What you are evaluating
This profile covers Enterprise Security Manager. Log analytics, automation and other OpenText security products should be scoped separately; a familiar portfolio name does not establish which components or licenses are part of a deployment.
A useful evaluation context
Consider it when existing ArcSight expertise, a varied source estate or deployment requirements justify a detailed evaluation. Account for ongoing connector and rule maintenance rather than treating correlation content as permanently complete.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Bring supported event sources into a collection and normalization pipeline.
- Use correlation rules to identify combinations of activity that merit analyst attention.
- Search and investigate the underlying records to assess whether a correlated signal represents a meaningful incident.
Where it fits in the work
- Select a use case and verify the required connector versions, source fields and time synchronization.
- Build or adapt a correlation rule against fabricated records with a known expected outcome.
- Review the signal and evidence with an analyst, then document operational ownership for changes, retention and recovery.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In a lab, replay fictional remote-access records and an administrative action using intentionally inconsistent timestamps.
Evidence to look for
Correct the time interpretation and show how it affects correlation. Preserve the raw records and explain why a rule can miss a known sequence even while the system successfully receives all of its events.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which connectors and schema mappings support the source versions in the environment?
- Which neighboring OpenText capabilities require separate deployment or entitlement?
- Can the operating team maintain capacity, upgrades and evidence retrieval across the retention period?
Names you may encounter: ArcSight · ArcSight ESM. Historical names do not establish current availability or feature equivalence.