SIEM Maintenance Support Costs and Returns

Anton Chuvakin recently wrote up a great blog article discussing SIEM associated costs. While it is my attention to write a longer post here to go a little more in depth on a comment I made in his article I wanted to post something quickly about a line item that probably doesn’t get a whole lot of attention after the bean counters and upper management have done their thing and papers are signed…until something breaks or there is a technical issue of one flavor or another.

What I am talking about is the technical/customer support group. The folks that are on the front line working the tickets and generally speaking are the point at which you engage the company. Sure you can contract for varying SLAs from a ticket turnaround perspective but their character and overall quality isn’t something you can really quantify going into an engagement.

After working with ArcSight’s support group for 2 and a half years now I can say they are a quality group of folks who know their stuff and have an over arching commitment to excellence that is only there by intentional effort, focus, and choice at the corporate and individual level. Don’t get me wrong things haven’t been all sunshine and gumdrops for each ticket. There have been times I have been frustrated to the point of wanting to wring people’s necks, been told things I didn’t want to hear, or they weren’t able to turn something around in the time I had hoped. It is, however, a program that has grown over the years and you could tell, or at least I have the impression, that there was a deliberate plan to take it up a notch. I think it’s a manifestation of the overall corporate policy/culture that I hope doesn’t disappear under HP.

Other people’s experiences may differ but we contracted for premium support and looking back across my 346 tickets (wth!) this group delivered on their end for the things they could control and even some outside their swim lane. In an effort to not miss anyone’s name and for a group that probably doesn’t get let out of their cages very often I will simply say thanks for all the help, your patience, and hitting mute before cussing me out. As I leave for a company that doesn’t have ArcSight I hope whatever support group I have to work with is as quality as you all are.

Mark