It was very hard to find this documentation which is a MUST ! Could you please add the tags event and categorization ? It is said in the "6.0c ESM Console UserGuide" that you have to come to the forum and search for "ArcSight Event Categorization" to find this document, but it does not work because the correct tags are not in place. The PDF document should probably also be renamed to "ArcSight Categorization White Paper.pdf" (with spaces) so that it appears at the top of the search.
Can you confirm this is still the correct location?
There is a 'user/agent/acp/categorizer' directory, but no content, nor a categorization directory on the 6.0.7 connector.
That path is actually incorrect. It should be user/agent/acp/categorizer. I will have that updated. This directory is where you put a categorization file if you want to override the one that comes with the connector. Unless you have some categorization you want to override, it will be empty.
Please let me know if this did not answer your question or if you have other.
Also, next release, can you also make sure you remove words like "Confidential" from the headers, if indeed it will be posted publicly on Protect (and hence not really Confidential)?