Service Flyer

ArcSight SaaS with Real-Time Threat Detection
Empower your SOC team to be cybersecurity heroes that can focus on
terminating threats, rather than maintaining hardware. Effortlessly detect
and respond to cyberthreats in real-time with ArcSight SaaS.

ArcSight SaaS with Real-Time
Threat Detection at a Glance
Detect Threats in Real-Time
Industry leading event correlation thatcentralizes event log analysis to detect‘known’ threats as they appear.

Native SOAR
Enable your team to efficiently respond tothreats with automation, playbooks, incident
management, SOC analytics, and more.

Native Threat Intelligence
Stay up-to-date on the latest threats with
ArcSight’s native threat intelligence feed.

Content and Reporting
Backed by MITRE ATT&CK mapping,
modular dashboards, hundreds of adjustablecorrelation rules, and more.

Evolve with ArcSight SaaS
Simplify your SecOps, increase time tovalue, and reduce infrastructural workloads,
onboarding, and education times, with
ArcSight SaaS. Let your SOC team be threat
hunters; leave system administration behind.

Welcome to ArcSight SIEM
as a Service

Defending your organization fromtoday’s evolving threat landscape can becomplicated and time consuming. With theeffect of rapid digitalization and the increase
in remote workers, the threat landscapeis increasing significantly and adding to
the workload of security professionals.
Managing infrastructure workloads andsoftware updates brings an additional
challenge for security operations anddistracts security analysts from their core
responsibilities of detecting and defending
their organization from possible attacks.
The ArcSight SaaS by OpenText platform
provides a no-hassle security experienceby eliminating the need to buy, install andmanage severs and by simplifying security
operations to empower your SecOps team.
The ArcSight team takes care of all theservers, hardware, and maintenance on yourbehalf to eliminate security infrastructure
concerns and to free up time for your team tofocus on stopping cyberthreats in their tracks.
With auto-updates, you and your teamcan run on the most cutting-edge ArcSight
solutions and immediately benefit fromtheir capability enhancements.
ArcSight SaaS is an intelligent, holistic
security operations stack with real-timethreat detection, ArcSight SOAR, behavioral
analytics, log management and compliancecapabilities in a scalable, no-hassle environ­ment. It provides a very detailed view into

exactly what is happening in an organization
by turning data into visualizations, alerts, andautomated actions. Backed by 20+ yearsof experience, ArcSight SaaS enables yourSecurity Operations Center (SOC) with anindustry leading SIEM focused on operational
efficiency and 360° threat analysis to reducebusiness risk and streamline your real-time
cyber defense.

Streamline Your SecOps withReal-Time Threat Detection

Faster threat detection and response are
critical to reducing threat exposure time andthe risk of breach. There are many useful
threat detection technologies in the market
today, but real-time event correlation froma SIEM is still the fastest method to uncoverand escalate known threats in a cyberenvironment. It alerts analysts to threatcorrelated events in real-time, rather thanmaking them wait on batched searches.
ArcSight has been a long-time market leader
in real-time threat detection and is now oneof the few vendors to offer this capability in
the SaaS space.
ArcSight SaaS with Real-Time Threat
Detection is a comprehensive data collection
and real-time threat analysis solution witha native threat intelligence feed and native
ArcSight SOAR. The SIEM solution detects
and directs analysts to cybersecurity threats
in real time, with dynamic event risk scoringand prioritization that help analysts toavoid much of the cost, complexity andextra work associated with false positives.

ArcSight SaaS with Real-Time Threat Detection

Further supported by native casemanagement and automated response,
ArcSight enables your SecOps team to react
quickly and accurately to threat indicatorsand cyber incidents.

Enterprise-Wide Event Visibility

ArcSight SaaS with Real-Time Threat
Detection leverages advanced event
collection technology through ArcSight’s
SmartConnectors by OpenText to consolidate,enrich, and analyze data from over 450
different security event source types.
ArcSight SmartConnectors support every
common event format (native Windows
and Linux events, APIs, firewall logs, syslog,Netflow, direct database connectivity, etc.).
ArcSight also ingests data from the cloud(AWS, Azure, GCP, Microsoft 365, and more).
Beyond these, our FlexConnector framework
supports the development of custom
connectors to facilitate the ingestion andcorrelation of additional sources. More event
sources means more visibility and the ability
to develop more complex security use-cases
specific to the needs of your organization.

Automated Response withNative ArcSight SOAR

ArcSight SOAR is considered to be a core
part of modern security analytics, and assuch provides it as a complementary, nativesolution. Backed by out-of-the-box playbooks
and 120+ integration plugins, ArcSight
SOAR effectively and efficiently automatesand orchestrates triage, investigation,and response activities. It supports visual
workflow playbooks, detailed reportingon KPIs, and greater team collaboration
through a complete case timeline.

Defend Against the Latest Threats
with GTAP Threat Intelligence
ArcSight Galaxy Threat Acceleration
Program (GTAP) Basic is the native threat
intelligence feed available to all ArcSight

Figure 1. SOC metrics dashboard

SaaS with Real-Time Threat Detection
users through the GTAP SmartConnector.
It automatically incorporates threat monitoring
content into ArcSight based on open-source
threat intelligence data, providing greater
coverage against modern threats andcampaigns through increased visibility ofindustry threats. ArcSight also integrates
with many third-party and open-source threat
intelligence feeds, and offers curated threat
intelligence protection through GTAP Plus,
ArcSight’s premium threat intelligence solution.

