Arcsight руководство администратора

About the connector

ArcSight Enterprise Security Manager (ESM) is a threat detection, analysis, triage, and compliance management SIEM platform.

This document provides information about the Micro Focus ArcSight connector, which facilitates automated interactions, with an ArcSight ESM server using FortiSOAR™ playbooks. Add the Micro Focus ArcSight connector as a step in FortiSOAR™ playbooks and perform automated operations, such as annotating events, running a report based on a report ID, and uploading an ArcSight report file as an attachment in FortiSOAR™.

You can configure ArcSight ESM and FortiSOAR™ so that FortiSOAR™ ingests correlated events from ArcSight ESM and converts them into an alert in FortiSOAR™. For more information, see the ArcSight ESM and FortiSOAR™ integration section.

Version information

Connector Version: 3.0.0

FortiSOAR™ Version Tested on: 6.4.1-2133

Micro Focus ArcSight Version Tested on: 7.0

Authored By: Fortinet

Certified: Yes

Release Notes for version 3.0.0

Following enhancements have been made to the Micro Focus ArcSight connector in version 3.0.0:

• Added the «Delete Active List Entries» operation and playbook.
• Updated the «Get Active List Entries» operation by making the ‘Active List ID’ parameter optional.
• Removed the ‘Do Not Fail Connector Function On API Error’ parameter from the connector’s «Configuration» page.
• Enhanced the data ingestion playbooks.
• Updated the «Configuration Parameters» by moving the «Active List ID» configuration parameter out of the Enable Pull ArcSight Events Service onchange parameters. 

Installing the connector

From version 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the yum command to install connectors. Connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and run the yum command as a root user to install connectors:

yum install cyops-connector-arcsight

Important: Upgrading the connector from 2.x to 3.x is not backward compatible because explicit changes are needed in the existing playbooks to delete the ‘Active List Entries» after Alerts are created in FortiSOAR™.

Prerequisites to configuring the connector

• You must have the IP Address or FQDN of ArcSight ESM server and credentials to access the server.
• To access the FortiSOAR™ UI, ensure that port 443 is open through the firewall for the FortiSOAR™ instance.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Micro Focus ArcSight connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details: 

Parameter	Description
Server URL	IP Address or FQDN of the ArcSight ESM server to which you will connect and perform automated operations.
ESM Port	REST API port of the ArcSight ESM server. Defaults to 8443.
Username	Username to access the ArcSight ESM server.
Password	Password to access the ArcSight ESM server.
Active List ID	Resource ID of the Active List for which you want to retrieve events from ArcSight ESM.
Verify SSL	Specifies whether the SSL certificate for the server is to be verified or not. By default, this option is set as True.
Enable Pull ArcSight Events Service	If you select this option, i.e., set this option as True (default), then ArcSight events will be pulled. If you select this option, then you must specify the following parameters: Playbook Trigger: The string used to trigger the playbook. Note: The playbook authentication method should be set as HMAC. Reader Port: Port used for communication between FortiSOAR™ and the ArcSight Active List Reader. 10012 is the default port number. You can specify any unused port number if the default port is unavailable. You can also use a similar port number for multiple ArcSight connector configurations as the ArcSight Active List Reader process is capable of communicating with multiple ArcSight servers. Poll Interval: Poll Interval, in seconds, that determines how frequently the ArcSight Active List Reader polls the active list for event IDs. Note: 300 seconds is the default poll interval. Important: To run the Enable Pull ArcSight Events Service, you can import the FortiSOAR_ArcSight.arb in ArcSight. Steps to import the FortiSOAR_ArcSight.arb in ArcSight, is mentioned in the «Importing the FortiSOAR_ArcSight.arb package in ArcSight» section. Also, ensure that the playbook whose trigger you have specified in the Playbook Trigger parameter is in the Active state. This ensures that you experience seamless event reading from ArcSight ESM.

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from version 4.10.0 onwards:

Function	Description	Annotation and Category
Annotate Event	Updates an ArcSight Event Stage, assigns it to a user and adds a comment.	annotate_event Investigation
Get Event Details	Retrieves information for events from the ArcSight ESM server, based on event IDs and other input parameters you have specified.	get_event_info Investigation
Run Report with Default Parameters	Runs a report based on an ID or URI and default inputs on the ArcSight ESM server.	run_report Investigation
Run Report	Runs a report based on an ID and custom user inputs on the ArcSight ESM server.	run_report Investigation
Delete Report	Deletes an archived report from the ArcSight ESM server, based on the Resource ID you have specified.	delete_report Remediation
Create Case	Creates a case in ArcSight ESM, based on the input parameters you have specified.	create_case Investigation
Update Case	Updates an existing case in ArcSight ESM, based on the input parameters you have specified.	update_case_info Investigation
Get Case Information	Retrieves information about a case from ArcSight ESM, based on the case ID you have specified.	get_case_info Investigation
Add Events to Case	Adds the specified events to an existing case in ArcSight ESM, based on the case ID you have specified.	add_events Investigation
Delete Case Events	Deletes the specified events from an existing case from ArcSight ESM, based on the case ID you have specified.	delete_events Remediation
Search Query	Searches ArcSight ESM records based on the query you have specified.	search_query Investigation
Download Report	Downloads a report based on an ID from ArcSight ESM and then upload that report as an attachment in the Attachment Module.	upload_report Investigation
Get Active List Information	Retrieves information about an active list from ArcSight ESM, based on the Active List ID you have specified.	get_active_list_info Investigation
Update Active List	Adds new items to a specified active list on ArcSight ESM, based on the Active List ID and other input parameters you have specified.	update_active_list Investigation
Get Active List Entries	Retrieves entries for a specified active list, based on the Active List ID you have specified.	get_active_list_entries Investigation
Clear Active List Entries	Clear entries for a specified active list, based on the Active List ID you have specified.	clear_active_list_entries Remediation
Delete Active List Entries	Deletes entries from a specified active list in ArcSight ESM, based on the Active List ID and other input parameters you have specified.	delete_active_list_entries Investigation
Get Fields	Retrieves details of all fields from ArcSight ESM.	get_fields Investigation
Get Query Viewer Data	Retrieves data of a specific query viewer from ArcSight ESM, based on the Query Viewer ID you have specified.	get_query_viewer_data Investigation

operation: Annotate Event

You can annotate ArcSight Events using the ArcSight Console to update the Stage and Assignee of the event and to add comments to the event.

