How To Sell ArcSight Security Information and Event Management Solutions

Solution Overview
ArcSight security and compliance solutions intelligently identify and mitigate business risk by delivering a centralized view of enterprise-wide events. ArcSight solutions provide a real time and historic view into external attacks, insider threats and regulatory compliance. ArcSight provides organizations with comprehensive, real-time, security situation monitoring, visualization, reporting, analysis and remediation capabilities. Product Range
ArcSight ESM ArcSight Logger ArcSight TRM ArcSight NCM
Branch-Remote Office ArcSight ArcSight SmartAgents Web, Email, SmartAgents Applications, Data Servers WLAN Servers
WLAN SAP, Citrix, Oracle Clents IP Telephony Server

UPS

UPS

ArcSight Connector Appliance

IDS IPS AV

ArcSight SmartAgents Clients PCs Other IP Phones `

UTM VPN Firewall Routing

VPN Firewall Security

ArcSight Connector Appliance

ArcSight NCM
Switching PoE

IP Network
VPN Firewall Security

ArcSight TRM

ArcSight SmartAgents Router Firewall IDS Switching Other ArcSight Insight Packages

Questions to Ask

ArcSight Logger Central Site

ArcSight Connector Appliance

ArcSight Console

ArcSight ESM

` Are you looking for a proven solution that automates the provisioning, configuration, and auditing of network device changes? Branch-Remote Office Do you want to protect IT assets, mobile deployments, routers, firewalls, intrusion detection systems, and applications? Do you need to manage information risk, assess your Benefits organizations security posture and identify malicious Broad Range of Data Sources Supports an extensive range of data sources from more vendors and insiders? in more categories than any other Security Information and Event Management system. Do you want the ability to capture and analyze all Visibility Provides network visibility that extends beyond the infrastructure and enables you to link enterprise log data while providing a compressed, business policies to specific network actions. cost-effective and self-managing log repository? Intuitive Interface Provides an intuitive front end that enables lower-level support staff to master Do you want to be able to pinpoint the exact location the tool with unmatched simplicity and ease of use. of any compromise on your network and respond immediately with specific, policy-based actions? Reduces Business Risk Intelligently collects and distills millions of enterprise-wide events down to the most critical information necessary for organizations to make informed decisions to protect their Would you like automated audit control monitoring and businesses. reporting that helps to identify risks in real time as well as demonstrate compliance with regulations and Scalable, Flexible and Extensible Platform ArcSight is proven to scale to some of the worlds internal directives? largest networks. Built on a flexible, extensible platform, it allows content portability from one implementation to another, within and across organizations. Pre-Packaged Capabilities Includes a variety of pre-packaged capabilities such as network Things to Know monitoring, intrusion monitoring, configuration monitoring and administration and workflow What is the ArcSight Advantage? ArcSight supports monitoring. a comprehensive range of data sources from more vendors and in more categories than any other Security Appliance Based Logging Delivered in a range of turnkey, stackable appliances that support high performance collection of logs from any source into a highly compressed yet easily searchable and Information and Event Management system. Over 180 self-managing log data repository. products, from over 85 vendors, representing 36 data categories are connected to the ArcSight system by over 200 ArcSight SmartConnectors. SmartConnectors Target Markets are updated frequently to accommodate new versions Enterprise ArcSight solutions mitigate external threats by detecting problems at the perimeter as of supported products. well as those that originate from no perimeter technologies such as mobile devices. ArcSight can What is the Business Advantage? Designed with also detect and monitor insider threats resulting from access violations, discrepancies between the needs of highly complex, geographically physical and logical access controls and mismatches between timesheet systems and GPS data. dispersed and heterogeneous business and technology Education ArcSight solutions help educational institutions to stop malicious attacks and security infrastructures in mind, ArcSight provides the industrys breaches dead in their tracks. Schools utilize ArcSight solution to automatically gain visibility only vendor-neutral solution for intelligent identification, into insider threats, fully protect their perimeters against malicious attack and manage compliance prioritization and network response to external security requirements. attacks, insider threats and compliance breaches. Healthcare Delivers the protection healthcare providers require from security devices plus a solid return on investment. Offers easy integration with proprietary applications and security technologies, and provides the ability to identify insider threats through comprehensive data collection. Also offers streamlined HIPAA compliance through centralized management, concrete workflow and pre-configured reports. Finance Allows financial institutions to take a comprehensive approach to log aggregation, monitoring and forensics thereby improving its overall security posture and allowing them to more effectively comply with Sarbanes-Oxley and SAS 70 requirements.

securitypoint.westcon.com

How To Sell ArcSight Security Information and Event Management Solutions

Product Overview
ArcSight ESM
ArcSight ESM Provides a comprehensive enterprise security platform that centrally collects and analyzes events from devices, systems and applications across the enterprise. Organizations use ArcSight ESM to discover risks, correlate relevant information, assess vulnerabilities and communicate compliance to stakeholders and customers. The ArcSight ESM console provides organizations with comprehensive, real time, and expert information analysis and remediation capabilities. ArcSight Compliance Insight Packages for ESM Leverages a unique multi-standard approach to deliver a ready-to-use, best practices-based compliance log review foundation to immediately begin assessing and demonstrating control effectiveness for regulatory compliance and IT Governance. ArcSight Insider Threat Package Acts as an early warning system designed to detect suspicious activity, such as printing large numbers of files outside of business hours, emailing large attachments to personal email accounts, employee communication with competitors or the clearing system audit logs to cover up ones tracks. The Insider Threat package also includes information leak and IT sabotage-specific detection capabilities. ArcSight Interactive Discovery Helps IT security professionals instantly pan, zoom and switch perspectives across complex technical data to perform in-depth analysis of security data and discover risks they might have otherwise missed. ArcSight Pattern Discovery Automatically examines massive amounts of events collected and processed by ArcSight ESM to discover repeating sequences such as emerging worms, worm variants, rootkit and lowand-slow attacks. It then automatically creates rules which fingerprint these patterns for future identification and response.

ArcSight Logger
A turnkey appliance which captures and analyzes all enterprise log data while providing a compressed, cost-effective and self-managing log repository. The enterprise event data can be leveraged for purposes ranging from threat detection and forensics investigations to rapid troubleshooting and simplified compliance monitoring.

ArcSight TRM
Provides an easy-to-use appliance that allows user to locate an endpoint on the network and provide information on how its accessing the network. Once located, ArcSight TRM can determine the closest control point and the recommended quarantine method to isolate the endpoint from the network. From this analysis, ArcSight TRM will quarantine the endpoint in a controlled and self-documenting framework that includes: authorization queuing, login credential protection, full audit trails, quarantine log and history.

ArcSight NCM
Provides an easy-to-use, easy-to-integrate central configuration repository appliance that allows users to look at the network graphically; compare different configuration versions; validate configuration against policy; and provide role-based control of configuration changes. ArcSight NCM also provides a wizard builder that allows organizations to create dialog-boxdriven configuration controls that simplify how configuration commands are represented. This reduces the configuration information to a need-to-know basis and controls the configuration setting options to display only those that are allowed by the organization.

Doc.Ref:Feb08v1

securitypoint.westcon.com