From OpenText ArcSight to Graylog

ArcSight migrations are rarely urgent and almost always overdue. The platform still works, the maintenance renewal still gets signed, and the correlation content still runs, which is precisely the problem: it has been running unexamined for years on a product whose ownership has changed hands repeatedly and whose architecture predates every assumption modern log platforms make. Graylog is a common destination not because it matches ESM feature for feature, but because it removes the two things that make ArcSight expensive to keep: the SmartConnector estate and the maintenance line item.

This migration is unusual in one respect. The hardest work is not technical. It is archaeology.

The content audit is the project

Start by pulling twelve months of correlated event history out of ESM and ranking rules by how many alerts a human actually dispositioned from them.

In a long-lived ArcSight estate the result is stark. A modest set of rules carries the entire detection programme. A larger set fires constantly and is ignored by convention rather than disabled. And a substantial tail has not fired in years, often because the log source behind it was decommissioned and nobody noticed, since a rule that never fires looks identical to a rule that is working perfectly.

That ranking is your migration scope, and it is also, quietly, a security improvement. Carrying unexamined content forward is how organisations end up with a new platform that inherits the old platform’s reputation for noise. Every rule you consciously retire should be written down as a decision with an owner and a date, so that when an auditor asks why a control disappeared you have an answer rather than a shrug.

Do the same for log sources. A SmartConnector consuming operational effort to feed a rule that no longer exists is pure cost.

The mapping

• SmartConnectors → Graylog inputs (Syslog TCP/UDP, Beats, GELF, HTTP), or CEF-over-syslog as a transitional bridge.
• CEF normalization → Graylog’s CEF parsing, then pipeline rules for the fields you actually query.
• The ArcSight event schema → Graylog message fields, which are yours to name rather than prescribed.
• ESM correlation rules → Graylog event definitions, with aggregation and thresholds.
• Filters and data monitors → streams and dashboards.
• Active lists → lookup tables.
• Session lists → an external state store queried via a lookup adapter, or a restructured detection.
• Trends and reports → Graylog dashboards and scheduled searches.
• Logger long-term storage → Graylog archiving to object storage.
• ESM cases → an external case platform (TheHive or your existing ticketing).

Use CEF as a bridge, then dismantle the connector tier

The sequencing trick that makes this migration low-risk is that Graylog can parse CEF. Most SmartConnectors already emit CEF over syslog to ESM, and a syslog destination is a configuration change on the connector, not a change on the source device.

So the first real milestone is cheap: add Graylog as a second syslog destination on a handful of connectors and start receiving genuine production data within days. You get real events to write pipeline rules against, real volumes to size against, and a running comparison with ESM, all without touching a firewall or a domain controller.

Then dismantle the connector tier deliberately, source by source, replacing each connector with native collection into Graylog. Some sources will move easily, because they were speaking syslog all along and the connector was only ever a normalizer. Others, particularly API-based and Windows event collection, need a real replacement such as Beats or the Graylog Sidecar. Sequence by effort, retire connectors as you go, and let the operational burden fall visibly, because that reduction is a large part of the case for the project.

Rebuilding detections without rebuilding the complexity

ArcSight rewards complex correlation, and estates accumulate it. Graylog rewards a different shape: enrich heavily at ingest in pipeline rules, then keep the detection condition simple.

Reworking content in that shape is usually a simplification rather than a compromise. A rule that correlated three event types by joining on user and asset in ESM often becomes, in Graylog, a pipeline that attaches user context and asset criticality to every event as it arrives, plus an event definition with a straightforward condition. The logic did not get weaker; it moved earlier.

Where that does not work is genuine multi-stage, stateful correlation across long windows. Identify those rules early, be honest about whether Graylog Open covers them, and choose deliberately between restructuring, external state, Graylog’s paid security tier, or accepting that one specific detection is not coming with you.

Order of operations

1. Rank ESM rules by real firing and disposition history, and record retirement decisions for the rest.
2. Inventory SmartConnectors against surviving log sources and mark each for native replacement or retirement.
3. Stand up Graylog with retention and archiving policies configured before the first message arrives.
4. Bridge with CEF: dual-destination a few connectors and validate parsing, volume, and search against live data.
5. Replace connectors with native collection, source by source, retiring each connector as its replacement proves out.
6. Build pipeline enrichment first, detections second, so conditions stay simple.
7. Convert active lists to lookup tables, and resolve session-list dependencies explicitly.
8. Parallel-run with both platforms alerting, comparing daily, for a full quarter.
9. Retire ESM after the maintenance renewal date you have been working backwards from, not before the parallel run completes.

Clearing the bar before you cut over

Every surviving detection fires correctly on replayed production events. Every retired detection has a documented retirement decision. All remaining log sources collect natively, with no SmartConnector in the path. Lookup tables are populated and refreshed automatically. Retention and archiving satisfy the written obligation. Analysts have worked real alerts out of the new workflow while ESM was still authoritative. And the connector estate is genuinely gone, because leaving half of it running is how the operational saving evaporates.

The short version

ArcSight to Graylog is a content-archaeology project wearing a migration’s clothes. The technical path is well-trodden: CEF gives you a safe bridge, connectors give way to native inputs, active lists become lookup tables, and pipeline enrichment replaces query-time correlation. The risk is not the technology, it is migrating a decade of unexamined rules and inheriting their noise. Rank by what actually fires, retire the rest on purpose, treat the calculator’s per-endpoint figures above as illustrative, and count the removal of the connector tier as a real and permanent operational saving.