We are buying uCMDB to be integrated with HPSM solution here. I want to know if ArcSight be integrated with HP uCMDB to utilize additional CI information to enrich events and alerts with CI information pulled from HP uCMDB.
I was just browsing through and found it can be done using HP enterprise view. But wanted to know if this can be done w/o purchasing enterprise view.
With ArcSight, "unsupported" is hardly as final as it sounds. We have an asset import connector that reads CSV files. If you get your uCMDB data exported to CSV (there are multiple ways to do that), you can get the assets to ArcSight.
We have already imported the asset lists and we have enabled auto asset feature which is also populating new assets. The McAfee Vulnerability manager is also giving additional data of open ports and vulnerabilities on each asset.
The uCMDB goes one step forward on identifying the installed applications, patches and also how one service is related to another and so on. Our management wanted to know if we can use these info from uCMDB to enrich the alerting of arcsight.
We also are seriously considering uCMDB but I fear the amount of work to do the integration. A specialized uCMDB connector that would perhaps make a connection to the uCMDB API or sql tables would make it very easy to integrate. I would rather not create and support custom scripts to support an HP to HP product integration like this. Adding support for that connector to map uCMDP asset values to custom categories for apps/patches/service relations would be very beneficial too. Let me know if you open up an HP feature request, I'll gladly tag our name to it.
We are considering such a connector. Instead of a feature request, I can use the names of the customers who are interested. Feel free to send directly to me at email@example.com.
In addition I can use your input:
- Mapping uCMDB CIs to ArcSight assets requires some conversion and I would love to know if you thought a bit about this conversion and can provide requirements for it.
- What specific properties are you interested in getting to ArcSight and in what use cases would use them?
Ofer, did the referenced SmartConnector end up getting any traction? Is this still on the cards?
Apologies for the necro - I couldn't find any information in a search that didn't reference a separate product.
Take a look at Effectual Systems... http://effectualsystems.com/clp-hp-monitoring-integrations-to-ucmdb/
In a recent presentation, they showed that they now provide a partial solution for getting Arcsight into uCMDB. Effectual Systems specialize more on the uCMDB side (so no deep knowledge of Arcsight) but they developed at least half of an integration from uCMDB to Arcsight.
Essentially, they export uCMDB info for the Arcsight Asset model to a DB table and then a person with Arcsight expertise created the asset model connector.
Hope this helps.