Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Highlighted
shezaf1 Acclaimed Contributor.
Acclaimed Contributor.
15130 views

ArcSight connectors master index: Smart, CEF, Flex and more

This document contains information on which source devices can send events to ArcSight and how. You will find here pointers to information on ArcSight supported devices, partner provided connectivity solutions and community contributed technology. In addition, the document includes guidelines, best practices and tips & tricks on configuring and connecting source devices.

ArcSight supported devices

3rd party connectors and parsers

This section contains information helpful in connecting to sources not supported by ArcSight:

  • Flex: Contributed flex connectors and parsers
  • Event collection systems that interface with ArcSight
  • CEF: CEF compatible products not certified and therefore not listed above.
  • Configuration: Tips and trick for configuring and using connectors and sources, usually applies to ArcSight native smart connectors, in which case this information should be used in conjunction with the official documentation for those smart connectors.
  • Event info: Information above events from the source.
  • Apps: Device specific content packs.

CEF, Configuration, Event Info and Apps are used to clearly tag entries based on their type. Commercial solutions are tagged as "(Commercial)".

Security systems

Gateway security

Intrusion Prevention Systems (IPS)

Web Application Firewalls

Authentication, Identity and Access management

End point security

Data center security

  • (CEF) Trend Micro Deep Security - instruction and mapping can be found in the admin guide. Search for "Syslog Integration (SIEM)".

Scanners

Other

Threat Intelligence

Operating systems & system utilities

Cloud and virtualization

  • (Syslog, Partial implementation)
  • AWS - ArcSight has an out of the box AWS CloudTrail connector.
  • LogStash, HP Helion and OpenStack
  • (CEF) HyTrust Cloud Control (see admin guide) - an hypervisor security system.
  • (Configuration) - guidelines augmenting the SmartConnector manual on how to configure Box.com to enable connection
  • Microsoft Azure log Integrator​ and Installation instructions  ​- the integrator collects logs from various Azure sources and creates JSON files. Microsoft provides the flex connector to read those.

Networking and web

Databases

Applications

  • Office365
  • Exchange Mailbox Events audit data
  • (Commercial) AgileSI (SAP) - AgileSI is is a complete security solution for SAP based on ArcSight which includes a comprehensive SAP event collection technology.
  • (Commercial) Logbinder SP (Sharepoint)
  • (Commercial) Logbinder EX (Exchange)
  • (Commercial, CEF) FairWarning - connects ArcSight with many different HealthCare applications including AllScripts, Cerner, EPIC, GE HealthCare & Siemens:
    • Full list of FairWarning supported applications available here
    • - A Protect conference customer use case of using FairWarning with ArcSight

Additional information about CEF integrations and Smart Connectors

Other (non event source) integrations

This section will evolve into a separate resource over time. for now the information is collected here

  • - a script for use as a rule action providing an alternative to ESM built-in notifications allowing additional flexibility.

If a device or the version of the device is not supported?

Support for minor versions not specifically listed in the manual

If a minor version is not explicitly called out in the manual it may still be supported. specifically, apart from minor exceptions, the following generally holds:

  • A version is supported if in between two tested and documented versions.
  • A minor/minor version (i.e. x.y.z) is supported if the minor version (x.y) or a similar minor/minor version (x.y.w) was tested and documented.

Alternatives

  • Create a parser override or a flex connector. Those can be created by the anyone. Refer to the for details
  • Parser overrides may require getting an the original obfuscated parser. HPE is providing those parsers to customers who request them on a need basis. Contact support to request one.

Creating a smart connector feature request

If HPE down not support a device or a device version that you use, they recommend that you file a feature request to help prioritize the needed update. Support will ask you to collect many details and even ask for a log file sample.

Python malware intelligence feed for ArcSight ESM

29 Replies
balahasan.v1 Acclaimed Contributor.
Acclaimed Contributor.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Great Collection. Thanks Ofer for putting it together. It would be really great if this blog gets updated regularly with the new releases.

0 Likes
shezaf1 Acclaimed Contributor.
Acclaimed Contributor.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

It will, but note that the actual lists, sans contributed and 3rd party, are not on this page.

A good opportunity to call for anyone who wants to add a link to a contributed flex or a 3rd party product to drop me a note (or comment to this document).

~ Ofer

0 Likes
Jurgen
Visitor.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Hi Ofer,

Great and useful list! very appreciated!

You can add the  RedSocks Malware Detector to the list.

Kind regards,

Jurgen

0 Likes
shezaf1 Acclaimed Contributor.
Acclaimed Contributor.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Done.

0 Likes
Established Member.. sbotharaj
Established Member..

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Very useful list.  I have recommended my team make use the most of it.

Thank you for updating:

0 Likes
rkent1 Acclaimed Contributor.
Acclaimed Contributor.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Hi Ofer,

I think Guardium (now IBM InfoSphere Guardium) can be added to this list. The product can generate CEF formatted events ->

Newer IBM InfoSphere Documentation (version 9.1 - 2014) that still indicates they generate CEF (page 398).

0 Likes
shezaf1 Acclaimed Contributor.
Acclaimed Contributor.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Richard,

I don't list here all the certified CEF partners. You can find a link to the list of those at the first section of the document. the "CEF compatible but not certified" section lists only those vendors that are not included in the formal list above.

0 Likes
akshay Absent Member.
Absent Member.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

well documented

0 Likes
pganguly1 Absent Member.
Absent Member.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Can you please help me to get a connector for Skybox ( Vulnerability Assessment tool )

0 Likes
mschleich Acclaimed Contributor.
Acclaimed Contributor.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Dear Ofer,

Great work very interesting!

To update it, I would add that Snare Epilog may be used on Linux hosts (we currently use it) to send logs to an ArcSight Syslog Connector.

Solution useful when System Admin do not want to use the default syslog on the host for different reasons or when there are many different custom logs which need a unique parser each and also when the arcsight connector (Java) is too heavy to be installed directly on the host.

FireEye Appliances used CEF (easy ArcSight Integration)

Thanks

Regards

Michael

0 Likes
Established Member.. anwarrhce1
Established Member..

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Perfectly done !! I remember i raised couple of threads regarding this issue of not having a central place where people can find what can be integrated. Glad to see the response from HP. Thanks.

0 Likes
pganguly1 Absent Member.
Absent Member.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

can any one help me to get Skybox connector

0 Likes
shezaf1 Acclaimed Contributor.
Acclaimed Contributor.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Pradeep,

You may want to ask that on the main ArcSight discussion forum;

~ Ofer

0 Likes
shezaf1 Acclaimed Contributor.
Acclaimed Contributor.

Re: ArcSight connectors master index: Smart, CEF, Flex and more

Thanks! Added yours to the list.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.