ArcSight Idea Exchange

2021-09-16

Idea ID: 2871174

Fortigate firewall version 6.4.6 needs to be supported by Microfocus

by rashwath in ArcSight

0 votes

Labels: Connectors

Status: New Idea
- New Idea on 16 Sep 2021
- 0 Comments
It is very critical for all the customers to onbaord and normalise. Request for expedited support on this.
- Ideas Id :
2021-09-15

Idea ID: 2871170

Smartconnector 8.0.0.8322.0 support Meraki MX 14.53

by Leor Dimalanta in ArcSight

0 votes

Labels: Connectors

Status: New Idea
- New Idea on 15 Sep 2021
- 0 Comments
At the moment as per the support Meraki 14.53 is not supported by the SmartConnector, we would like to request that this version of Meraki should be supported.
- Ideas Id :
2021-09-14

Idea ID: 2871155

Smart Connector can collect event SMTP Protocol (SMTP Received and SMTP send Protocol)

by MinhNQ in ArcSight

0 votes

Labels: Connectors

Status: New Idea
- New Idea on 14 Sep 2021
- 0 Comments
Hello Micro Focus Team, I would like to send you an idea about collect events of SMTP Protocol like SMTP Received Protocol or SMTP Send Protocol. Thank you!
- Ideas Id :
2021-09-02

Idea ID: 2871087

Improving HA of CDF master nodes

by k8s_rlz in ArcSight

2 votes

Labels: Transformation Hub

Status: New Idea
- New Idea on 2 Sep 2021
- 0 Comments
Hi, I noticed that HA of master nodes is based on sending gratuitous ARP request to VIP master ip (itom-cdf-keepalived is responsible for that). I find this to be not best solution as master server might be up and have assigned VIP, but Kubernetes...
- Ideas Id :
2021-09-02

Idea ID: 2871075

ESM Trend runs on events containing extended character sets fail

by ianfitz1 in ArcSight

1 votes

Labels: ESM

Status: New Idea
- New Idea on 2 Sep 2021
- 0 Comments
Please fix trends to support extended character sets. Currently for extended characters the trend run fails with a PersistenceException. Thanks, Ian.
- Ideas Id :
2021-09-01

Idea ID: 2871069

Add ESM content for SOAR setup to Default Content or publish on ArcSight Marketplace

by steve-m in ArcSight

1 votes

Labels: Content , ESM , SOAR

Status: New Idea
- New Idea on 1 Sep 2021
- 0 Comments
Please review theARB file in the " ArcSight_SOAR_Build_Guide_Content.7z" file in the" ArcSight SOAR "from the ground up" Build Guide" and add this to the ESM Default Content or publish this on the ArcSight Marketplace. This will make it much easier for...
- Ideas Id :
2021-08-25

Idea ID: 2871008

Add tmux and screen packages to ArcSight appliances

by richhamilton in ArcSight

2 votes

Labels: ArcMC , ESM

Status: New Idea
- New Idea on 25 Aug 2021
- 0 Comments
tmux (terminal multiplexer) and screen binaries should be included as part of the installed packages on ArcSight appliances. tmux would allow some one connected to the appliance to open multiple shells. This would be beneficial for example when tailing...
- Ideas Id :
2021-08-25

Idea ID: 2871002

Set a throughput limit for the Smart Connectors

by SoporteBCN in ArcSight

0 votes

Labels: Connectors

Status: New Idea
- New Idea on 25 Aug 2021
- 0 Comments
Hello, We have noticed that whenever a connector loses connection or there is a source that sends a peak of events, the logger interface may go down due to this peak of events. We think it is very useful for us and many other clients to add a limiter...
- Ideas Id :
2021-08-24

Idea ID: 2870992

McAfee ENS 10.7 Certified with EPO connector

by Kyle Pearson in ArcSight

2 votes

Labels: Connectors

Status: New Idea
- New Idea on 24 Aug 2021
- 0 Comments
ENS 10.7 is the latest version and should ideally be certified to work with the EPO connector. - idea from this post:
- Ideas Id :
2021-08-17

Idea ID: 2870912

ArcSight Logger should be able to add/delete users using Windows AD group/user

by Minos in ArcSight

1 votes

Labels: Logger-Search-Reporting

Status: New Idea
- New Idea on 17 Aug 2021
- 1 Comment
Hi, When we need to use Distinguished Name to map it to a Windows AD user. ArcSight Logger should be able to add/delete user using Windows AD group/user directly. Thanks.
- Ideas Id :
2021-08-17

