ArcSight Support (Rant)
So I have to ask.
Has anyone else noticed that ArcSight Tech Support does not help or does not respond back to tickets in a timely manner?
I Opened a ticket with Support about our Upgrade not working on Our logger and the ArcSight Support Rep assigned to the case states he will call give me a call but never calls and it has been over a week with No Support actions from ArcSight Support except I the comment "I don't understand what you mean by Factory Default or like new interface with all settings missing."
Has anyone else had problems like this?
If so what course of action did you take to get your tickets worked in a timely manner?
I am just saying if our companies and clients are paying for Enterprise level support why does it seem like we always get the type of support you would except from a fast food worker asking "Would you like fry's with that?" and being given mashed potato's instead.
If you don't get an answer, feel free to send the ticket info to me so I can get it to the relevant person
~ Ofer Shezaf
ArcSight EMEA Product Director
Thanks for this information I will add that PowerPoint to our process binder as good info to know and ref. Sadly this is not a one off issue we have come to have problems with. This is a general issue over all and the post by Samer pointing to https://protect724.hp.com/message/50284#50284 was valid complaint that I think most if not all people requesting support from ArcSight feel. With tickets I have opened in the past on this contract and past contracts I have worked supporting ArcSight I can count on my hands 2 techs (Jim Elin and Repesh) that I can say went out of there to show HP does have a few good Support Reps. Sorry I cant Remember Repesh's last name but he worked with us on ESM DB issues.
The other problem we run into is My systems are on a closed network that I am not able to transfer data from or if I do transfer data it takes a few days ( NO Fast track process) to be screened and cleaned and support reps don't want to or cant do the good ol troubleshooting because we cant get logs when we are down and we role back to a VMware Snapshot. Best I can do is recreate the issue in our Lab by building the environment out the exact way we have it on our closed network but sometimes I cant even recreate the issue. I know working with Microsoft Support they have DOD support reps on all networks that we can email Logs to or upload logs to but we don't even have that option with HP and I know for a fact you guys are all over the DOD networks with your techs supporting this or that Gov agency or Department.
For the most part Even if the tech would keep their word and follow up on the day they said they would follow up with a phone call most of our frustration can be avoided if we just feel like our issue is their issue. On this case our customer got upset and decided to take the loss of logged events and rebuild the system from scratch because ArcSight Support was not replying back. As an onsite support for the company I work for it makes my team look bad when your support does not support us and report to leadership its been 1 week and HP has not followed up on that ticket. One person on my team is now been asked to start looking at other approved SEIM solutions (Splunk) because of this trend that continues to occur over and over.
While ArcSight as a SEIM may be the industry standard I know I have been in meetings talking about going to Splunk because Lockheed Martin Standardizes on Splunk Software for the F-35 Lightning II and we need to be able to integrate into them anyways along with other DOD agencies that left ArcSight and went to Splunk. Don't get me wrong I am in the ArcSight Camp but it gets hard to defend a product that we cant get good support for.
Thanks for the article that you pointed me to that was a great read and a few members of my team also got a good laugh out of it as I hate to say it but its still true. Also thanks for that Email address we will add that to our list of approved Escalation steps if we don't get contact from our Tech Support Rep.
I would like to follow-up on your current open ticket and make sure your logger upgrade issue is addressed appropriately.
I have followed up with an E-mail to you requesting for the ticket information since I was unable to locate any current open tickets. please feel free to either call me or E-mail me the ticket information.
Rani Aswadhati - ArcSight Customer success
It was good talking to you today on the phone and I do wish you the best of luck on the thinks we talked about and with the information your team and Ofer have empowered us with and we have added this to our process binder for when we hit snags in the road. Hopefully those processes work and it will make my job easy to defend ArcSight to my customers.
Thanks again for letting me rant
Thank you for your time today talking to me. I have sent you my contact details and process email that you can use in the future.
Feel free to reach out to me if you need anything.