ArcSight has been a pioneer in the security event management business since 2000, and the company's leadership shows in the richness, flexibility, and maturity of its offering. The product lineup is led by the ArcSight Enterprise Security Manager and Logger event log management appliances, although the company has smaller appliances and companion modules for identity-based and compliance monitoring.
Unlike most of the products in this review (all except Splunk), which throw in some SIEM functionality, Logger is strictly for event log collection and reporting. It doesn't include event processing rule sets or make decisions about incoming information and alert you to security events. Rather, it simply sucks in all of the log information you want to analyze and generates reports on it.
For this review, ArcSight sent me the Logger 4 7200-series appliance (2U) with six 1TB RAID5 drives, the maximum amount of internal storage available. Using default compression, ArcSight says the unit can store 42TB of event storage before needing to archive to external storage, though I did not verify this.
Logger 4 runs on 64-bit Oracle Enterprise Linux with one or two Intel Xeon Quad Core 2.0GHz processors, two or four network interfaces, and 12GB or 24GB of RAM. Initial setup was fast and easy -- standard for today's appliances. Configuration, management, and operations can be done using a command-line interface or an HTTPS-protected Web GUI.
Events can also be collected by one Logger and forwarded to other Loggers and ArcSight solutions, a handy feature for handling remote offices. ArcSight claims that more than 100,000 events per second can be sent to one appliance. I did not stress test this claim, but in my limited tests, Logger handled complex queries against gigabytes of data very well.
Events are collected into individual, customizable storage groups (up to five), which can be set up for particular device types, for different networks, or to meet different collection needs. Storage groups can be configured for size, maximum event age, and reporting priorities. Storage groups are a great feature for managing device resources, and ArcSight's were the most customizable among the products in this review.
The initial logon takes you to a role-customizable dashboard, which at first focuses on the monitoring the system's performance, including CPU utilization and event logging metrics. Most admins will spend much of their time within the Analyze tab, where search queries and alerts can be defined.
Luckily, the Search Builder graphically presents the various structured data fields available and lets the user point and click their way into complex queries. Search queries can be saved and even analyzed before running to find any weaknesses.
No matter how you construct the query filter, the query itself is very fast. Most queries, even across tens of millions of events, only took seconds. Each query result includes how long it took the query to execute and how many events per second it queried to reach those findings. Queries can be executed across multiple Loggers at once. Results can be saved and exported, and the query can be turned into an alert. One note of caution: ArcSight has artificially limited Logger to five active alerts at once. More flexible alerting can be enabled in ArcSight's other products.
Reporting is another strong feature. Logger comes with many built-in reports; my favorite was the SANS Top Five report set and the ability to create customized reports. Logger has the most design and editing options for reports of any product in this review. Reports can be ad hoc, run on a predetermined schedule, converted into multiple formats (including HTML, PDF, and Microsoft Excel), or added to the dashboard.