ArcSight Idea Exchange

Welcome to ArcSight Idea Exchange

This idea exchange is for submitting product enhancement ideas only. If you have a question about the product, please click on the “Discussions” tab above and post your questions there.

2022-05-26

Idea ID: 2873371

Duplicated events ingests from Check Point IDS/IPS

by Paul Jung in ArcSight

1 votes

Labels: Connectors , ESM

Status: New Idea
- New Idea on 2022-5-26
- 0 Comments
Hi Team, one of our customer report that duplicated event ingests from Check Point IPD/IPS with syslog type, these events don't ingest randomly time manner. Fort example, time range was various such as 5 mins,1 hours or 3 hours and ETC. This...
- Ideas Id :
2022-05-24

Idea ID: 2873345

IIS Multiple site connector, failed access detect

by Cdc Planning in ArcSight

2 votes

Labels: Connectors

Status: New Idea
- New Idea on 2022-5-24
- 2 Comments
Hi, We are using that IIS multiple site connector, when there is an access problem one of site, i can see that details on agent.wrapper.log.However, this is not possible detect this on ESM or Recon. Because they are not any internal agent log. We need...
- Ideas Id :
2022-05-24

Idea ID: 2873343

ArcMC repository push/upload - dont stop batch job on failures

by ianfitz1 in ArcSight

1 votes

Labels: ArcMC

Status: New Idea
- New Idea on 2022-5-24
- 0 Comments
Hi, Could you please change the way repository push/upload to containers works, and instead of failing at some random point in the list of connectors to which you are pushing the repo, skip the ones that fail, then at the end just give us a list of...
- Ideas Id :
2022-05-18

Idea ID: 2873318

ESM 7.5 Is there a umask policy that dev can honor or use for applying permissions?

by mariliw in ArcSight

1 votes

Labels: ESM

Status: New Idea
- New Idea on 2022-5-18
- 0 Comments
ESM 7.5 Is there a umask policy that dev can honor or use for applying permissions?
- Ideas Id :
2022-05-02

Idea ID: 2873187

Connector to support Microsoft Exchange Server 2019 Access Auditing logs, Mailbox Audit and Admin Audit logs

by Tan Kb in ArcSight

1 votes

Labels: ArcMC , Connectors , Logger-Search-Reporting

Status: New Idea
- New Idea on 2022-5-2
- 0 Comments
Current connector versions support the following Exchange PowerShell versions and log types: Microsoft Exchange Server 2010 SP2 and 2013 Mailbox Audit and Admin Audit logs Microsoft Exchange Server 2016 Access Auditing logs Request to enhance the connector...
- Ideas Id :
2022-04-28

Idea ID: 2873177

Provide search builder function in Logger new search UI

by Leon Chiu in ArcSight

1 votes

Labels: Logger-Search-Reporting

Status: New Idea
- New Idea on 2022-4-28
- 0 Comments
Hi everyone, Logger classical search have an advanced search builder function to create search by easy combination the criterial together. In Logger new search didn't come with same capability, my idea is to provide same search builder. Regards...
- Ideas Id :
2022-04-27

Idea ID: 2873171

changing the target port for notification via smtp to e.g. 587

by PeterTh in ArcSight

2 votes

Labels: ESM

Status: New Idea
- New Idea on 2022-4-27
- 0 Comments
due to the fact that we need to use SMTP Auth, we have to change the destination port for notifications to a port other than 25 because the mail server support SMTP auth only on port 587
- Ideas Id :
2022-04-26

Idea ID: 2873109

Support for RSA Authentication Manger

by Engineer20I7 in ArcSight

1 votes

Labels: Connectors

Status: New Idea
- New Idea on 2022-4-26
- 0 Comments
Hi, Currently Tried using SNMP Unified Connector for RSA Authentication Manager 8.4. The guide states that it only supports up to 8.3 is there any works in the pipeline to update to newer versions for RSA ? Regards Uma
- Ideas Id :
2022-04-07

Idea ID: 2872974

Improve parsing for WiNC connector

by Kresimir Zamuda in ArcSight

1 votes

Labels: Connectors

Status: New Idea
- New Idea on 2022-4-7
- 0 Comments
Can you please update parsing for event ID 4771 , to map IpAddress to sourceAddress? The reason for this is that the c lient address is viewed as a source address from the point of DC. Currently, it's mapped to dCS3 field (conditionalmap[0].mappings...
- Ideas Id :
2022-04-06

Idea ID: 2872954

Category Technique field is missing in Checkpoint IPS Smart Defense Logs with ArcSight Smart connector

by Jitendra Singh in ArcSight

1 votes

Labels: Connectors

Status: New Idea
- New Idea on 2022-4-6
- 0 Comments
Hi, In checkpoint IPS smart defense logs smart connector is not capturing the Category technique field which is the most useful field for creating any use cases of IPS and have raised the case with Micro focus support team but they are not able to...
- Ideas Id :
2022-04-04

Idea ID: 2872938

Allow to restore "on premise" ArcMc backups to be restore in "containerized" ArcMc

by Numb78 in ArcSight

2 votes

Labels: ArcMC

Status: New Idea
- New Idea on 2022-4-4
- 0 Comments
Actually the ability to restore "on premise" ArcMc instance in another one in container (installed in CDF as capability) is not allowed as clearly stated in ArcMc documentation. As for some customers, with a lot of nodes configured, the re-implementation...
- Ideas Id :
2022-04-04

Idea ID: 2872936

Allow to directly enroll TLS certificates that protect CDF applications (SOAR, Intelligence, Fusion, etc.)

by Numb78 in ArcSight

2 votes

Labels: ArcMC , Deploy & Arch. , ESM , Investigate , Recon , SOAR , Transformation Hub

