Channel Brief

For HP and Partner Internal Use.

Partner Guide to licensing HP

ArcSight products
This document was created to provide guidelines on how to license HP ArcSight products and
answer some of the most common questions. The status of the information is effective
November 2013 and may be subject to change in the future.
HP ArcSight Logger
HP ArcSight Logger is shipped in two form factors, appliance and software. Both platforms are licensed very similar:

Appliance

Software

Comment

Events Per Second

GB per day

GB per day is based on the incoming raw events on the connector level. So the GB
per day number can be mapped back to EPS.

Number of Devices

Number of Devices

All devices which are sending events are counted, even if they are routed via a
concentrator like a central syslog server or a management product.

Capacity

Capacity

While appliances have a built in capacity, software capacity is limited by license

restrictions. This is for online storage only. Archives are separate and not limited.

For all HP ArcSight Logger versions unlimited user accounts are included and all connectors as software available on
the day of purchase.
The following models are available as a production version, non-production version (NP) for testing and staging, and a
high availability version (HA). The table shows the corresponding appliance and software versions.

Appliance

EPS

Software

GB per day

Devices

Storage

FREE L750MB

750MB

10

500GB

L5GB

50

2.5TB

L3500

2,000

L30GB

30

200

8TB

L7500s

5,000

L80GB

80

500

42TB

L7500-SAN

75,000

Unlimited

50TB

L7500x

100,000

L160GB

160

Unlimited

42TB

L250GB

250

Unlimited

42TB

Frequently asked questions:

Q: How can I upgrade from one software model to another?
A: Via a license upgrade. The SKU for the upgrade is available.
Q: How can I upgrade from one appliance model to another?
A: An upgrade from L7500s to L7500x is available as the hardware is identical. For all other models no upgrade is
available.
Q. How is the license enforced?
A: For both models the capacity is enforced. For the software model also the volume per day. If the system is not
compliant more than 5 days in a 30 days rolling window, access to the search and the report interface will be limited
until the system is compliant again.

For HP and Partner Internal Use.

Q: Do I need an HP ArcSight Connector Appliance or ArcSight Management Console?

A: No, the connector can also be a software connector sending events to HP ArcSight Logger. But the connector
management interface of the connector appliance and ArcMC is an advantage when dealing with a lot of connectors.
Q: Can I add more devices to a certain model?
A: Yes, more devices can be added.
Q: The L3500 comes with connector management abilities and 4 connectors on board. Is the true for other models
too?
A: No, only the L3500 is available with connector management for up to 20 remote connectors and 4 onboard
connectors.

HP ArcSight Express

HP ArcSight Express is shipped as an appliance only. The licensing of HP ArcSight Express is the following:

Model

AE-7506

AE-7511

AE-7526

AE-7551

AE-7566

AE-7581

Peak EPS*

500

1,000

2,500

5,000

10,000

15,000

Sustained EPS

250

500

1,250

2,500

5,000

7,500

Total Devices

750

750

750

750

1,500

1,500

Events per Day

21,6 M

43,2 M

108 M

216 M

432 M

648 M

Total Assets

5,000

5,000

10,000

10,000

25,000

25,000

*Peak EPS: This number is informative only and based on twice the sustained number. Short peaks can be much higher.

HP ArcSight Express comes with the following specifications:

-

1 ArcSight Console included. Additional licenses can be ordered

25 Web Users.

Identity View for 50 Users. Additional licenses can be order to a maximum of 2,500

ConnApp 4 with 4 on board connectors and 4 remote connectors

All connectors as software available on the day of purchase

HP ArcSight Express is available as a production version, non-production version (NP) for testing and staging, and a
high availability version (HA). For demo and trial purposes, a not for resell (NFR) version is available too.

Frequently asked questions:

Q: How can I upgrade from one model to another?
A: There are no model to model upgrade SKUs, however as the hardware is the same, upgrade is based on capacity
which means additional blocks off 500 EPS sustained can be added. Also additional users and devices can be added.
Q: How is the license enforced?
A: HP ArcSight Express enforces events per day which are based on sustained EPS, so if a customer buys AE 7506 they
can process sustained 250EPS or 21,6M EPD (250*60*60*24). Peak EPS can be much higher if there are times where the
EPS are lower than 250EPS and the overall EPD are the same or below the maximum. If the system is not compliant
with the license some functionality will be disabled, however, no events will be dropped. Depending on the number of
violations this can be up to 5 hours every day always at the start time of the manager. In addition, the number of
consoles, actors in IdView, and the number of assets in the asset database will be audited but only notified on in case of
a license violation.
Share with colleagues

Rate this document

Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP
products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as
constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Trademark acknowledgments, if needed.

For HP and Partner Internal Use.

Q: Can I add more devices to a certain model?