You can also perform similar operations using the Annotate Event function in FortiSOAR™ playbooks.

Input parameters

Parameter	Description
Event ID	The ID of the ArcSight Event that you want to annotate.
Stage	The Stage to be set for the Event. You can choose from one of the following values: Queued/Initial/Monitoring/Rule Created/Follow-Up/Final/Flagged as Similar/Closed
User	An existing ArcSight user to whom you want to assign the event. For example, admin.
Comment	The comment that you want to add to the event.

Output

The JSON output returns a Success message if the ArcSight ESM event is annotated successful or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Get Event Details

Input parameters

Parameter	Description
Event IDs	IDs of ArcSight Events whose details you want to retrieve from ArcSight. You can add multiple IDs using the CSV or list format.
Replace Null Values with Empty String?	If an event field is not set, the ArcSight APIs return the following values. Use this option to replace these values with an empty string. Note that, by default, the Replace Null Values with Empty String? field is set to True. Field Type integer: Returned value in place of NULL: -2147483648 (Integer.MIN_VALUE) Field Type long: Returned value in place of NULL: -9223372036854775808 (Long.MIN_VALUE) Field Type double: Returned value in place of NULL: 5e-324 (Double.MIN_VALUE
IP Address Keys to Parse	(Optional) ArcSight API returns the IP address fields in decimal format. Provide a comma-separated list of field names you want to convert from decimal to IP address format. Defaults to address.
MAC Address Keys to Parse	(Optional) ArcSight API returns the MAC address fields in decimal format. Provide a comma-separated list of field names you want to convert from decimal to MAC address format. Defaults to macAddress,translatedAddress.
Fields Name	(Optional) Specify field names if you want to retrieve a specific set of columns from Micro Focus ArcSight.
Time Field Names	(Optional) Specify a comma-separated list or array of field names for which you want to perform time conversion in the output of this operation.
Date Time Format	(Optional) Specify the DateTime format for converting the time fields. You must specify a DateTime format that is supported by the arrow library. For more information on the arrow library, see https://arrow.readthedocs.io/en/latest/

Output

The JSON output contains the details of the event, based on the specified event ID and other input parameters, retrieved from ArcSight ESM.

The output contains the following populated JSON schema:
{
     "endTime": "",
     "ttl": "",
     "severity": "",
     "locality": "",
     "domainFp5": "",
     "domainFp2": "",
     "domainNumber3": "",
     "name": "",
     "domainFp6": "",
     "domainFp1": "",
     "deviceCustomFloatingPoint2": "",
     "deviceCustomString2": "",
     "domainDate6": "",
     "originalAgent": {
         "name": "",
         "assetName": "",
         "address": "",
         "translatedAddress": "",
         "assetId": "",
         "version": "",
         "type": "",
         "addressAsBytes": "",
         "macAddress": "",
         "mutable": "",
         "hostName": "",
         "zone": {
             "referenceID": "",
             "managerID": "",
             "uri": "",
             "isModifiable": "",
             "referenceString": "",
             "referenceType": "",
             "referenceName": "",
             "id": ""
         },
         "assetLocalId": "",
         "id": ""
     },
     "domainNumber8": "",
     "domainNumber6": "",
     "deviceCustomFloatingPoint4": "",
     "type": "",
     "startTime": "",
     "domainIpv4addr1": "",
     "destination": {
         "translatedPort": "",
         "assetName": "",
         "address": "",
         "translatedAddress": "",
         "geo": {
             "mutable": "",
             "longitude": "",
             "latitudeLong": "",
             "longitudeLong": "",
             "latitude": ""
         },
         "assetId": "",
         "processId": "",
         "addressAsBytes": "",
         "port": "",
         "mutable": "",
         "hostName": "",
         "zone": {
             "referenceID": "",
             "managerID": "",
             "uri": "",
             "isModifiable": "",
             "referenceString": "",
             "referenceType": "",
             "referenceName": "",
             "id": ""
         },
         "assetLocalId": "",
         "macAddress": ""
     },
     "domainIpv4addr3": "",
     "domainNumber5": "",
     "domainFp8": "",
     "domainFp4": "",
     "deviceEventClassId": "",
     "agentReceiptTime": "",
     "persistence": "",
     "managerId": "",
     "deviceSeverity": "",
     "deviceCustomFloatingPoint3": "",
     "deviceCustomString1": "",
     "flexNumber1": "",
     "domainDate1": "",
     "domainNumber12": "",
     "deviceReceiptTime": "",
     "deviceEventCategory": "",
     "category": {
         "outcome": "",
         "object": "",
         "mutable": "",
         "significance": "",
         "behavior": "",
         "deviceGroup": ""
     },
     "deviceCustom": {
         "mutable": "",
         "number1Label": "",
         "string1Label": "",
         "string2Label": ""
     },
     "domainIpv4addr2": "",
     "deviceCustomDate2": "",
     "modelConfidence": "",
     "correlatedEventCount": "",
     "deviceCustomDate1": "",
     "managerReceiptTime": "",
     "baseEventCount": "",
     "domainNumber13": "",
     "aggregatedEventCount": "",
     "deviceCustomFloatingPoint1": "",
     "domainDate3": "",
     "domainFp7": "",
     "deviceCustomNumber3": "",
     "assetCriticality": "",
     "deviceDirection": "",
     "domainIpv4addr4": "",
     "agentSeverity": "",
     "eventAnnotation": {
         "endTime": "",
         "stage": {
             "referenceID": "",
             "managerID": "",
             "uri": "",
             "isModifiable": "",
             "referenceString": "",
             "referenceType": "",
             "referenceName": "",
             "id": ""
         },
         "version": "",
         "modificationTime": "",
         "eventId": "",
         "managerReceiptTime": "",
         "flags": "",
         "auditTrail": "",
         "stageUpdateTime": ""
     },
     "agent": {
         "name": "",
         "assetName": "",
         "address": "",
         "translatedAddress": "",
         "assetId": "",
         "version": "",
         "type": "",
         "addressAsBytes": "",
         "macAddress": "",
         "mutable": "",
         "hostName": "",
         "zone": {
             "referenceID": "",
             "managerID": "",
             "uri": "",
             "isModifiable": "",
             "referenceString": "",
             "referenceType": "",
             "referenceName": "",
             "id": ""
         },
         "assetLocalId": "",
         "id": ""
     },
     "domainDate5": "",
     "deviceProcessId": "",
     "relevance": "",
     "finalDevice": {
         "product": "",
         "assetName": "",
         "address": "",
         "translatedAddress": "",
         "assetId": "",
         "version": "",
         "addressAsBytes": "",
         "vendor": "",
         "mutable": "",
         "hostName": "",
         "zone": {
             "referenceID": "",
             "managerID": "",
             "uri": "",
             "isModifiable": "",
             "referenceString": "",
             "referenceType": "",
             "referenceName": "",
             "id": ""
         },
         "assetLocalId": "",
         "macAddress": ""
     },
     "domainNumber11": "",
     "sessionId": "",
     "deviceCustomNumber2": "",
     "flexDate1": "",
     "bytesIn": "",
     "concentratorDevices": {
         "product": "",
         "assetName": "",
         "address": "",
         "translatedAddress": "",
         "assetId": "",
         "version": "",
         "addressAsBytes": "",
         "vendor": "",
         "mutable": "",
         "hostName": "",
         "zone": {
             "referenceID": "",
             "managerID": "",
             "uri": "",
             "isModifiable": "",
             "referenceString": "",
             "referenceType": "",
             "referenceName": "",
             "id": ""
         },
         "assetLocalId": "",
         "macAddress": ""
     },
     "domainDate2": "",
     "deviceCustomNumber1": "",
     "device": {
         "product": "",
         "assetName": "",
         "address": "",
         "translatedAddress": "",
         "assetId": "",
         "version": "",
         "addressAsBytes": "",
         "vendor": "",
         "mutable": "",
         "hostName": "",
         "zone": {
             "referenceID": "",
             "managerID": "",
             "uri": "",
             "isModifiable": "",
             "referenceString": "",
             "referenceType": "",
             "referenceName": "",
             "id": ""
         },
         "assetLocalId": "",
         "macAddress": ""
     },
     "originator": "",
     "domainNumber9": "",
     "domainNumber1": "",
     "priority": "",
     "domainDate4": "",
     "flexNumber2": "",
     "domainNumber7": "",
     "eventId": "",
     "domainFp3": "",
     "domainNumber2": "",
     "domainNumber4": "",
     "concentratorAgents": {
         "name": "",
         "assetName": "",
         "address": "",
         "translatedAddress": "",
         "assetId": "",
         "version": "",
         "type": "",
         "addressAsBytes": "",
         "macAddress": "",
         "mutable": "",
         "hostName": "",
         "zone": {
             "referenceID": "",
             "managerID": "",
             "uri": "",
             "isModifiable": "",
             "referenceString": "",
             "referenceType": "",
             "referenceName": "",
             "id": ""
         },
         "assetLocalId": "",
         "id": ""
     },
     "bytesOut": "",
     "domainNumber10": ""
}

