Commander
Commander
1119 views

Arcsight integration with uCMDB

Jump to solution

Hi guys,

We are buying uCMDB to be integrated with HPSM solution here. I want to know if ArcSight be integrated with HP uCMDB to utilize additional CI information to enrich events and alerts with CI information pulled from HP uCMDB.

I was just browsing through and found it can be done using HP enterprise view. But wanted to know if this can be done w/o purchasing enterprise view.

Labels (1)
0 Likes
1 Solution

Accepted Solutions
Commander
Commander

Hi,

Got a reply from arcsight support that its not supported as of now. This clears everything

View solution in original post

0 Likes
10 Replies
Commander
Commander

Hi,

Got a reply from arcsight support that its not supported as of now. This clears everything

View solution in original post

0 Likes
Fleet Admiral
Fleet Admiral

Hi Ramesh,

With ArcSight, "unsupported" is hardly as final as it sounds. We have an asset import connector that reads CSV files. If you get your uCMDB data exported to CSV (there are multiple ways to do that), you can get the assets to ArcSight.

~ Ofer

0 Likes
Commander
Commander

Hi Ofer,

We have already imported the asset lists and we have enabled auto asset feature which is also populating new assets. The McAfee Vulnerability manager is also giving additional data of open ports and vulnerabilities on each asset.

The uCMDB goes one step forward on identifying the installed applications, patches and also how one service is related to another and so on. Our management wanted to know if we can use these info from uCMDB to enrich the alerting of arcsight.

0 Likes
Captain
Captain

We also are seriously considering uCMDB but I fear the amount of work to do the integration.  A specialized uCMDB connector that would perhaps make a connection to the uCMDB API or sql tables would make it very easy to integrate.  I would rather not create and support custom scripts to support an HP to HP product integration like this.  Adding support for that connector to map uCMDP asset values to custom categories for apps/patches/service relations would be very beneficial too.  Let me know if you open up an HP feature request, I'll gladly tag our name to it.

0 Likes
Fleet Admiral
Fleet Admiral

I understand. My method was suggested specifically for importing uCMDB information to ArcSight.

0 Likes
Fleet Admiral
Fleet Admiral

We are considering such a connector. Instead of a feature request, I can use the names of the customers who are interested. Feel free to send directly to me at ofr@hp.com.

In addition I can use your input:

  • Mapping uCMDB CIs to ArcSight assets requires some conversion and I would love to know if you thought a bit about this conversion and can provide requirements for it.
  • What specific properties are you interested in getting to ArcSight and in what use cases would use them?
0 Likes
Absent Member.
Absent Member.

Ofer, did the referenced SmartConnector end up getting any traction? Is this still on the cards?

Apologies for the necro - I couldn't find any information in a search that didn't reference a separate product.

0 Likes
Fleet Admiral
Fleet Admiral

Nope. I your need a SmartConnector to receive uCMDB events or an asset model connector to populate the ESM asset model?

0 Likes
Absent Member.
Absent Member.

Thanks for the reply, Ofer. Currently we have a need to utilise the data within uCMDB to populate and enrich the ESM Asset Model.

0 Likes
Commodore Commodore
Commodore

Adam,

Take a look at Effectual Systems... http://effectualsystems.com/clp-hp-monitoring-integrations-to-ucmdb/

In a recent presentation, they showed that they now provide a partial solution for getting Arcsight into uCMDB.  Effectual Systems specialize more on the uCMDB side (so no deep knowledge of Arcsight) but they developed at least half of an integration from uCMDB to Arcsight.

Essentially, they export uCMDB info for the Arcsight Asset model to a DB table and then a person with Arcsight expertise created the asset model connector.

Hope this helps.

Carl

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.