A: Yes, customers can add network/server/security devices or desktop SKUs to any HP ArcSight Express model as long
as the total deployment does not exceed 2500 network/ server devices.
Q: Can I upgrade to HP ArcSight ESM?
A: No, an upgrade is not available at the moment.
Q: How does the licensing of the console work?
A: The console is licensed by named user. HP ArcSight Express comes with a license for the admin user; additional user
licenses can be acquired.

HP ArcSight Reputation Security Monitor

HP ArcSight RepSM is an add on for HP ArcSight Express and HP ArcSight ESM. The pricing for HP ArcSight Express is
based on the price of the monitoring components such as Appliances, EPS upgrades, and Monitored devices but not on
options like console and compliance packages. Please ask your HP ESP Partner Business Manager or Sales
Representative for a quote when your customer is interested. HP ArcSight Express comes with a 30 day trial version of
HP ArcSight RepSM.

HP ArcSight Connector Appliance

HP ArcSight Connector Appliance is shipped as an appliance or software. The appliance combines a connector
management interface and the ability to run a certain number of HP ArcSight Connectors up to a certain number of EPS
on one appliance. The following models are available:

Model

C3500

C5500

Note

EPS

2,500

5,000

Performance varies depending on

the type of Connector running on
the appliance.

Onboard Connectors

16

32

Default maximum. Performance

depends on the type of Connector
deployed.

Remote Connector Management

Up to 50

Up to 150

Default licensed maximum.

Default Total Connector Management

66

182

License enforced total. Supporting

Add-on (less than 1000 per
appliance) Connector license.
Actual performance varies
depending on the resources usage
of the appliance.

The software version has the ability to manage connectors but doesn't include connector installation itself. These can
be installed separately on the same hardware. The software is available in the following versions:

Model

ConnApp 4

ConnApp 50

ConnApp 150

Remote Connector Management

50

150

Additional licenses can be bought to manage more Connectors. Actual performance varies depending on the server
resources usage.

Share with colleagues

Rate this document

Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP
products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as
constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Trademark acknowledgments, if needed.

For HP and Partner Internal Use.

For all HP ArcSight Connector Appliance versions unlimited user accounts are included and all connectors available on
the day of purchase can be used.

Frequently asked questions:

Q: How can I upgrade from one hardware model to another?
A: No, upgrades between the models are not possible.
Q: How is the license enforced?
A: By number of managed connectors in the license file.

HP ArcSight Management Center (ArcMC)

HP ArcSight Management Center 1.0 is shipped as software only. The license includes 2 portions:
1. Number of Connectors to be managed by ArcMC running either as software Connector or onboard Connector
running on HP ArcSight Connector Appliances (hardware form factor)
2. Number of Products (software and hardware form factors of Connector Appliances and Logger) to be managed

Model

ArcMC 70/5

ArcMC 200/15

ArcMC 300/30

ArcMC 400/45

ArcMC 500/60

Managed Connectors

70

200

300

400

500

Managed Products

15

30

45

60

Q: How can I upgrade from one model to another?

A: Upgrades from a lower tier server to a higher tier server is possible by the add-on of Connectors and/or add-on of
Products.
Q: How is the license enforced?
A: The license will be created for a specific ArcMC server IP address the customer provides as well as the number of
connectors and products in the license file.
Q: What is the difference between ArcMC and ConnApp?
A: ArcMC 1.0 can manage Connectors that ConnApp can only manage today. ArcMC 1.0 can also manage both form
factors (software and appliance) of ConApp and Logger that ConApp cannot manage. . Hardware form factor of
Connector Appliance can host onboard Connector while ArcMC 1.0, a software offering, does not support onboard
Connector.
Q: How many Connectors and Products can ArcMC support?
A: ArcMC 1.0 can support up to 1000 Connectors if no other Products are managed by the same server. If both
Connectors and Products are to be managed by ArcMC, no more than 500 "Nodes" (combination of Connectors and
Products) can be managed by ArcMC 1.0.
Q: Do I still need ConnApp?
A: If you have ConApp today to manage Connectors and you do not have the need to manage Logger and ConApp, you
can keep your ConApp. ArcMC 1.0 is designed to help you better manage the overall HP ArcSight deployment that
includes Connector, ConApp, and/or Logger. Also ArcMC doesn't have onboard connectors as Connector Appliance.
If you are looking for a hardware solution, yes. If the customer only has HP ArcSight Express, ConnApp is included. If the
customer just starts with the project, the scope is relatively small, and doesn't require an appliance, no.

HP ArcSight ESM
For HP ArcSight ESM please contact your HP ESP sales representative or HP ESP Partner Business Manager.
Share with colleagues

Rate this document

Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP
products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as
constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Trademark acknowledgments, if needed.