Status: New Idea
- New Idea on 2022-4-4
- 0 Comments
Customers usually needs to protect applications web access like SOAR, Intelligence, ESM CC with their own certificates enrolled by a corporate CA. Usually, when performing such operations, customer are allowed to produce a certificate request for the...
- Ideas Id :
2022-03-30

Idea ID: 2872898

ArcMC - preserve web_memory and MEMORY_SETTINGS on upgrade

by ianfitz1 in ArcSight

1 votes

Labels: ArcMC

Status: New Idea
- New Idea on 2022-3-30
- 0 Comments
Hi, it would be really helpful if you could preserve the following 2 settings on ArcMC upgrade: 1) Preserve the existing setting for result below: $ARCMC_HOME/current/arcsight/bin/query_platform ... elif [ "$1" = "web_memory" ]; then ***...
- Ideas Id :
2022-03-30

Idea ID: 2872896

Support of PKCE within REST Flex

by mcglynn1 in ArcSight

1 votes

Labels: Connectors

Status: New Idea
- New Idea on 2022-3-30
- 0 Comments
Support of PKCE within REST Flex OAuth2.0 Code Flow. PKCE ( RFC 7636 ) is an extension to the Authorization Code flow to prevent CSRF and authorization code injection attacks.
- Ideas Id :
2022-03-30

Idea ID: 2872893

Rest API to retrieve all events in last X hours

by Ivgeni Broitman in ArcSight

2 votes

Labels: APIs , ESM

Status: New Idea
- New Idea on 2022-3-30
- 0 Comments
I would like to have a REST API that will return all events in the last X hours. The closest to what I need is the /events/retrieve but it requires list of events ids. I would like to have the same functionality without the need to know the events...
- Ideas Id :
2022-03-29

Idea ID: 2872880

Ability for ArcMC to cleanup backups/logs/etc from performing a connector framework upgrade.

by Michael Dearing in ArcSight

1 votes

Labels: ArcMC , Connectors

Status: Under Consideration
- Under Consideration on 2022-4-14
- 0 Comments
Brief Description Ability for ArcMC to cleanup backups/logs/etc from performing a connector framework upgrade. Benefits / Value Given the recent vulnerabilities such as Log4j and having connectors installed on hosts that may not be accessible...
- Ideas Id :
2022-03-24

Idea ID: 2872854

Add API Token access capability to Okta SmartConnector

by Spencer Phillips in ArcSight

3 votes

Labels: Connectors

Status: Under Consideration
- Under Consideration on 2022-4-14
- 0 Comments
Brief Description: Add API token access capability as an alternative to OAuth2 for the Okta SmartConnector Benefits: Provides a simpler setup of Okta, and another access method for environments restricted by either Multi-Factor Authentication or...
- Ideas Id :
2022-03-23

Idea ID: 2872826

Arcsight connector required to integrate with Microsoft M365 but not support modern authentication

by Archie Cheng in ArcSight

2 votes

Labels: Cloud , Connectors , ESM

Status: Under Consideration
- Under Consideration on 2022-4-14
- 0 Comments
Hi, It is required that SIEM agents support Microsoft modern authentication as standard. However, my company found that the agent message tracing does not support the required authentication and exception security policy is applied for this issue....
- Ideas Id :
2022-03-22

Idea ID: 2872819

ArcSight Smartconnector required to integrate Trend Micro Apex Central

by Jitendra Singh in ArcSight

1 votes

Labels: Connectors

Status: Waiting for Votes
- Waiting for Votes on 2022-4-14
- 2 Comments
Hi, There is no smart connector available for Trend Micro apex Central, As per their support person currently we don't have any kind of integration document for it, we can support you for it's earlier version that is trend micro control manager. ...
- Ideas Id :
2022-03-18

Idea ID: 2872800

Syslog Folder follower in addition to daemon,pipe,file

by acappelli in ArcSight

3 votes

Labels: Connectors

Status: Under Consideration
- Under Consideration on 2022-4-14
- 0 Comments
Syslog connector does not have an option to follow more than one file. Many organization will set up a collection for their enterprise which forwards logs to a central collection using the host name and date as the file name. The current syslog connector...
- Ideas Id :

Menu

ArcSight

ArcSight Idea Exchange

Labels

Welcome to ArcSight Idea Exchange

Duplicated events ingests from Check Point IDS/IPS

IIS Multiple site connector, failed access detect

ArcMC repository push/upload - dont stop batch job on failures

ESM 7.5 Is there a umask policy that dev can honor or use for applying permissions?

Connector to support Microsoft Exchange Server 2019 Access Auditing logs, Mailbox Audit and Admin Audit logs

Provide search builder function in Logger new search UI

changing the target port for notification via smtp to e.g. 587

Support for RSA Authentication Manger

Improve parsing for WiNC connector

Category Technique field is missing in Checkpoint IPS Smart Defense Logs with ArcSight Smart connector

Allow to restore "on premise" ArcMc backups to be restore in "containerized" ArcMc

Allow to directly enroll TLS certificates that protect CDF applications (SOAR, Intelligence, Fusion, etc.)

ArcMC - preserve web_memory and MEMORY_SETTINGS on upgrade

Support of PKCE within REST Flex

Rest API to retrieve all events in last X hours

Ability for ArcMC to cleanup backups/logs/etc from performing a connector framework upgrade.

Add API Token access capability to Okta SmartConnector

Arcsight connector required to integrate with Microsoft M365 but not support modern authentication

ArcSight Smartconnector required to integrate Trend Micro Apex Central

Syslog Folder follower in addition to daemon,pipe,file

Resources