solutions is to give me the ability to write queries that look at multiple data sources and run fast. Most SIEMs don't do that. And I can do that by creating entity-based queries. Let's say I have a table which has Okta, a table which has G Suite, a table which has endpoint telemetry, and I have a table which has DNS telemetry. I can write a query that says, 'Join all these things together on IP, and where the IP matches in all these tables, return to me that subset of data, within these time windows.' I can break it down that way.""Those 400 days of hot data mean that people can look for trends and at what happened in the past. And they can not only do so from a security point of view, but even for operational use cases. In the past, our operational norm was to keep live data for only 30 days. Our users were constantly asking us for at least 90 days, and we really couldn't even do that. That's one reason that having 400 days of live data is pretty huge. As our users start to use it and adopt this system, we expect people to be able to do those long-term analytics.""The real-time analytics of security-related data are super. There are a lot of data feeds going into it and it's very quick at pulling up and correlating the data and showing you what's going on in your infrastructure. It's fast. The way that their architecture and technology works, they've really focused on the speed of query results and making sure that we can do what we need to do quickly. Devo is pulling back information in a fast fashion, based on real-time events."

More Devo Pros »

"The filters and the ability to do what you want are the most valuable features. There is nothing that you cannot do in this solution. It has all the features, which makes it very dynamic.""We have been satisfied with the support.""The reports that we are from getting from ArcSight are very valuable. The reporting in ArcSight is good. Our regulators ask us for the reports on a regular basis, and we have been able to provide the required data. Its overall functionality in terms of log analysis and the speed at which it does that is also valuable. It is very quick. Whatever alerts we had configured were extremely fast. We immediately get alerts when there is unauthorized access or unknown access, or even positive access. This is where we found the difference between ArcSight and other solutions.""I really like the correlation part and the way the logs are correlated. I have never faced issues with parsing in this product. I like the way it parses, and everything is so clear to me.""The feature that I have found the most useful is that it can be deployed to the cloud.""ArcSight gives us better visibility into threats that were unknown earlier.""The product is quite mature. It's been around for a long time.""There are many features that are good for clients who are looking for a good SIEM solution. They like the ease of creating a business that is effective and impressive."

More ArcSight Enterprise Security Manager (ESM) Pros »

"There aren't any positive aspects of the solution. It was a complete failure. There are no redeeming features.""The feature that I have found most valuable is their analytics platform where they have the open security data-link, which they introduced. This is typically different from the other vendors.""Customer support and making sure that we're successful has been one of the best features, one that we weren't even looking for during evaluation, but that's what we have found.""The solution is stable and scalable.""I was looking for software as a service rather than having issues with managing hardware, upgrades, updates. I was trying to step away from that. Those were the key factors when looking at Securonix as a full-feature SIEM with next-generation capabilities available."

More Securonix Security Analytics Pros »

Cons
"There's always room to reduce the learning curve over how to deal with events and machine data. They could make the machine data simpler.""There is room for improvement in the ability to parse different log types. I would go as far as to say the product is deficient in its ability to parse multiple, different log types, including logs from major vendors that are supported by competitors. Additionally, the time that it takes to turn around a supported parser for customers and common log source types, which are generally accepted standards in the industry, is not acceptable. This has impacted customer onboarding and customer relationships for us on multiple fronts.""Devo has a lot of cloud connectors, but they need to do a little bit of work there. They've got good integrations with the public cloud, but there are a lot of cloud SaaS systems that they still need to work with on integrations, such as Salesforce and other SaaS providers where we need to get access logs.""There's room for improvement within the GUI. There is also some room for improvement within the native parsers they support. But I can say that about pretty much any solution in this space.""Their documentation could be better. They are growing quickly and need to have someone focused on tech writing to ensure that all the different updates, how to use them, and all the new features and functionality are properly documented.""The Activeboards feature is not as mature regarding the look and feel. Its functionality is mature, but the look and feel is not there. For example, if you have some data sets and are trying to get some graphics, you cannot change anything. There's just one format for the graphics. You cannot change the size of the font, the font itself, etc.""From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments.""I would like to have the ability to create more complex dashboards."

More Devo Cons »

"I am having issues with report generation with older versions. I don't know if this is because of compatibility issues, but report generation has been a little bit difficult in older versions. It is not similar to the newer and current versions. We are looking at moving to the cloud. It would be good if ArcSight ESM can move to the cloud. They already seem to be working on this. It would also be very helpful and great if we can integrate external threat intelligence, machine learning, and AI into this solution. It has good dashboards, but they can always be better. Its stability can also be improved.""The customer experience could be improved.""We would like the ability to easily identify either unused resources or those that are being used sub-optimally.""Its search part can be improved. When I go to the console and search for a few logs or something else, it takes a lot of time. When I try to search for three days or one week, it takes too much time. This is a major area of improvement. I wanted them to include features like SOAR, threat intelligence, and automation, and they seem to have included all these features in version 7.3 or 7.4.""The solution could be more stable.""I would like to have a feature that gives us an entire report listing what devices are integrated.""Currently lacks SOAR feature.""The biggest requirement is that there is no cloud solution for this product yet. They need to create a cloud version. It's the biggest thing they can do to make the solution better."

