From Counting EPS to Hunting Threats: Why I Moved from ArcSight to Microsoft Sentinel
For anyone who worked in cybersecurity ten years ago, HP ArcSight was the gold standard. It was the tool we all looked up to. In fact, if you go back in the archives of this very blog, you’ll see me deep in the trenches of ArcSight ESM, optimizing SmartConnectors and tweaking correlation rules. It was a beast, but it was our beast.
But if you were an engineer back then, you also remember the pain.
I remember spending weeks designing hardware architectures just to handle a predictable spike in traffic. I remember the constant anxiety over EPS (Events Per Second) licensing limits. We weren't just security engineers; we were database administrators, hardware mechanics, and license auditors. We spent 60% of our time keeping the lights on and only 40% actually looking for bad guys.
The "Hardware Ceiling" is Gone
The biggest bottleneck we faced with legacy SIEMs like ArcSight was physical infrastructure. If you wanted to ingest more logs, you needed more storage. If you wanted to run more complex correlation rules, you needed more CPU. Scaling meant purchase orders, rack space, and downtime.
Today, as the founder of New Paradigm Security, I work primarily with Microsoft Sentinel, and the difference is night and day.
Microsoft Sentinel is "Cloud-Native." That’s not just a buzzword—it means the infrastructure is abstracted away. You don't size a server for Sentinel. You just turn it on.
No more EPS anxiety: You pay for the data you ingest, but you never hit a "hard limit" where the system crashes or drops packets because you exceeded your license for 10 minutes.
Elastic Compute: When you run a massive query across petabytes of data, the cloud spins up the necessary compute power instantly and spins it down when you're done.
Data Ingestion: From Months to Minutes
In the old days, connecting a new data source (like a custom firewall or a legacy application) was a project in itself. You had to write regex parsers, configure SmartConnectors, and pray the normalization didn't break.
Sentinel changed the game with Data Connectors. Today, you can connect your Microsoft ecosystem (Office 365, Azure AD, Defender) with literally one click. Third-party firewalls like Palo Alto or Fortinet? There’s a connector for that.
Instead of spending weeks normalizing logs, my team now spends that time configuring Analytics Rules to detect actual threats.
Out-of-the-Box Value
This is where the "New Paradigm" really comes into play. With ArcSight, you often started with a blank canvas. You had to build your use cases from scratch.
Sentinel comes with a Content Hub. It’s essentially an app store for security. Need to monitor for the latest ransomware variant? Microsoft likely already published a solution pack that includes:
Data Connectors to get the right logs.
Analytic Rules to detect the specific attack techniques.
Playbooks (SOAR) to automatically isolate an infected machine.
Workbooks to visualize the data for your CISO.
Focus on What Matters: The Threats
The role of a Cyber Security Engineer has evolved. We are no longer "log plumbers." We are threat hunters.
My goal with New Paradigm Security is to help organizations make this transition. We don't just "install a SIEM"; we build a Security Operation Center (SOC) that scales with your business, not your hardware budget.
If you are still struggling with EPS limits, database maintenance, or blind spots in your monitoring, it might be time to look at how modern cloud SIEMs have solved these problems.
Curious about how this looks for your organization?
Check out our dedicated
