Micro Focus ArcSight

Short Summary

Cyberattacks are growing in sophistication, and traditional cybersecurity tools have struggled to keep pace, especially as global supply chains and private organizations remain fragile due to the Covid-19 pandemic and geopolitical instability. In this context, organizations need strong security foundations, resilient operations, and the ability to detect and respond to incidents through real-time monitoring and analysis. Many have therefore built or expanded Security Operations Centers (SOCs), historically centered on SIEM solutions for collecting, storing, and investigating security events across diverse sources.

SIEM, coined in 2005, initially promised comprehensive security monitoring but often delivered overwhelming false positives, alert fatigue, high deployment and maintenance costs, limited real-time response, and scalability constraints. As IT environments grew more complex, legacy SIEMs struggled to adapt. Over the last decade, SIEM capabilities improved by incorporating machine learning, UEBA, SOAR, NDR, and EDR-aligned workflows, enabling more automation, better analytics, and more streamlined incident handling. Next-generation SIEMs are expected to reduce dependence on scarce expert operators through actionable alerts, automation, risk scoring, threat hunting, and easier forensic investigation via integration with other security tools.

Micro Focus (founded 1976) owns ArcSight following a 2017 spin-merger with HPE software. ArcSight, established in 2000, is now part of Micro Focus’ CyberRes portfolio and is positioned as an end-to-end SecOps platform integrating SIEM (ESM), native SOAR, Recon for log management and hunting, Galaxy threat intelligence (GTAP feeds), ArcSight Intelligence for ML-driven anomaly detection and risk scoring, and SODP for real-time data collection and transformation with smart connectors for extensive source coverage. ArcSight emphasizes layered analytics (correlation plus supervised and unsupervised ML), multiple deployment models (SaaS, cloud-hosted, on-prem), MITRE ATT&CK dashboards, and modernization toward a unified interface, data model, and storage—while acknowledging ongoing modernization work, on-prem maintenance burden, and lack of EDR.

Interesting Facts

• The term SIEM was coined by analysts in 2005.
• Micro Focus was founded in 1976 and is headquartered in Newbury, UK.
• Micro Focus completed a spin-merger with the software business of Hewlett Packard Enterprise in 2017, gaining ownership over ArcSight.
• ArcSight has existed since 2000, predating the SIEM concept.
• ArcSight components include Enterprise Security Manager (ESM), SOAR, Recon, Galaxy Threat Acceleration Program (GTAP), ArcSight Intelligence, and the Security Open Data Platform (SODP).
• Micro Focus acquired Interset in 2019 and ATAR Labs in 2020 and integrated their UEBA and SOAR technologies into ArcSight.
• ArcSight Recon was launched in July 2020.
• GTAP has two offerings: GTAP Basic (native to ArcSight) and GTAP Plus (premium).
• SODP Smart-Connectors can connect to over 450 data sources.
• ArcSight has been used by NPC Ukrenergo to protect Ukrainian electricity transmission and regional power systems by increasing visibility into threat data and enabling cross-team collaboration.

Notable Quotes

• “In times of crisis, resilience and business continuity are fundamental.”
• “Essentially, legacy SIEMs failed to cope with new threats as IT infrastructures became more complex and sophisticated.”
• “The latest generation of SIEM solutions incorporate innovative intelligence and automation capabilities that create more streamlined and automated workflows for dealing with security incidents.”
• “As opposed to traditional SIEMs, next-generation solutions should not require a team of trained security experts to operate, relying instead on actionable alerts understandable even to businesspersons…”
• “Despite the long and arduous journey, SIEM solutions remain a core component of modern enterprise security architectures.”
• “The ArcSight platform provides the necessary tools in the face of overwhelming incident volume, fragmented solutions, and alert fatigue.”
• “ArcSight Intelligence takes data and uses unsupervised machine learning to identity unusual patterns of behavior, detect anomalies, and alert threat hunters of ongoing attacks.”
• “ArcSight’s layered analytics enables faster, more accurate threat detection of both known and unknown threats.”
• “ArcSight's battle-tested performance in current war zones is one of its unique selling points.”
• “By implementing the current modernization program, ArcSight has begun to unify all its components into a single end-to-end security operations platform…”