operation: Run Report with Default Parameters

You can get the ID for a report (Resource ID) from the ArcSight Console, as shown in the following image:

You can get the URI for a report from the ArcSight Console. To get the URI, you must add the report name to the parent resource, as shown in the following image:

Input parameters

Parameter	Description
Run Report By	Parameter of the report based on which you want to run a report on ArcSight ESM. You can choose between Report ID or Report URI.
Report URI or Report ID	ID or URI of the ArcSight report that you want to run on ArcSight ESM.

Output

The JSON output returns the Download ID of the report. You can use this Download ID to download the report subsequently when the report is ready. You can use the «Download Report» operation to download the report and add it as an attachment in FortiSOAR™.

The output contains a non-dictionary value.

operation: Run Report

Input parameters

Parameter	Description
Report Id	ID of the ArcSight report that you want to run.
Input parameters	Input parameters in the JSON format. For example, {'StartTime': '$Now - 3h', 'Report Format': '0'}. The keys are the same as seen on the ArcSight console. Note that the values for the drop-down fields are their integer positions. For example, the Report Format should be specified as 0, 1, 2, etc., and not as pdf, csv, html, etc.

Output

The JSON output returns the Download ID of the report. You can use this Download ID to download the report subsequently when the report is ready. You can use the «Download Report» operation to download the report and add it as an attachment to FortiSOAR™.

The output contains a non-dictionary value.

operation: Delete Report

Input parameters

Parameter	Description
Report ID	ID of the archived ArcSight report that you want to delete from ArcSight ESM.

Output

The JSON output returns a Success message if the specified report is deleted from ArcSight ESM, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Create Case

Input parameters

Parameter	Description
Parent Group ID	Parent Group ID of the case you want to create.
Case Name	Name of the case that you want to create.
Alias (Display Name)	(Optional) Alias or Display Name of the case that you want to create.
Ticket Type	(Optional) Ticket type of the case you want to create. You can choose from the following options: INTERNAL, CLIENT, or INCIDENT.
Stage	(Optional) Stage that you want to assign to the created case. You can choose from the following options: QUEUED, INITIAL, FOLLOW_UP, FINAL, or CLOSED.
Frequency	(Optional) Frequency that you want to assign to the created case. You can choose from the following options: TEN_TO_FIFTEEN, NEVER_OR_ONCE, FIFTEEN, LESS_THAN_TEN, or MORE_THAN_FIFTEEN.
Operational Impact	(Optional) Operational Impact that you want to assign to the created case. You can choose from the following options: NO_IMPACT, NO_IMMEDIATE_IMPACT, LOW_PRIORITY_IMPACT, HIGH_PRIORITY_IMPACT, or IMMEDIATE_IMPACT.
Security Classification	(Optional) Security Classification that you want to assign to the created case. You can choose from the following options: UNCLASSIFIED, CONFIDENTIAL, SECRET, or TOP_SECRET.
Consequence Severity	(Optional) Consequence Severity that you want to assign to the created case. You can choose from the following options: NONE, INSIGNIFICANT, MARGINAL, CRITICAL, or CATASTROPHIC.
External ID	(Optional) Unique ID of the case you want to create.
Description	(Optional) Description of the case you want to create.
Deprecated	(Optional) Whether or not the created case is deprecated.
Additional attributes in json format	(Optional) Use this field to set values that are not displayed in FortiSOAR™.