More ArcSight Enterprise Security Manager (ESM) Cons »

"We would like to see better integration with other products.""The pricing. I'm not sure how they are proceeding with the identity based pricing compared with DB pricing which most of the vendors are using today.""There is slight room for improvement in terms of the initial deployment. What I see is that Securonix is more focused on their product. They are expanding, in a big way, the number of customers. So there has to be a number of dedicated teams to jump on and speed up the deployment process.""Some of the user experience when doing threat-hunting, such as being able to see multiple types of analytics from different log sources in one view, would be beneficial. Right now, there are some limitations around that.""We thought they were going to be a great product, however, they're actually not great at all as an MSP."

More Securonix Security Analytics Cons »

Pricing and Cost Advice
"Be cautious of metadata inclusion for log types in pricing, as there are some "gotchas" with that.""I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money.""[Devo was] in the ballpark with at least a couple of the other front-runners that we were looking at. Devo is a good value and, given the quality of the product, I would expect to pay more.""Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products.""Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs.""It's a per gigabyte cost for ingestion of data. For every gigabyte that you ingest, it's whatever you negotiated your price for. Compared to other contracts that we've had for cloud providers, it's significantly less.""We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom.""Our licensing fees are billed annually and per terabyte."

More Devo Pricing and Cost Advice »

"It's a good price, it's one of the cheaper solutions.""There is a license required for this solution.""ArcSight can be a little bit expensive because of the area that we work in and the cost. Licensing is mostly on a yearly basis, not monthly."

More ArcSight Enterprise Security Manager (ESM) Pricing and Cost Advice »

Information Not Available
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
552,305 professionals have used our research since 2012.
Answers from the Community
Malola Varadhan
author avatarHimanshu Shah
User

Arcsight is a legacy SIEM a Ro-bust log management tool however works on EPS ( Events per second) costing, which mounts recurring cost on year on year basis. However Securonix SIEM based on Data Lake and Advanced Analytics or  UEBA suite which provides rich context of any insider threat. You can also have Incident Responder and Threat hunting along with automated response with Play books with add on SOAR tool. I think for a mid-ranged bank Securonix may suite better , also one can have this as service by Cloud service for above tools if options available for the same.

author avatarAnnette Warren
MSP

Since you are in financial services and your risk is high and there is compliance that your firm should be following. We would need to at least have a conversation before we recommend anything.  


I agree with the other responses this is a specific question and I would need more information to give you the best advice.  

author avatarAji Joseph
Reseller

QRadar, Splunk, or LogRythm could be better options. The success of SIEM solutions depends a lot on the expertise of the SOC team that will be managing the alerts generated by SIEM solutions. It is also worthwhile to evaluate the forensics capability of these solutions before buying.  

author avatarSimo Sim
User

I would agree that besides the technology you also need the manpower behind it. And with regards to technology, you asked Securonix vs Arcsight. I would go with Arcsight, to gain the visibility into the logs first. I have worked with Arcsight for 8 years now as a partner and as a customer. We were able to ingest logs from anywhere, we were able to ingest logs from anything - custom applications, custom logs - not to mention the logs from the usual security devices - and you also get the OOB support for a lot of devices - Sales claims they have the broadest support with regards to other SIEM vendors. 


Yes it was said that it was dated, but they are really making strides to modernize the solution and they will also integrate a Machine Learning UEBA from Interset. My suggestion would be to deploy a SIEM first, which can then be upgraded with an UEBA solution. 


author avatarAngel Rivera Baez
Real User

We didn’t use any of the products but I include you a link to Gartner comparison. https://www.gartner.com/review.

author avatarJoseph Slattery
Vendor

To be upfront 


I am a security vendor and we are the authors and developers of Snare our SIEM-agnostic Enterprise solution for log collection and log management. 


We work with lots of Siem vendors and Snare deploys and integrates with all major SIEM platforms e.g. Arcsight, Qradar, Splunk, RSA. We have over 500 Banks and financial services companies using Snare Agents and Snare central where we have been able to contain and reduce their Siem ingestion charges by up to 60% where the Siem vendor charges for log data ingestion by EPS, GB or any metered basis - https://www.youtube.com/channel/UCr8sLTVcI7oivIjEQBfu7UA.


Snare collaborates and compliments SIEM solutions. Snare Agents provide Granular Filtering @ Source, Truncation of Noise out of logs @ Source in a lightweight Agent. Snare Central provides dashboard analytics to monitor log traffic from windows, Linux, Unix, OSX, Syslog feeds etc.while also providing "Out of the Box Compliance Reporting, Alerts" and ability to reflect logs to multiple destinations simultaneously. 


From our experience, Arcsight is a good SIEM, very feature-rich but does require a lot of resources and is generally very expensive one-time and ongoing ingestion of logs into Arcsight (unless you have Snare). Arcsight connectors provide an agentless collection process but this has many issues as it is not as secure as Agents and can invite log tampering, no encryption, unable to set group policy etc...


