ArcSight FlexConnector Developer's Guide

[Ahedge]

When are they going to add information on merging events to this document?

[sadingrid]

Event merging is not an officially supported function, so it will not be documented in the ArcSight FlexConnector Developer’s Guide. For information about this function, you can contact ArcSight Professional Services.

Ingrid

[dbarry1]

Aurthur:

What can you tell us about event merging? 😉

[flibeau]

On page 11 it is mentioned:

REST FlexConnector that uses REST API endpoints, JSON parser, and OAuth2

authentication to collect security events from cloud vendors (such as Box, Salesforce,

or Google Apps). This FlexConnector is not documented in this guide. See the ArcSight

REST FlexConnector Developer’s Guide for details.

Where can I find this guide?

Thanks,

Fabian

[sadingrid]

You can find it on Protect 724 here:

https://protect724.arcsight.com/docs/DOC-3276

It seems search is not currently working for documentation, but you can use the SmartConnector Configuration Guide Official Index.

Ingrid

[hatemware]

Hello Ingrid,

Could you please provide the link to SmartConnector Configuration Guide Official Index?

Rgds, hatem

[sadingrid]

There is no longer a separate PDF document of the index. Go to the following link in Protect 724 and there is an index on that screen into all the connector configuration guides and other connector documentation.

https://protect724.hp.com/community/arcsight/productdocs/connectors

Ingrid

[Samour]

On pages 83 & 88 of the flex dev guide, page 131 should be page 151

[sadingrid]

Thank you for pointing this out. We’ve fixed this, and the updated guide will be available with the upcoming SmartConnector release this month.

Ingrid Sadler

[EricLamer]

Why is there many function that Arcsight use but are not documented or that are unsupported???

Ex: Merge.

The documentation for the flex developpment guide could be way better, not enough info.

[kitdaddio]

Error on page 85 of the FlexConnector dev guide. Where it says:

"For Oracle, use:

jdbc:oracle:thin:@hostname_or_IP:1521:database_name

Change the final colon to a forward slash:

jdbc:oracle:thin:@hostname_or_IP:1521/database_name

By the way, "database_name" could be "database_instance_name".

[kitdaddio]

Hi, did the release occur? Where is the link to it?

Thank you!

Regarding last month's comment: "updated guide will be available with the upcoming SmartConnector release this month"

[sadingrid]

The release is currently being processed and will be available soon. Docs will be uploaded to Protect 724 as soon as the release package is available from HP SSO.

Ingrid

[EricLamer]

Any news on the new release, been over a month?

[jchhabra@arcsig1]

Hello Eric,

The posted guide is the latest. The page number references (pointed by Samer Faour) are updated in this guide. We will look into the feedback Christopher provided above and incorporate it in the next update.

Ingrid's reply above (dated Jan 14, 2014) addresses your query about the merge function:

"Event merging is not an officially supported function, so it will not be documented in the ArcSight FlexConnector Developer’s Guide. For information about this function, you can contact ArcSight Professional Services.

Ingrid"

If you have additional feedback on this doc, please send me an email and I will pass it on to the writer who works on this doc.

Thanks,

Jagdeep Chhabra

Manager, ArcSight Technical Publications

[kitdaddio]

Error on page 84 and 89.

"For Microsoft SQL Server, use: com.sqlserver.jdbc.SQLServerDriver"

No, that should be:

com.microsoft.sqlserver.jdbc.SQLServerDriver

[sadingrid]

Thanks, we’ll make that update.

Ingrid

[hassanvf1]

Hi Christopher,

Both ":" and "/" are correct but based on the how you connect to database .

If it is a RAC and accessible by service name then after the "@" sign it will service Name ,example below.

jdbc:oracle:thin:@service name:1521/database_name

If it is a simple instance then ":" after the port number works with hostname or IP after the "@" sign as in document.

[vip]

Hi, there are a few points unclear in the documentation of agent.properties parameters in this document:

• The multi-folder connectors "foldertable" is not documented (like BlueCoat multifolder): which parameters do apply to foldertables and which ones not ?
• There are inconsistencies in the description of "persistenceinterval"
  • Starting from which connector version is the "new implementation" available ?
  • Old implementation can be used but how ?
• preservestate is described as a property which is written only at connector shutdown but then preservedstateinterval and preservedstatecount would have no meaning
• What are the relations / conflicts between persistenceinterval and preservestate ?