How to map additional data in GTAP connector?

ps1 ctic 9 months ago

The currently deployed smart connector imports data from our MISP instance into the ESM. My question is whether we need to map additional data names in our ESM, as I believe those fields already exist within the ArcSight fields.

Tags:

ESM

model import connector

ArcSight

model_import_connector

mapping_fields

Suggested Answer

0 LewisJ 6 months ago

Please look in the unobfuscated parser files that you can download from the SLD portal.

There's a folder called 'misp'. This is what the gtap connector uses.

You could try applying a parser override in the user/agent/fcp/misp to extract extra information.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 LewisJ 6 months ago in reply to LewisJ

However you may run into different issues as this is a model import connector and they work slightly differently to traditional smart connectors
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Menu

ArcSight User Discussions

How to map additional data in GTAP connector?

Tags:

Suggested Answer

Resources