The real problem is that there seemingly isn't a great FOSS alternative for ArcSight. Whatever it does couldn't really be that extraordinary.