CEF Folder Follower

[sahaya]

Hi,

Can anyone help me out on how to create a CEF Folder Follower Connector ?

Thanks,
Sahaya

[sparky1]

Ask support for the CEF parser, then create a folder follower flex connector using the CEF parser.

[sahaya]

Hi,

I tried that as well. but these will not be any regex defined in the cef parser and  hence the flex regex folder follower is not parsing the logs.

Rgds,
Sahaya

[eugene.rostofsk1]

Hi,

Use "ArcSight FlexConnector Multiple Folder File" connector. Configure  the folder of interest or folders, processing mode (batch  or realtime), under configuration file enter "cef_syslog" (provided that support gave you cef_syslog.sdkkeyvaluefilereader.properties file and you put it to current\user\agent\flexagent directory), configuration type - sdkkeyvaluefilereader.

HTH

[bkilroe]

You don't need to request the parser from support.

Configure it exactly as Ihar has said above except under the Configuration File just refer it to the normal parser by entering "cef_syslog/cef_syslog"  and use sdkkeyvaluefilereader configuration type.

If you have configured it correctly you should see a similar entry in the agent.log

[2014-03-23 20:38:59,839][INFO ][default.com.arcsight.agent.pe.g][getInputStream] Resource [cef_syslog/cef_syslog.sdkkeyvaluefilereader.properties] found in [C:\ArcSight\6.0.7.6901.0\current\system\agent\fcp\arcsightagents.aup|cef_syslog/cef_syslog.sdkkeyvaluefilereader.properties.arc]

[sahaya]

Hi,

Thanks for the answer. However, below is what is see

[2014-03-24 11:50:48,879][INFO ][default.com.arcsight.agent.pe.g][getInputStream] Resource [cef_syslog/cef_syslog.sdkkeyvaluefilereader.properties] found in [D:\SIEM_Connectors\multiple files\current\system\agent\fcp\arcsightagents.aup|cef_syslog/cef_syslog.sdkkeyvaluefilereader.properties.arc]

[2014-03-24 11:50:48,879][INFO ][default.com.arcsight.common.config.AgentPropertiesFileConfiguration][loadDefaultProperties] customInitialization() - read default properties from [cef_syslog/cef_syslog.sdkkeyvaluefilereader.properties].

[2014-03-24 11:50:48,895][INFO ][default.com.arcsight.agent.pe.g][getInputStream] Resource [cef_syslog/cef_syslog.sdkkeyvaluefilereader.properties] not found (AUP file ignored)

[thoman]

Select ArcSight FlexConnector Multiple Folder File and click Next.

Enter the device details and click Next.

Parameter	Description
Folder	The absolute path of the directory where log files for the FlexConnector are located. For example: C:\CEF_Folders\
Processing Mode	If the files in the folder are not being written to in real time and are complete, select batch. If the files are open and new log lines are being added to them, select realtime.
Configuration File	The base name of the configuration file that describes the format of the log file. Enter cef_file
Configuration Type	The file is a CEF-format log file, select cef.

[sahaya]

Hi,

the extension part of the CEF file is getting parsed, but not the Header Part.

There is no mapping for the header fields in the parser, however there is a line that says ( Header automatically parsered by CEF Parser)

Please Assist

~Sahaya

[thoman]

Please give us some example of your CEF events.

[sahaya]

Hi,

Sample Logs Below

CEF:0|a.b|hostname|R1|AUTHN_SUCCESS|Authentication successful|1|cs1=abc-ght-098 start=2014-03-20 08:40:11.333 cs2=BR:BRM src=1.2.3.4 cs4=11B6622C-0BB0-E311-A6D1-00505684015B duid=abcdef duser=1hdi5479j cs3=User:q063hjB msg=User:Id:32114,InstanceType:Id:42eed532-0fa4-e311-80c1-00505684015b

CEF:0|a.b|hostname|R1|AUTHN_SUCCESS|Authentication successful|1|cs1=8D2C8A4B-0BB0 start=2014-03-20 08:40:32.528 cs2=ZM:ZMAG1 src=1.6.1.1 cs4=C234BD07-0BB0 duid=BRAHAJ duser=80C1-00505684015B:abc:Braham cs3=User:3D851146-0FA4-E31 msg=User:Id:3d851146,InstanceType:Id:44eed532-0fa4-e311-80c1-00505684015b, Code:LCL

[thoman]

I do not face issue on my lab, can you try using CEF File Connector to read the same file? Please also try the latest connector version.

[sahaya]

Hi,

It works for me now. but i do not get the milli seconds in the time. i doubt that the time stamp itself is not getting parsed