Idea ID: 2870911

ArcMC alert rules should be able to send to different users

by Minos in ArcSight

14 votes

Labels: ArcMC

Status: Waiting for Votes
- Waiting for Votes on 20 Aug 2021
- 0 Comments
Right now, ArcMC only can send all alerts to one administrator. We need to send alerts to different users bases on different rules.
- Ideas Id :
2021-08-09

Idea ID: 2870808

Netflow v10

by Obiora_NG in ArcSight

0 votes

Labels: Connectors , ESM

Status: New Idea
- New Idea on 9 Aug 2021
- 0 Comments
Please the DEV Team should work on getting Arcsight Connections to be compatible with Netflow Version 10. Netflow is essential now for threath Hunting and correlation of Events on the SIEM. This is a major gap for the ESM.
- Ideas Id :
2021-08-07

Idea ID: 2870807

R80.40 CheckPoint Syslog

by Naz Mal in ArcSight

3 votes

Labels: Connectors

Status: New Idea
- New Idea on 7 Aug 2021
- 0 Comments
Hi All, Was wondering if anyone can advise if the 8.2 parser version supports CheckPoint Version R80.40. The guide states support for versions upto 80.10 - this is a bit misleading as I have 80.20 and 80.30 in our environment and the 8.2 parser seems...
- Ideas Id :
2021-08-07

Idea ID: 2870806

R80.40 + R81 Checkpoint version support

by Naz Mal in ArcSight

3 votes

Labels: Connectors

Status: New Idea
- New Idea on 7 Aug 2021
- 0 Comments
R80.40 has been out since Jan 2020. According to the Arcsight CheckPoint Syslog config guide - upto 80.10 is supported. I can confirm that 80.20 and 80.30 is working the guide needs to be updated about this. R80.40 - is a minor update but with extra...
- Ideas Id :
2021-08-06

Idea ID: 2870793

Checkpoint R81-Support-ArcSight

by vikasgupta in ArcSight

2 votes

Labels: Connectors

Status: New Idea
- New Idea on 6 Aug 2021
- 3 Comments
Checkpoint devices and Perimeter Security Appliance and very critical for all the customers to onbaord and normalise. Request for expedited support on this.
- Ideas Id :
2021-08-05

Idea ID: 2870772

Rapid 7 Integration with SIEM

by SET in ArcSight

0 votes

Labels: Connectors

Status: New Idea
- New Idea on 5 Aug 2021
- 0 Comments
We are Rapid 7 NeXpose version is 6.6.95 supported connector, because our customer have 6.6.95 version and they want to integrate this device with arcsight solution. We have try with 8.2 connector version but smart connector unable to read the logs...
- Ideas Id :
2021-07-29

Idea ID: 2870708

Time taken to perform Logger reporting operations unacceptably long

by ianfitz1 in ArcSight

0 votes

Labels: Logger-Search-Reporting

Status: New Idea
- New Idea on 29 Jul 2021
- 2 Comments
Hi there, Time taken to perform the following operations is far too long: Creating a query object from a Logger Unified Query- I have been waiting for the "Logger Search" popup in a greyed out state for over 10 minutes while trying to create a query...
- Ideas Id :
2021-07-27

Idea ID: 2870688

Update syslog connector to accept messages from Mcafee EPO syslog forwarder

by acappelli in ArcSight

1 votes

Labels: Connectors

Status: New Idea
- New Idea on 27 Jul 2021
- 0 Comments
Mcafee has the ability to forward its messages using syslog, Updating the syslog connector to accept these message would remove the need for a DB connector and make it easier to retrieve those logs.
- Ideas Id :
2021-07-19

Idea ID: 2870555

Syslog-NG: Remove incorrect ERROR message from logs

by ofriese21 in ArcSight

1 votes

Labels: Connectors

Status: New Idea
- New Idea on 19 Jul 2021
- 2 Comments
In Syslog-NG v8.2 SmartConnector whenever a TLS connection ends the SmartConnector writes an ERROR to the log without a description. e.g. [2021-06-10 13:56:14,385] [INFO ] [com.arcsight.agent.ed.a.o] [handleAccept] New TLS socket connection opened...
- Ideas Id :
2021-07-19

Idea ID: 2870554

Smart Connector - Symantec Endpoint Protection version 14

by bfko in ArcSight

3 votes

Labels: Connectors

Status: New Idea
- New Idea on 19 Jul 2021
- 0 Comments
Please consider providing full support for Symantec Endpoint Protection version 14 components for Smart Connector.
- Ideas Id :