Security Flag Detected

ArcSight Threat Intelligence Delisting Service: We Get Your Domain Removed

ArcSight Threat Intelligence flagged your domain. We handle removal.

Do it yourself: step-by-step guide
Response time: No published SLA; typically 3-10 business days
Difficulty: Moderate
No cure, no pay

About the vendor

What is ArcSight Threat Intelligence?

ArcSight Threat Intelligence is a data feed provided by OpenText (formerly Micro Focus) that integrates directly into ArcSight ESM, one of the world's most widely deployed enterprise SIEM platforms. Large enterprises, government agencies, and financial institutions use ArcSight to monitor their entire security posture. When your domain appears in the ArcSight Threat Intelligence feed, it generates automated SIEM correlation rules and alerts inside every organization running ArcSight.

ArcSight ESM is the SIEM of choice for many of the world's largest organizations, including major banks, government agencies, and Fortune 500 companies. A flag in ArcSight Threat Intelligence means your domain is triggering automated security alerts inside these institutions, often leading to firewall blocks and supplier-risk escalations.

Common causes

Why was your site flagged?

  • Your domain was included in a threat intelligence report consumed by ArcSight feeds
  • An IP associated with your domain appeared in a SIEM correlation rule trigger
  • Your domain was correlated with a known threat actor TTPs (tactics, techniques, procedures)
  • A historical phishing or malware incident was linked to your domain in public threat reports
  • Your hosting infrastructure shares threat intelligence signals with flagged entities

From our own case data

ArcSight Threat Intelligence in our monitoring and cases

Flagged in the last 90 days
0monitored domains newly listed by ArcSight Threat Intelligence

Not enough data yet for median days to removal, removal success rate, most common reason and last delisting date.

We have not handled a ArcSight Threat Intelligence removal case yet. We only show a removal figure once we have at least 5 cases.

Removal at a glance

How ArcSight Threat Intelligence handles removal requests

Submission method
ArcSight Threat Intelligence does not list a public request form. The steps below explain how to reach them.
Account needed
No account is needed to file the request.
ArcSight Threat Intelligence response time
No published SLA; typically 3-10 business days
Where to check the verdict
No public lookup page is listed. Check your domain with our free blacklist checker instead.

Last updated

Complete removal guide

How to remove your domain from ArcSight Threat Intelligence

Expected time: No published SLA; typically 3-10 business daysDifficulty: ModerateAccount required: No
1

Confirm the ArcSight Threat Intelligence detection

This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step

2

Clean the site and prepare evidence

This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step

3

Email ArcSight Threat Intelligence

Email virustotalsupport@opentext.com. Subject: "False positive: example[.]com" plus your reference. Plain text, no links or attachments, domains defanged. Give the URL(s), VirusTotal label, what the site does, why the verdict is wrong and what you fixed.

4

Follow up if there is no response

This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step

5

Verify on VirusTotal before closing

This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step

The evidence checklist, follow-up routine and checks after removal are the same for every vendor. We keep them in one place so this page can focus on what is specific to ArcSight Threat Intelligence.

Read the VirusTotal false positive guide

FAQ

Questions about ArcSight Threat Intelligence delisting

How our ArcSight Threat Intelligence removal service works

We check that your site is clean, send ArcSight Threat Intelligence the evidence it needs through its official channel and follow up until the flag is gone. You only pay once the removal is confirmed, and the full process for 90+ vendors is explained on our website blacklist removal page.

Read how website blacklist removal works

Related guides

Picked for the same vendors and the same kind of problem.

Part of: Website blacklist removal

Ask AI

Get a summary from your AI assistant

Open this page in your favourite AI assistant with a ready-made question, and ask follow-ups about your own domain.