OpenText ArcSight

Founded by Tim Bray & Gaston Gonnet & Frank Tompa in 1991

Detect insider threats and credential misuse using self-learning behavioral analytics

Pricing model

Demo

Rating

★ Mixed Reviews

Time to value

Quick Setup (< 1 hour)

You can use OpenText TDR to monitor user and device behavior across your organization and automatically flag unusual activity that could indicate insider threats, credential misuse, or advanced attacks. It builds behavioral baselines for every user and entity without manual rule-writing, integrates with Microsoft Defender for Endpoint and Entra ID, and scores alerts by risk level so your SOC team focuses on real threats. It reduces false positives by up to 90% and maps detections to MITRE ATT&CK for faster investigation.

What OpenText ArcSight does

Baseline normal behavior for every user and device across Microsoft environmentsScore and prioritize alerts by behavioral severity, frequency, and peer comparisonMap detected anomalies to MITRE ATT&CK tactics and techniques automaticallyGenerate LLM-written narratives explaining what happened and what to do nextIngest telemetry from Microsoft Defender for Endpoint and Entra ID without adding agentsCluster related security indicators into single high-priority incidentsBackfill 30 days of historical telemetry during initial onboardingRefresh behavioral baselines daily to account for workforce and role changesContinuously builds behavioral baselines for every user and device without manual rules or thresholdsUnsupervised machine learning automatically adapts to role changes, mergers, and seasonal behavior shiftsReduces false positives by up to 90% through integrated risk scoring and alert clusteringAgentless SaaS onboarding via native Microsoft APIs with actionable detections within hoursMaps every alert to MITRE ATT&CK tactics and techniques with LLM-generated kill-chain narrativesPeer-group comparison surfaces compromised or malicious insiders before privilege abuse occursVisual dashboards with entity heat maps, behavior timelines, and investigation workflowsBackfills 30 days of historical data during onboarding for immediate baseline context

Pricing breakdown

Pricing model: Book a demo

Tutorials & Demos

Frequently asked

Microsoft Entra ID

Want a tailored answer?

See whether OpenText ArcSight fits your stack.

Techbible weighs OpenText ArcSight against what you already pay for, your team shape, and the work that's actually happening. Free to start.

Side by side

Compare OpenText ArcSight

Search the catalog or pick a similar tool to compare pricing, features, and fit.

Or pick from similar tools

More in Cybersecurity

All tools →

Adversa AI

Monitor and block dangerous actions taken by coding agents in real time

AIShield

Protect machine learning and generative AI systems from attacks and vulnerabilities

Arcjet

Secure AI agents and applications at runtime directly in code

Aviatrix

Protect multi-cloud networks and contain data breaches across workloads and AI environments

Blind Insight

Run analytics and machine learning inference directly on encrypted datasets without decryption

CalypsoAI

Protect generative AI applications and agents against prompt injection and sensitive data leaks

Charli

Monitor and control AI agent actions and data access across enterprise systems in real time

Clawvisor

Control and audit the tools and permissions your AI agents can access