Output

The JSON output contains the case ID and the details of the case created on ArcSight ESM.

The output contains the following populated JSON schema:
{
     "modifierName": "",
     "creatorName": "",
     "type": "",
     "reference": {
         "referenceType": "",
         "uri": "",
         "referenceString": "",
         "referenceName": "",
         "isModifiable": "",
         "id": "",
         "managerID": ""
     },
     "displayID": "",
     "createdTimestamp": "",
     "attributeInitializationInProgress": "",
     "deprecated": "",
     "isAdditionalLoaded": "",
     "state": "",
     "estimatedRestoreTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "modifiedTimestamp": "",
     "name": "",
     "localID": "",
     "description": "",
     "URI": "",
     "initialized": "",
     "disabled": "",
     "reportingLevel": "",
     "numberOfOccurences": "",
     "inCache": "",
     "inactive": "",
     "resourceid": "",
     "typeName": "",
     "modificationCount": "",
     "createdTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "modifiedTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     }
}

operation: Update Case

Input parameters

Parameter	Description
Case ID	ID of the case you want to update.
Case Name	(Optional) Updated case name, if you want to update the name of an existing case.
Alias (Display Name)	(Optional) Alias or Display Name of the case that you want to update.
Ticket Type	(Optional) Ticket type of the case you want to update. You can choose from the following options: INTERNAL, CLIENT, or INCIDENT.
Stage	(Optional) Updated stage, if you want to update the stage of an existing case. You can choose from the following options: QUEUED, INITIAL, FOLLOW_UP, FINAL, or CLOSED.
Frequency	(Optional) Updated frequency, if you want to update the frequency of an existing case. You can choose from the following options: TEN_TO_FIFTEEN, NEVER_OR_ONCE, FIFTEEN, LESS_THAN_TEN, or MORE_THAN_FIFTEEN.
Operational Impact	(Optional) Updated operational impact, if you want to update the operational impact of an existing case. You can choose from the following options: NO_IMPACT, NO_IMMEDIATE_IMPACT, LOW_PRIORITY_IMPACT, HIGH_PRIORITY_IMPACT, or IMMEDIATE_IMPACT.
Security Classification	(Optional) Updated security classification, if you want to update the security classification of an existing case. You can choose from the following options: UNCLASSIFIED, CONFIDENTIAL, SECRET, or TOP_SECRET.
Consequence Severity	(Optional) Updated consequence severity, if you want to update the consequence severity of an existing case. You can choose from the following options: NONE, INSIGNIFICANT, MARGINAL, CRITICAL, or CATASTROPHIC.
Estimated Restore Date Time	(Optional) Updates the Date and time for restoring the case, if required.
External ID	(Optional) Updated External ID, if you want to update the Unique ID of the case.
Description	(Optional) Updated description of the case.
Deprecated	(Optional) Updates whether or not the case is deprecated.
Notification Group IDs	(Optional) IDs of groups that should be notified when the case is updated.
Custom Fields	(Optional) Use this field to set or update values that are not displayed in FortiSOAR™.

Output

The JSON output contains the details of the case updated on ArcSight ESM.

The output contains the following populated JSON schema:
{
     "modifierName": "",
     "creatorName": "",
     "alias": "",
     "type": "",
     "reference": {
         "referenceType": "",
         "uri": "",
         "referenceString": "",
         "referenceName": "",
         "isModifiable": "",
         "id": "",
         "managerID": ""
     },
     "displayID": "",
     "initialized": "",
     "createdTimestamp": "",
     "attributeInitializationInProgress": "",
     "deprecated": "",
     "isAdditionalLoaded": "",
     "state": "",
     "estimatedRestoreTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "modifiedTimestamp": "",
     "name": "",
     "localID": "",
     "description": "",
     "URI": "",
     "estimatedStartTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "disabled": "",
     "reportingLevel": "",
     "numberOfOccurences": "",
     "inCache": "",
     "inactive": "",
     "resourceid": "",
     "typeName": "",
     "modificationCount": "",
     "createdTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "modifiedTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "eventIDs": "",
     "detectionTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     }
}

operation: Get Case Information

Input parameters

Parameter	Description
Case ID	ID of the case for which you want to retrieve the information from ArcSight ESM.

Output

The JSON output contains the details of the case, retrieved from ArcSight ESM, based on the specified case ID.

The output contains the following populated JSON schema:
{
     "modifierName": "",
     "creatorName": "",
     "type": "",
     "reference": {
         "referenceType": "",
         "uri": "",
         "referenceString": "",
         "referenceName": "",
         "isModifiable": "",
         "id": "",
         "managerID": ""
     },
     "displayID": "",
     "initialized": "",
     "createdTimestamp": "",
     "attributeInitializationInProgress": "",
     "deprecated": "",
     "isAdditionalLoaded": "",
     "state": "",
     "estimatedRestoreTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "modifiedTimestamp": "",
     "name": "",
     "localID": "",
     "description": "",
     "URI": "",
     "estimatedStartTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "disabled": "",
     "reportingLevel": "",
     "numberOfOccurences": "",
     "inCache": "",
     "inactive": "",
     "resourceid": "",
     "typeName": "",
     "modificationCount": "",
     "createdTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "modifiedTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     },
     "eventIDs": "",
     "detectionTime": {
         "day": "",
         "minute": "",
         "year": "",
         "hour": "",
         "timezoneID": "",
         "second": "",
         "milliSecond": "",
         "month": ""
     }
}

operation: Add Events to Case

Input parameters

Parameter	Description
Case ID	ID of the case in which you want to add events.
Events IDs	IDs of the events that you want to add to the specified case. You must provide the Event IDs in the list format.

Output

The JSON output returns a Success message if the events are successfully added to the specified case ID, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Delete Case Events

Input parameters

Parameter	Description
Case ID	ID of the case from which you want to delete events.
Events IDs	IDs of the events that you want to delete from the specified case. You must provide the Event IDs in the list format.