I have lots of my customers using Snare Agents with logs going to Arcsight and can provide a reference point if required. My largest financial services customer has over 100,000 Snare agents filtering, reflecting logs to Arcsight. Please take a look at https://www.snaresolutions.com/siem-integration/

author avatarAndrés Batista
Vendor

Securonix is a good SIEM tool, even if you want to use it as a service (SaaS) solution. 


UTMStack is another Next-Gen SIEM that delivers cybersecurity services like Penetration Testing, Vulnerability Assessment, SOC-as-a-Service, and others at a cost-effective price.


Both are recommendable, and your election depends on what you need.

Questions from the Community
Top Answer: It's very, very versatile.
Top Answer: Devo, like other vendors, doesn't charge extra for playbooks and automation. That way, you are only paying for the side… more »
Top Answer: I need more empowerment in reporting. For example, when I'm using Qlik or Power BI in terms of reporting for the… more »
Top Answer: In my market, a lot of financial companies had or have an ArcSight installation. Just because in former times it was… more »
Top Answer: Compared to the pricing of other products, Securonix's pricing is pretty good. Clients can get half of the price of… more »
Top Answer: The monitoring, analysis, and visualization of data that Securonix provides is good. However, there are some things that… more »
Comparisons
Also Known As
Micro Focus ArcSight, HPE ArcSight, ArcSight
Securonix
Learn More
Overview

Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

ArcSight is Micro Focus' leading Security Information and Event Management (SIEM) solution. ArcSight helps businesses protect their data through compliance solutions and security analytics.

There are a number of different products and solutions in the ArcSight family so you are able to pick and choose those that are best suited to your business requirements.

With ArcSight, IT can:

  • Monitor IT infrastructure.
  • Manage insider security with secure identity and access control.
  • Automate compliance.
  • Monitor applications.
  • Manage security risks.
  • Identify APTs.

SNYPR is a next-generation security analytics platform that transforms big data into actionable security intelligence. Built on a Hadoop big data security lake, SNYPR combines an open data model, log management, security incident and event management (SIEM), user and entity behavior analytics (UEBA) and fraud detection into a complete, end-to-end platform that can be deployed in its entirety or in flexible, modular components.

Offer
See Devo in Action

See how Devo allows you to free yourself from data management, and make machine data and insights accessible.

Learn more about ArcSight Enterprise Security Manager (ESM)
Learn more about Securonix Security Analytics
Sample Customers
United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel
Lake Health, U.S. Department of Health and Human Services, Bank AlJazira, Banca Intesa, and Obrela.
Dtex SystemsPfizerWestern UnionHarrisITG
Top Industries
VISITORS READING REVIEWS
Computer Software Company28%
Comms Service Provider20%
Government8%
Financial Services Firm7%
REVIEWERS
Financial Services Firm34%
Comms Service Provider21%
Computer Software Company10%
Insurance Company7%
VISITORS READING REVIEWS
Computer Software Company29%
Comms Service Provider21%
Government8%
Financial Services Firm7%
VISITORS READING REVIEWS
Computer Software Company29%
Comms Service Provider16%
Financial Services Firm8%
Government6%
Company Size
REVIEWERS
Small Business17%
Midsize Enterprise17%
Large Enterprise67%
VISITORS READING REVIEWS
Small Business48%
Midsize Enterprise15%
Large Enterprise36%
REVIEWERS
Small Business24%
Midsize Enterprise16%
Large Enterprise59%
VISITORS READING REVIEWS
Small Business16%
Midsize Enterprise2%
Large Enterprise83%
REVIEWERS
Small Business33%
Midsize Enterprise8%
Large Enterprise58%
VISITORS READING REVIEWS
Small Business41%
Midsize Enterprise34%
Large Enterprise26%
Find out what your peers are saying about ArcSight Enterprise Security Manager (ESM) vs. Securonix Security Analytics and other solutions. Updated: November 2021.
552,305 professionals have used our research since 2012.

ArcSight Enterprise Security Manager (ESM) is ranked 7th in Security Information and Event Management (SIEM) with 15 reviews while Securonix Security Analytics is ranked 8th in Security Information and Event Management (SIEM) with 6 reviews. ArcSight Enterprise Security Manager (ESM) is rated 7.4, while Securonix Security Analytics is rated 8.0. The top reviewer of ArcSight Enterprise Security Manager (ESM) writes "A mature and simple to use product, but needs a cloud deployment option". On the other hand, the top reviewer of Securonix Security Analytics writes "The solution has helped by reducing the number of false positives in half". ArcSight Enterprise Security Manager (ESM) is most compared with Splunk, IBM QRadar, LogRhythm NextGen SIEM and McAfee ESM, whereas Securonix Security Analytics is most compared with Splunk, Exabeam Fusion SIEM, IBM QRadar, Microsoft Sentinel and McAfee ESM. See our ArcSight Enterprise Security Manager (ESM) vs. Securonix Security Analytics report.

See our list of best Security Information and Event Management (SIEM) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.