Functions of Arcsight SIEM

ESM collects ,normalizes.aggregates and filters events from assets in network.

Events are prioritized according to risk,vulnerabilities and criticality.

Prioritized events are then correlated ,monitored,analyzed and remediated by ESM tools.

Correlation : It is a process to discover relationship between events and based on relationship events are prioritized and later according to priority events are handled.

Monitoring : Critical events are monitored and remedial action taken before incident occurrence

Workflow : Workflow framework is defined for timely escalation of critical events

Analysis : Critical events can be analysed and drilled by tools within Arcsight

Reporting : Reports are generated manually/scheduled