4 ms·

This is totally normal practice. Also most likely ArcSight used by pentagon can be totally different beast then ArcSight used by private companies. Also most

• heisenbit 9y ago
  ArcSight processes security events. These typically come from devices or server log files. Events are filtered and tagged with context before being sent to the server where they are further processed. The primary processing is correlation done in-memory which is a strength of the product. Each installation is different - deployment site of probes, filter, tagging and correlation rules. There is not much be gained by looking at the code vs. knowing the Pentagon uses ArcSight. The one security relevant aspect is the fact that ArcSight processes data from the internet. Programming error in that code may contain vectors allowing a RCE. On the other hand the product has been around for a while and should be safe. ArcSight is not only used by the Pentagon but by many tier-1 companies to monitor their networks. Unless it falls under ITAR companies can sell their product in whatever manner they like.