Home › Articles › ArcSight Marketplace content and license scope
ArcSight & Security · Track 03

ArcSight Marketplace content and license scope

By ·

Downloadable content extends what a SIEM can do, but it does not extend what you have licensed unless the agreement says so. ArcSight Marketplace content and license scope become an audit question when installed packages, use cases, and add on content are treated as separately licensable items, inflating a finding for material that the platform license may already cover.

ArcSight reached the OpenText estate through the Micro Focus acquisition that closed on January 31, 2023, and is governed by the Additional License Authorizations rather than the OpenText EULA. The platform draws on a library of content, packages, connectors, dashboards, use cases, and detection logic, that teams install to operationalise the product. The defensive question is whether that content is part of what the platform license covers, or whether any piece of it carries a separate entitlement. The answer is in the authorization and the agreement, not in a list of everything that happens to be installed.

Installed content is not automatically a separate license

A security team installs content to make the platform useful. Most of it is configuration and detection logic that operates within the licensed product, not a separate product with its own meter. An audit that lists every installed package and treats each as a chargeable item is counting activity inside the platform as though it were a series of distinct licenses. The corrective is to distinguish content that runs within the platform entitlement from any component the agreement genuinely licenses separately, and to hold the finding to the latter only.

The mechanic

Installing content is how a SIEM is operated, not how it is relicensed. A finding that prices every installed package as a separate entitlement counts the use of the platform rather than the scope of what the agreement actually licenses apart from it.

Where the content scope finding overreaches

The overreach in a content scope finding tends to appear in a few places, each of which is a question about what the agreement licenses rather than what is installed.

Reconstruct against what the agreement licenses

The four Rs apply directly. Respond inside the seven day notice window and route every inventory request through a single controlled channel so the installed content is described once. Reconstruct the effective position by reading the authorization and the agreement to establish what the platform license covers and what, if anything, carries a separate entitlement, then map installed content to that distinction. Rebut the finding line by line, removing content that runs within the platform entitlement and content that was never in production use. Resolve on terms that fix the content scope so the next measurement does not relitigate what the platform license already covers.

A recent engagement

In a recent engagement an ArcSight finding had listed installed Marketplace content and priced several packages as separate entitlements, including bundled use cases and superseded material left installed after newer versions replaced them. Reading the agreement to establish what the platform license covered and mapping the installed content to that scope corrected the finding without inventing any new facts about the deployment. The discipline mirrors the way decommissioned connectors are removed from a count: what is installed is not the same as what is separately licensed or in production use.

Read the scope before accepting the inventory

With Marketplace content more than most topics, an inventory of installed packages looks like a list of entitlements until the agreement is read against it. The defensive discipline is to insist that the finding distinguish content covered by the platform license from any component the agreement licenses separately, to remove trial, superseded, and never deployed material, and to hold the charge to what the agreement actually scopes apart from the platform. Most of the reduction in a content scope matter comes from establishing that the audit counted the operation of the platform rather than the entitlements the agreement defines.

Charged for installed ArcSight Marketplace content?

We read the agreement for what the platform license covers, separate it from anything licensed apart, and reprice the finding against the real content scope. To get a defense team on the file, open a case or download the ArcSight EPS defense briefing.

Get The Number Down →

Related field notes

These notes from the ArcSight and Security audit defense cluster cover scope, connectors, and entitlement reconciliation. Each links back to the complete OpenText audit defense playbook for 2026.

If an OpenText or Micro Focus audit notice has landed, the first seven days carry more weight than any week that follows. OpenText Audit Defense is an independent, buyer side practice founded in 2020 by former vendor compliance leadership. We have defended more than 200 audits, brought the average finding down by 68 percent, and mitigated more than $90M in claims against vendor positions. We do not resell OpenText software and we are not affiliated with OpenText Corporation. To open a case, use the contact form on this site.