OpenText ArcSight

OpenText ArcSight (formerly Micro Focus ArcSight) is an enterprise Security Information and Event Management (SIEM) and security analytics platform engineered to collect, normalize, correlate, and analyze massive volumes of security log telemetry across hybrid enterprise environments. Serving as the nerve center for modern Security Operations Centers (SOCs), ArcSight provides real-time threat detection, advanced behavioral analytics (UEBA), and automated incident response workflows to help security analysts identify advanced persistent threats, malicious insiders, and complex multi-stage attacks.

The platform is architected around an open, scalable data fabric (ArcSight Data Platform / SmartConnectors) capable of ingesting hundreds of thousands of events per second from thousands of heterogeneous IT, security, and cloud sources. Key technical capabilities include real-time correlation using the Common Event Format (CEF) standard, user and entity behavior analytics (ArcSight Interset) using unsupervised machine learning, integrated security orchestration, automation, and response (SOAR), and scalable threat hunting search engines. By correlating disparate log events against real-time threat intelligence feeds, ArcSight reduces analyst dwell time and accelerates incident containment.

OpenText ArcSight integrates with thousands of enterprise technologies via standard CEF SmartConnectors, including Windows Event Logs, Syslog, firewall appliances, cloud platforms (AWS, Azure, GCP), and enterprise ticketing solutions like ServiceNow. Core enterprise use cases include centralizing enterprise security log monitoring, detecting advanced persistent threats and credential misuse, automating SOC incident response playbooks, and maintaining continuous regulatory compliance reporting for PCI-DSS, SOX, and FISMA. OpenText ArcSight provides enterprise-scale log management, proven correlation intelligence, and resilient SOC operational capability.