ArcSight ESM
ArcSight's SIM suite, marketed under the guise of ESM, is the most comprehensive SIM tool we tested, and it earns its second consecutive first-place finish (it took top honors in our 2003 review). ESM sports an extremely flexible "connector" framework capable of bandwidth throttling and batch queuing; both Web and Java console access; reporting and incident-analysis tools; support for a wide range of device types, including more than 120 products from 60-plus vendors; and a comprehensive real-time correlation capability that we found helpful. Although the suite is not without its faults, and could be pricey, ArcSight ESM remains a few steps ahead of the competition (though we do see Network Intelligence's and High Tower's products gaining ground).
Our ArcSight deployment ran on three Windows 2003 systems: One housed the "manager" and served as the destination for all correlation and inbound data, one hosted the Oracle database for our back-end storage, and one ran the Java console. The console was a bit of a pig--it didn't run smoothly until we gave it 2 GB of RAM!
ArcSight ESM comes bundled with prebuilt correlation rules that helped us make sense out of a wide range of otherwise confusing activity. Rules flagging potential worm outbreaks due to traffic patterns, identifying suspicious activities, such as "multiple firewall denies followed by an allow," and spotting failed login attempts across multiple systems are just a few among a wide prepackaged set.
We did, however, have some false-positive problems with the stock rule set. For example, the "worm outbreak" rule seemed to misfire frequently. The first few times, the alert sent us into a bit of a panic as we scoured our network for signs of automated nastiness, but we soon discovered that the rule was being triggered by some overzealous Web surfing--an end user's rapid connects to multiple destinations through the firewall confused this particular ArcSight ESM correlation rule. We also ran into problems with "dark space" alarms (traffic communicating to/from our network to IP ranges that are supposedly unallocated or "dark") that were attributable to outdated IP lists. We tuned these rules and eliminated the false positives, but we found it ironic that our primary alert consolidator was creating more alerts.
|
ArcSight ESM also offers a wide set of preconfigured dashboards, as well as a dizzying array of tools to monitor and manage the system. There's an entire dashboard, for example, complete with real-time graphs and tables, for simply monitoring database health and activity. ArcSight also uses a taxonomy-based approach that puts event and alert data into a generic classification, or bucket. A PIX deny event will be placed in a general firewall rule violation bucket, for instance. Not only does this simplify the process of creating correlation rules, it has the neat side effect of letting organizations swap out device vendors--you can replace Check Point firewalls with those from Juniper without worrying about your correlation rules breaking.
Our complaints about ArcSight are restricted to two areas: pricing and ad hoc querying limitations. On the pricing front, we found ArcSight's model cumbersome. The company charges per CPU for its manager, per Java console, per connector type and per device, and has some additional add-ons, such as visualization suites and ticketing integration, that cost--you guessed it--extra.
By comparison, companies such as High Tower charge per appliance, period. ArcSight has the luxury of being the leader in the space and has been able to get by with this pricing structure, but we wonder how tolerant the market will be moving forward with an increased level of competition.
Finally, on the querying front, we have some concerns with ArcSight ESM's implementation. To perform ad hoc queries on, say, an IP address, we had to configure a data feed and range, pull a large dataset from the database to the console, and then perform a search on that local dataset. ArcSight's console applet does a lot of the work, but the task still requires multiple steps, can be confusing, and is often slow and inefficient given how much data you're pulling across the wire. By comparison, LogLogic's ad hoc querying abilities go directly to the database, are incredibly simple and quick.