Intelligent and Dynamic Event
Risk Scoring and Prioritization

ArcSight’s unique priority formula for RealTime Threat Detection consists of criteriathat each event is evaluated against todetermine its relative importance, or priority,
to your network. The calculation incorporates
many data points, such as open ports andimported vulnerability scan results fromthird-party solutions. For example, a given
attack might be known to exploit a certain
vulnerability. If the targeted system exposesthat vulnerability and the attacked port isopen on the asset, then ArcSight SaaS canassume that the attack is likely to succeed
and will prioritize it.

Hypothesis-Driven Threat Hunting
with ArcSight Search

Threat hunting is an analyst-centric processthat enables security operations teams
to uncover hidden advanced threats.
It supplements ArcSight’s real-time detection
capabilities and expands on the effectivenessof the solution by leveraging a collaborationof people, technology, and process to
uncover top-tier attackers. ArcSight SaaS
empowers threat hunters by turning data into
insights and actions with ArcSight Search,a core component of the platform.
With ArcSight Search, you’re enabled to do
the following:• Enjoy the ease of threat hunting withvisualizations, fast and detailed search,
reports, and dashboards to hunt for
threats before damage is done.
• Run many parallel searches at high speed.
• Encourage your teams to adopt
exploratory search approaches andcreative mindsets.
• Benefit from the advantage of easy-to-use
transparent results for decision-making.

2

ArcSight SaaS with Real-Time Threat Detection

Dashboards and Visualizations
with ArcSight Reports

ArcSight SaaS comes with 100+ out-of-thebox reports and dashboards, including cloud,
OWASP, data modeler, and MITRE ATT&CK.
ArcSight’s prebuilt and customizable reports
and dashboards, available as part of ArcSightReports (another core component of theArcSight SaaS platform), enable you todecrease the time needed to visualize andshare your security posture, improve yourunderstanding of your security environment,
and achieve enterprise-wide threat visibility.

Easier Compliance withArcSight Reports

Compliance regulations aren’t meant toincrease the workload of a SOC. They’remeant to help organizations improve theirsecurity posture. This is why the compliancemodule for ArcSight SaaS is designed
specifically for cybersecurity. ArcSight
Reports reduces the pain and complexityof compliance reporting with simple,
customizable reports and dashboards. With
policy-driven data collection and retention,and out-of-the-box content, it is easy to run
efficient compliance reports so your team canbe audit-ready at a moment’s notice.

Additional Feature Highlights• Active Lists—Dynamic in-memory lists
capable of holding millions of entries,
these can act as watch lists for monitoring
suspicious traffic or behavior, with theability to use active lists in any
correlation rule.
• Schedule reports—Automated reportingcan prepare reports and deliver results
automatically to key stakeholders.
• ArcSight 360° Analytics Dashboards—
ArcSight’s unifying analytics UI connects allcomponents of the ArcSight SaaS platform
and supports customizable widget-based
dashboards to visualize SOC metrics.

Figure 2. GDPR dashboard within ArcSight Reports• MITRE ATT&CK Dashboards—Get a realtime view of all MITRE ATT&CK related
events happening in your environment,
the top threat techniques facing your SOC,
and a clear image of your organization’s
ability to detect individual techniques.
• Data Security—Protect your data integrity
with immutable data storage.

Transition from ArcSight ESM

ArcSight SaaS with Real-Time Detection is
the natural successor of ArcSight Enterprise
Security Manager (ESM) by OpenText.
Thousands of customers have been drawn
to ArcSight ESM over the years for its marketleading real-time detection capabilities.
But architectural maintenance has always
been a necessary evil for SIEM solutions like
ArcSight ESM, especially when deployed offcloud. With ArcSight SaaS, SOC teams canditch the drawbacks of time-consuming
maintenance while maintaining the enterprisewide threat visibility that ArcSight ESM
users have come to hold dear. Furthermore,
ArcSight SaaS comes with native ArcSight

SOAR and enhanced case management andreporting capabilities over what was available
with ArcSight ESM.
Why Transition from ArcSight ESM
to ArcSight SaaS?
• Eliminate version lag. Benefit from thelatest ArcSight SaaS capabilities as theycome online.
• Simplify migration, by easily exporting/importing your rules and content from
ArcSight ESM to ArcSight SaaS.
• Alleviate analyst fatigue with automatedresponse, native threat intelligence, andreduced maintenance.
• Avoid capability deficit—ArcSight ESM,
although supported, will no longer receivefeature upgrades.

Why ArcSight SaaS?

ArcSight SaaS is a scalable and powerfulnext-gen SIEM platform that enables security
teams to leave behind maintenance andadministration so they can focus on theirtrue passion: finding and eliminating3

Connect with Us
www.opentext.com

threats. The ArcSight SaaS platform is acomprehensive solution developed for
security professionals by security experts.
It takes a holistic approach to security
intelligence, uniquely unifying big datacollection, event monitoring, threat detection,and response. Customers are enabled byadvanced security analytics technologies,
including hunt, investigation, ArcSight UEBA,

ArcSight SOAR and real-time detection,
to execute a powerful, layered analytics
approach to secure their enterprise against
modern threats.
Learn more atwww.microfocus.com/en-us/cyberres/saas/secops

OpenText Cybersecurity provides comprehensive security solutions for companies and partners of all sizes. From prevention, detection and response to recovery, investigation and compliance,
our unified end-to-end platform helps customers build cyber resilience via a holistic security portfolio. Powered by actionable insights from our real-time and contextual threat intelligence,
OpenText Cybersecurity customers benefit from high efficacy products, a compliant experience and simplified security to help manage business risk.
761-000100-002 | O | 10/23 | © 2023 Open Text