Output

The JSON output returns a Success message if the events are successfully deleted from the specified case ID, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Search Query

Input parameters

Parameter	Description
Query	Query using which you want to search ArcSight ESM.
Start Position	Position from where you want to start the search. By default, this is set to 0.
Page Size	Number of result records that you want to display on one page. By default, this is set to 10.

Output

The JSON output contains the search results retrieved from ArcSight ESM, based on the specified query.

The output contains the following populated JSON schema:
{
     "elapsed": "",
     "queryStr": "",
     "hitCount": "",
     "statusString": "",
     "searchHits": [
         {
             "uri": "",
             "score": "",
             "uuid": "",
             "name": ""
         }
     ],
     "queryTerms": [],
     "rewrittenQueryString": ""
}

operation: Download Report

Input parameters

Parameter	Description
Report ID	Download ID of the ArcSight report that you want to upload as an attachment in FortiSOAR™. Note: You can get the ID of the report using the Run Report function.
Name of the file when added as an attachment in Cybersponse	Name of the file when it is added as an attachment in FortiSOAR™. If you do not specify any name, then the file by default is named as ‘ArcSight Report’.

Output

The JSON output contains the details of the attachment in FortiSOAR™.

The output contains a non-dictionary value.

operation: Get Active List Information

Input parameters

Parameter	Description
Active List ID	Resource ID of the Active List for which you want to retrieve details from ArcSight ESM.

Output

The JSON output contains the details of the active list, retrieved from ArcSight ESM, based on the specified active list ID.

The output contains the following populated JSON schema:
{
     "modifierName": "",
     "multiMap": "",
     "creatorName": "",
     "inactive": "",
     "type": "",
     "reference": {
         "referenceType": "",
         "referenceString": "",
         "isModifiable": "",
         "referenceName": "",
         "id": "",
         "managerID": "",
         "uri": ""
     },
     "caseSensitiveType": "",
     "capacity": "",
     "isAdditionalLoaded": "",
     "keyFields": "",
     "createdTimestamp": "",
     "modifiedTimestamp": "",
     "deprecated": "",
     "timePartitioned": "",
     "state": "",
     "optimizeData": "",
     "activeListType": "",
     "attributeInitializationInProgress": "",
     "name": "",
     "localID": "",
     "fieldTypes": "",
     "fieldSubTypes": {},
     "URI": "",
     "initialized": "",
     "entryTimeToLive": "",
     "disabled": "",
     "partialCache": "",
     "inCache": "",
     "fieldNames": "",
     "resourceid": "",
     "typeName": "",
     "modificationCount": "",
     "createdTime": {
         "day": "",
         "timezoneID": "",
         "milliSecond": "",
         "month": "",
         "second": "",
         "year": "",
         "minute": "",
         "hour": ""
     },
     "modifiedTime": {
         "day": "",
         "timezoneID": "",
         "milliSecond": "",
         "month": "",
         "second": "",
         "year": "",
         "minute": "",
         "hour": ""
     }
}

operation: Update Active List

Input parameters

Parameter	Description
Active List ID	Resource ID of the Active List that you want to update on ArcSight ESM.
Column Names List	(Optional) List of column names that you want to update, i.e., columns in which you want to add entries. By default, all the column names are included.
Entry List	List of entries to add to the specified active list. You must add the values in the same sequence as the columns specified. For example, [[“val1”, “val2”], [“val3”, “val4”]]

Output

The JSON output returns a Success message if the active list is successfully updated on ArcSight or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Get Active List Entries

Input parameters

Parameter	Description
Active List ID	(Optional) Resource ID of the active list for which you want to retrieve entries from Micro Focus ArcSight.
Clear Active List Entries	Select this option, i.e., set it to True (default), to clear the entries of the specified active list after the active list is read.

Output

No output schema is available at this time.

operation: Clear Active List Entries

Input parameters

Parameter	Description
Active List ID	Resource ID of the Active List for which you want to clear entries from ArcSight ESM.

Output

The output response appears as follows if the entries are cleared successfully from the specified Active List:
Active List: <Active List ID> entries are cleared successfully.

operation: Delete Active List Entries

Input parameters

Parameter	Description
Active List ID	Resource ID of the Active List from which you want to delete entries on ArcSight ESM. Note: The default ID is taken from the connector configuration. For more information, see the Configuring the connector section.
Entry List	List of entries that you want to delete from the specified active list. You must add the values in the same sequence as the columns specified. For example, [[“val1”, “val2”], [“val3”, “val4”]]

Output

The output contains a non-dictionary value.

operation: Get Fields

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
     "sei.getFieldsResponse": {
         "sei.return": [
             {
                 "fieldDisplayName": "",
                 "fieldType": {
                     "type": "",
                     "javaTypeName": "",
                     "name": ""
                 },
                 "sidetable": "",
                 "derived": "",
                 "groupDisplayName": "",
                 "simple": "",
                 "fieldName": "",
                 "reference": "",
                 "fieldIndex": "",
                 "copyOfFieldName": "",
                 "groupName": ""
             }
         ]
     }
}

operation: Get Query Viewer Data

Input parameters

Parameter	Description
Query Viewer ID	Resource ID of the query viewer for which you want to retrieve details from ArcSight ESM.

Output

No output schema is available at this time.

Included playbooks

The Sample - Micro Focus ArcSight - 3.0.0 playbook collection comes bundled with the Micro Focus ArcSight connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Micro Focus ArcSight connector.

• Active List : Clear Active List Entries
• Active List : Delete Active List Entries
• Active List : Get Active List Entries
• Active List : Get Active List Information
• Active List : Update Active List
• ArcSight > Fetch 
• > Arcsight > Fetch Events And Create Record
• >> ArcSight > Get Base Events
• ArcSight > Ingest
• Case : Add Events to Case
• Case : Create Case
• Case : Delete Case Events
• Case : Get Case Information
• Case : Update Case
• Event : Annotate Event 
• Event : Get Fields
• Get Query Viewer Data
• Report : Delete Report
• Report : Download Report
• Report : Run Report
• Report : Run Report with Default Parameters
• Search Query

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Troubleshooting

For troubleshooting, any issues with the Pull ArcSight Events Service, see the /var/log/cyops/cyops-integrations/arcsight/arcsight_reader.log log file.

