SECURITY ATLAS / EVALUATION BRIEF
OpenText Enterprise Security Manager
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/opentext-arcsight/

THE ATLAS TAKE
Atlas judgment: OpenText Enterprise Security Manager is most credible where a team needs detailed event correlation and already has ArcSight operational expertise or a clear reason to retain its deployment model. SmartConnector behavior and event-field choices are central to the product’s value, because correlation can only use what reaches the manager. The evaluation should focus on maintainable detection content, evidence fidelity and platform resilience rather than age or brand familiarity. Compare modernization against migration using the same investigation requirements, and keep adjacent OpenText storage, analytics and automation products outside the assumed ESM entitlement.

SCOPE
This profile covers Enterprise Security Manager. Log analytics, automation and other OpenText security products should be scoped separately; a familiar portfolio name does not establish which components or licenses are part of a deployment.

WORTH A LOOK WHEN
Organizations with skilled ArcSight engineers and explicit requirements for controlled correlation and event processing.

THINK TWICE WHEN
There is no capacity to maintain connectors, content, platform upgrades and a recovery procedure.

IMPLEMENTATION
1. Inventory connector and content dependencies
Map important rules and investigations to connector versions, normalized fields and supporting asset context.

2. Prove the target topology
Size the proposed manager and related infrastructure, document supported versions and agree backup and failover ownership.

3. Migrate content with evidence fixtures
Replay known scenarios after upgrades or connector changes and keep source-to-rule traceability.

OPERATING REALITY
A capable ESM deployment depends on connector administration, event normalization, content tuning and platform availability. Atlas would make field-reduction choices reviewable by detection owners; an optimization that lowers transport volume can remove context an investigation or correlation rule relies on.

COMMERCIAL CONSIDERATIONS
The reviewed pages do not establish a universal ESM price; request capacity, infrastructure, support and adjacent-module scope in a single proposal.
- Licensed processing and selected ESM scope
- Connector and platform infrastructure
- Content maintenance, upgrades and specialist support

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Trace an event through normalization
Acceptance evidence: Keep the raw fixture, connector output and ESM fields, confirming that a chosen custom field survives intact.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Test correlation precision
Acceptance evidence: Replay an ordered synthetic sequence and a similar benign case, retaining rule conditions and the explanation for each result.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Validate the field-reduction decision
Acceptance evidence: Repeat an investigation before and after the proposed transfer optimization and document any lost context or changed rule outcome.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which connectors and schema mappings support the source versions in the environment?
- Which neighboring OpenText capabilities require separate deployment or entitlement?
- Can the operating team maintain capacity, upgrades and evidence retrieval across the retention period?

EVIDENCE GAPS
- No independent throughput, detection-quality or operational-cost result was measured.
- Confirm supported topology, current connector compatibility and the licensing of any adjacent analytics or storage component.

SOURCES
OpenText Enterprise Security Manager (Product information)
https://www.opentext.com/products/enterprise-security-manager
ArcSight ESM 7.9 documentation collection (Documentation)
https://www.microfocus.com/fr-fr/documentation/arcsight/arcsight-esm-7.9/
ESM 7.9 administrator guide (Documentation)
https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.9/pdfdoc/ESM_AdminGuide/ESM_AdminGuide.pdf

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.