Highlighted
aritra Absent Member.
Absent Member.
338 views

Connectors in ArcSight Express

Jump to solution

In ArcSight Express (appliance), we have 4 on-board connectors and the feasibility to integrate 4 remote connectors as well, arriving at a total of 8 connectors. However, if I wish to integrate more than 8 connectors, would I face any issue (licensing or otherwise) in doing so, or would I be not able to register the connector at all?

Thanks!

Aritra Gautam

Labels (3)
0 Likes
1 Solution

Accepted Solutions
shezaf1 Acclaimed Contributor.
Acclaimed Contributor.

Re: Connectors in ArcSight Express

Jump to solution
  • The remote connectors license is for managing remote connectors using the integrated connector management feature. You can use and register any number of connectors from licensing perspective.

  • There is a licensing limit on the number of devices for which events are collected and total EPS (events per second). This would impose a practical limit on the number of connectors you can use from licensing perspective. Note though that connectors and devices do not map 1 to 1 as several connectors may report for a single server and vice versa:
    • Windows and an AV on the same server still count as 1 device.
    • On the other hand a single connector can easily report on a large number of devices - syslog would be a good example.
0 Likes
3 Replies
shezaf1 Acclaimed Contributor.
Acclaimed Contributor.

Re: Connectors in ArcSight Express

Jump to solution
  • The remote connectors license is for managing remote connectors using the integrated connector management feature. You can use and register any number of connectors from licensing perspective.

  • There is a licensing limit on the number of devices for which events are collected and total EPS (events per second). This would impose a practical limit on the number of connectors you can use from licensing perspective. Note though that connectors and devices do not map 1 to 1 as several connectors may report for a single server and vice versa:
    • Windows and an AV on the same server still count as 1 device.
    • On the other hand a single connector can easily report on a large number of devices - syslog would be a good example.
0 Likes
aritra Absent Member.
Absent Member.

Re: Connectors in ArcSight Express

Jump to solution

Thanks Ofer,

This information was really helpful! So from my understanding, the remaining connectors can be registered and managed locally as well as on ESM via ArcSight console, but not from the ArcSight connector management software.

0 Likes
shezaf1 Acclaimed Contributor.
Acclaimed Contributor.

Re: Connectors in ArcSight Express

Jump to solution

You understand correctly.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.