Connection refused while requesting to run the wrapper

This generally occurs in the case of self-signed SSL certificates. If you are using self-signed certificates for testing or staging, keep in mind this problem will not occur in production, and you might need to switch the certificates on or off.

Resolution:

Ensure that the SSL certificates are trusted or that SSL checking is turned off in the wrapper script. This is not advised for production instances.

Playbook fails after the ingestion is triggered

There are many reasons for a playbook failure, for example, if a required field is null in the target module record, or there are problems with the Playbook Appliance keys.

Resolution:

Investigate the reason for failure using the Running Playbooks tab in the Playbook Administration page. Review the step in which the failure is being generated and the result of the step, which should contain the trace of the error. Once you have identified the error and if you cannot troubleshoot the error, contact Fortinet support for further assistance.

ArcSight ESM and FortiSOAR™ integration

ArcSight ESM and FortiSOAR™ integration is achieved by the following simple steps:

• Setup an Active List in ArcSight ESM
• Create a user in ArcSight ESM 
• Setup the ArcSight ESM connector in FortiSOAR™
• Configure Data Ingestion

Setup an Active List in ArcSight ESM

An Active List in ArcSight ESM holds correlated events, which can be read by FortiSOAR™ and then converted into alerts.

To ingest data from ArcSight, you need to create an “Active List” and configure “Rules” in ArcSight ESM, so that events from ArcSight ESM can be pulled into FortiSOAR™ as described in the following sections.

Use the “FortiSOAR_ArcSight.arb” package to create the Active List in ArcSight ESM and configure the Rule that forwards desired events to the created active list. You have to create and configure a rule to define the type of events you want to forward and investigate in FortiSOAR™. Once the active list is added and the rule is configured, FortiSOAR™ monitors the active list pulls the desired events from ArcSight ESM, and creates alerts in FortiSOAR™. 

Download the FortiSOAR_ArcSight.arb package, which is attached to this article, and then import the same into ArcSight ESM, as described Importing the FortiSOAR_ArcSight.arb package in ArcSight section.

Alternatively, you can manually set up the active list and the rules using the standard ArcSight interface. Points to be considered while manually setting up rules:

Rule:

• Create a rule (generally a “Lightweight Rule”) that would populate events in the FortiSOAR Active List.
• Specify conditions to filter out undesired events, such as add a rule to exclude low priority events so that unnecessary alerts would not be pushed to FortiSOAR™.

The following image displays an Active List populated with desired events and the Resource ID is highlighted in the right pane: 

Create a user in ArcSight ESM 

FortiSOAR™ requires a user account and password to connect to ArcSight ESM. You could use an existing user, or create a new standard user for this purpose. This user account will be used by FortiSOAR™ to fetch and/or update events and invoke other supported actions. Ensure that the user has the following permissions: 

• Read and write access to the FortiSOAR Active List (“FortiSOAR AL”). 
• Access to all required events in ArcSight ESM, including the base events.

The following image displays a FortiSOAR user in ArcSight ESM with «Read» and «Write» access to FortiSOAR AL:

Setup the ArcSight ESM connector in FortiSOAR™

Install and configure the Micro Focus ArcSight Connector in FortiSOAR™ as described in the Installing the connector and Configuring the connector sections.

Configure Data Ingestion

Configure data ingestion using the “Data Ingestion Wizard” to seamlessly map the incoming ArcSight ESM correlated event data into a FortiSOAR™ alert.

The Data Ingestion Wizard enables you to configure scheduled pulling of data from ArcSight ESM into FortiSOAR™. It also lets you pull some sample data from ArcSight ESM using which you can define mapping of data between ArcSight ESM and FortiSOAR™. Mapping of common fields are generally already done by the Data Ingestion Wizard; users mostly require to only map any custom fields that are added in the ArcSight event.

1. To begin configuring data ingestion, click Configure Data Ingestion on the ArcSight ESM connector’s Configurations page. 
   
   Click Let’s Start by fetching some data, to open the “Fetch Sample Data” screen.
   Sample data is required to create a field mapping between ArcSight ESM data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.
2. On the Fetch Data screen, provide the configurations required to fetch ArcSight ESM data, i.e., specify the Event IDs of sample events to be fetched to create a mapping between ArcSight ESM events and FortiSOAR™ alerts.
   You can also specify the maximum number of base events to be fetched per event and then click Fetch Data.
   
   The Data Ingestion Wizard uses the specified event IDs to pull sample data from ArcSight ESM into FortiSOAR™. The specified event IDs are used only as sample data and not used for subsequent data ingestion.
3. On the Field Mapping screen, map the fields of an ArcSight event to the fields of an alert present in FortiSOAR™. 
   To map a field, click the key in the sample data to add the “jinja” value of the field. For example, to map the path parameter of an ArcSight event to the File Path parameter of a FortiSOAR™ alert, click the Field Path field and then click the path field to populate its keys:  
   
   For more information on field mapping, see the Data Ingestion Wizard chapter see the «Connectors Guide» in the FortiSOAR™ product documentation.
   Once you have completed mapping fields, click Save Mapping & Continue.
   It is recommended to schedule the pull data from ArcSight ESM using the Poll Interval parameter in the “Enable Pull ArcSight Service” section of the Micro Focus ArcSight connector Configurations page as described in the Configuring the connector section. Therefore, just click Save Setting & Continue.
4. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.

For additional information about the “Data Ingestion Wizard” and installing and configuring connectors, see the «Connectors Guide» in the FortiSOAR™ product documentation.

Importing the FortiSOAR_ArcSight.arb package in ArcSight

Note: The ‘FortiSOAR_ArcSight.arb’ package included with this version has been updated to remove the ‘Active List Rule’ from the package.

