• State Not Answered
  • Replies reply
    1
  • Subscribers subscribers
    23
  • Views views
    402
  • Users 0 members are here
  • Locked Locked
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How do I get a replay file on my test connector?

dcorwin25

I have set up a test connector on my connector appliance and a matching receiver on my logger. I have also exported some events from ESM to a csv file. I now want to turn that csv file into a replay file and have the test connector use it to send test events to my logger. How can I accomplish this?

Thanks,

Dave

  • 0

    Hi,

    There's a tool inside arcsight to do this.

    Please look at the attachment steps:

    3. Copy the CSV file to the database server and run the following command from the ArcSight bin directory (this path for Linux is usually /usr/local/arcsight/db/bin):

    ./arcsight csvconvert –S <full path with CSV filename> -D <event replay filename>

    4. You’ll find the replay file in your replayagent directory when the conversion is complete. (ie: /usr/local/arcsight/db/replayagent)

    Here is a disccusion about it:

    There are also other discussions about it on protect247

    i also added some .events files that you can use to simulate an attack

    wormOutbreak_200epm.zip

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.