1. Download the FortiSOAR_ArcSight.arb file that is attached to this document.
2. To import the FortiSOAR_ArcSight.arb package in ArcSight, navigate to the Packages tab in ArcSight as shown in the following image:
   
3. Click Import and select the FortiSOAR_ArcSight.arb.
   The FortiSOAR_ArcSight.arb package contains the Active List (FortiSOAR_Event_collector).
   Once the FortiSOAR_ArcSight.arb package is imported successfully, the FortiSOAR Active List will appear in ArcSight as follows:
   

FortiSOAR_ArcSight.arb

ArcSight is a cyber security product that offers big data security analytics and intelligence software for SIEM and log management. It is designed to help clients discover and prioritize security risks, organize and manage incident response activities, and ease audit and compliance tasks. This article will cover all you need to know to get started with ArcSight ESM.

ArcSight ESM — Table of contents

What is ArcSight ESM?

ArcSight Enterprise Security Manager (ESM) is a Big Data analytics-based enterprise security solution that turns Big Data into actionable insight. ArcSight ESM is a market-leading security event information collection, correlation, and reporting system.ArcSight ESM evaluates and analyses every login, logoff, file access, and database query in the organization to give actual security risk ranking and breach of enforcement. 

What is the Use of ArcSight ESM?

ArcSight ESM is a market-leading security event information collection, correlation, and reporting system. ArcSight ESM aids you in the following areas:

• Real-time correlation of data from any source to discover issues before they become a breach.
• Building Security Use Cases with ArcSight ESM gives you a thorough understanding of ArcSight’s security problem-solving approach in the context of ESM.

If you want to enrich your career and become a professional in ForgeRock, then enroll in «ArcSight Training«. This course will help you to achieve excellence in this domain.

ArcSight ESM Overview

ESM uses ArcSight ESM Overview ArcSight ESM Architecture SmartConnectors to collect event data from your network.

SmartConnectors transform device event data into a standard format that may use to correlate.

The Manager in the CORR Engine is in charge of Processing and storing event data. Users may monitor events, run reports, produce resources, conduct investigations, and control the system using the ArcSight Console or the ArcSight Command Center.

ESM’s underlying architecture is used to power additional ArcSight products that control event flow, simplify event analysis, and offer security warnings and incident response.

ArcSight ESM Architecture

Several components make up the ESM for the Fusion environment, allowing it to receive and show data from sources like ESM. The following picture will help you comprehend the software and components that make up your ESM for Fusion setup. 

ArcSight ESM Key Features

The following are critical features of ArcSight:

Layered Security Analytics.

It’s a one-stop solution for real-time correlation, hypothesis-based threat hunting, and behavioural analytics.

Native SOAR Out-of-the-Box 

Security Orchestration Automation and Response offers automated, coordinated, and expedited incident response.

Log Management and Reporting

Unified storage, quick big-data search, rich analytics, visualization, and reporting speed up threat hunting and make compliance easier.

MITRE ATT&CK Integration

Extensive coverage of MITRE ATT&CK methodologies and tactics, with tiered analytics and threat monitoring content packages.

Security Data Operating Platform

Real-time data collection and enrichment Device, connector, and destination management have been streamlined.

ArcSight ESM Event Ingestion for Security Operations integration

Security incident analysts may gather associated events and automate the development of security incidents with the ServiceNow platform thanks to the ArcSight ESM event ingestion interface with the Security Incident Response solution. Data is continuously absorbed depending on a polling schedule, and analysts utilise it to identify and respond to possible cyber security risks.

Correlated events that are candidates for security incidents can be ingested regularly using this integration. You may map fields in associated events to security incident fields, preview the configuration of an event as a security incident, and schedule event ingestion to automatically produce security incidents.

This connection gives a security operations centre (SOC) analyst access to ArcSight ESM correlation events. This data may be linked to Now Platform Security Incident Response (SIR) security incidents for further analysis and repair. Different correlation event types are produced and made available via correlation query viewers in ArcSight ESM, and your Now Platform instance profiles are built to manage them.

These profiles control the appearance of specific ArcSight ESM associated event fields for SIR security events.
This integration includes the following critical functionalities:

• Create several event intake profiles to generate SIR security events for various risks such as malware and unauthorised access attempts.
• Drag-and-drop mapping of ArcSight ESM correlation event field values to corresponding SIR security incident fields
• To verify event mapping information, a preview of the SIR security incident layout based on example correlation events is supplied.
• Input prior correlation events as well as new significant occurrences at predefined intervals.
• Remove correlation events that do not meet SIR incident creation criteria, such as low priority events.

ArcSight ESM Supported Versions

The ArcSight ESM Manager version 7.0.0.2436 was used to test this integration. The integration supports ArcSight ESM on-premises and Cloud/Hosted service environments.

MID Server

When the ArcSight ESM server is deployed within your corporate network, this integration requires an installed and configured MID Server in your Now Platform instance to connect to the ArcSight ESM service. A MID Server is unnecessary if you use the ArcSight ESM cloud service. 

Conclusion:

With this, we have come to the end of this blog of ArcSight ESM. We hope the information covered is valuable and helps you gain a thorough grasp of ArcSight ESM.

About Author

Готов к работе

Скачать установщик

1. Загрузите установщик Arcsight HA и установщик Arcsight ESM с официального сайта HP.
2. Загрузите файл лицензии Arcsight, установщик Arcsight HA и установщик Arcsight ESM в каталог / tmp uatemsha1.
Введение в установщик
Структура каталогов ArcSightESMSuite-7.0.0.2234.1 выглядит следующим образом:

D:ArcSightArcSightESMSuite-7.0.0.2234.1>tree /F
D:.
│  ArcSightESMSuite.bin
│
├─ESMComponents
│  │  component.properties
│  │
│  ├─logger
│  │      ArcSightLogger.bin
│  │
│  ├─manager
│  │      ArcSightManager.bin
│  │      ArcSightManager_Documentation_Pack.iam.zip
│  │
│  └─service
│          boxster-services.tgz
│
└─Tools
    │  prepare_scripts.sh
    │  prepare_system.sh
    │  stop_services.sh
    │
    └─highavail
            functions
            prepareHA.sh
            setupESM.sh
            template.properties

Требования к разделу жесткого диска

При установке операционной системы оставшееся пространство не выделяется. После установки операционной системы выполните следующую команду, чтобы разделить пространство.

1. Создать PV

fdisk -l
partprobe /dev/sda
pvcreate /dev/sda4

#pvdisplay 
   --- Physical volume ---
  PV Name               /dev/sda4
  VG Name               vg00
  PV Size               500.39 GiB / not usable 4.96 MiB
  Allocatable           yes (but full)
  PE Size               4.00 MiB
  Total PE              128099
  Free PE               0
  Allocated PE          128099
  PV UUID               eTLmWv-QaK2-qHPJ-wJ3e-JfvQ-pw2I-anYUoT

Во-вторых, создать VG

vgcreate vg00 /dev/sda4
vgdisplay

Три, создай LV

1. Создайте раздел / tmp и отформатируйте его в формате ext2.

lvcreate -L 10G -n tmp vg00
lvdisplay
mkfs.ext4 /dev/vg00/tmp

2. Создать / matadate раздел без форматирования.

lvcreate -L 64M -n metadate vg00

3. Создайте раздел / opt и отформатируйте его в формате xfs.

lvcreate -l 100%FREE -n opt vg00
mkfs.xfs /dev/mapper/vg00-opt

4. Создайте файл автоматического монтирования при загрузке.
Отредактируйте / etc / fstab и добавьте следующие 2 строки

/dev/mapper/vg00-tmp /tmp ext4 defaults 1 2
/dev/mapper/vg00-opt /opt xfs defaults,inode64 1 2

[[email protected] ~]# fdisk -l

Disk /dev/sda: 600.1 GB, 600093712384 bytes, 1172058032 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 262144 bytes / 262144 bytes
Disk label type: dos
Disk identifier: 0x0006bfae

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048     1026047      512000   83  Linux
/dev/sda2         1026048   105883647    52428800   83  Linux
/dev/sda3       105883648   122660863     8388608   82  Linux swap / Solaris
/dev/sda4       122660864  1172058031   524698584   83  Linux

Конфигурация, связанная с операционной системой

1. Настройте IP-адрес и имя хоста

Конфигурация хоста 1:
1. Настройте IP-адрес и имя хоста.

Конфигурация хоста 1:
Имя хоста: uatesmha1
IP-адрес: 192.168.1.143
Шлюз: 192.168.1.254
/ etc / hosts:
192.168.79.143 uatesmha1
192.168.1.144 uatesmha2
192.168.1.145 uatesm

Конфигурация хоста 2:
Имя хоста: uatesmha2
IP-адрес: 192.168.1.144
Шлюз: 192.168.1.254
/ etc / hosts:
192.168.1.143 uatesmha1
192.168.1.144 uatesmha2
192.168.1.145 uatesm

Разархивируйте установщик

tar -xvf ArcSightESMSuite-7.0.0.2234.1.tar 
tar -xvf ArcSight-Highavail-7.0.0.1104.1.tar

Результаты распакованного каталога следующие:

файл highavail.properties

1. Файл свойств Arcsight HA

Перейдите в каталог / tmp / Tools / highavail и выполните команду:

cp ./template.properties highavail.properties

Используйте редактор vi для настройки следующего содержимого в highavail.properties.

# Сервисное имя хоста, т.е. uatesm
service_hostname=
# Общий диск, вот / opt
shared_disk=
Объем метаданных, здесь / dev / mapper / vg00-meta
metadata_volume=
# IP первичного сервера
primary_cable_ip=
# Имя основного сервера
primary_hostname=
# Резервный IP-адрес сервера
secondary_cable_ip=
# Имя хоста резервного сервера
secondary_hostname=

2. Запустите файл подготовки установки HA и выполните следующую команду:

/tmp/Tools/highavail/prepareHA.sh

Действуйте в соответствии с шагами, и выполнение будет завершено без ошибок. После завершения операции перезапустите сервер.

3. Скопируйте сгенерированные свойства highavail.properties на резервный компьютер и выполните также /tmp/Tools/highavail/prepareHA.sh. Перезагрузите сервер без ошибок.

scp ./highavail.properties [email protected]:/tmp/Tools/highavail/

4. Установите модуль Arcsight HA

Выполните следующие команды на главном сервере:

/tmp/ ArcSight-Highavail-7.0.0.1104.1.bin –i console

Следуйте инструкциям.

5. Проверьте, успешна ли установка

/usr/lib/arcsight/highavail/bin/arcsight_cluster status

Tue Jan 29 10:22:49 CST 2019 OK
uatesmha1: online Primary
uatesmha2: online

Disk: Connected UpToDate/UpToDate

OK   Network-uatesmha1
OK   Network-uatesmha2

Started   ESM
Started   Failover-Check-uatesmha1
Started   Failover-Check-uatesmha2
Started   Filesystem
Started   Ping-uatesmha1
Started   Ping-uatesmha2
Started   STONITH-SSH-uatesmha1
Started   STONITH-SSH-uatesmha2
Started   Service-IP

Установите Arcsight ESM

1. Запустите от имени пользователя arcsight: /tmp/ArcSightESMSuite.bin –i console и следуйте инструкциям
2. Запустите мастер первого запуска Arcsight ESM
/opt/arcsight/manager/bin/arcsight firstbootsetup -boxster -soft -i console
, обратите внимание, чтобы выбрать компактный режим и установить модуль HA Monitor.

Следуйте инструкциям и обратите внимание на имя хоста ESM при uatesm.
В соответствии с приглашением запустите /opt/arcsight/manager/bin/setup_services.sh под root, чтобы установить ESM в качестве службы.

3. Проверьте установку Arcsight ESM

/etc/init.d/arcsight_services status

Пока что установлен Arcsight ESM HA.
Проверьте состояние кластера:

/usr/lib/arcsight/highavail/bin/arcsight_cluster status

Troubleshoot

Сообщение об ошибке: ПРЕДУПРЕЖДЕНИЯ: arcsight-monit настроен, но не работает.

При выполнении «/etc/init.d/arcsight_services status», WARINGS: arcsight-monit настроен, но не запущен. Появляется сообщение об ошибке.

Подходить:

1. Выполните команду: / usr / lib / arcsight / highavail / bin arcsight_cluster диагностировать

, если нет других ошибок.
2. Переустановите службу и выполните следующую команду

/opt/arcsight/manager/bin/remove_services.sh
/opt/arcsight/manager/bin/setup_services.sh

3. Выполните: /etc/init.d/arcsight_services status. Сообщение об ошибке исчезает.