Absent Member.
Absent Member.
14185 views

Device Status Monitoring Pack

Hey guys,

Appreciate that there are some threads that talk about Device Status Monitoring (DSM), but we have released a content pack to help you get started in ensuring that you always get your event logs. This is aimed more at people that are new to ArcSight and just getting started, as I'm sure that the more seasoned of you will already have something setup.

General Description

The success of any SIEM system relies on receiving events from the respective in scope source devices and servers. Without any events, the SIEM platform effectively becomes useless. Part of setting up a good SIEM system is creating mechanisms to ensure that these events are received and the most effective approach to do this is by using the Device Status Monitoring (DSM) capability built-in to the ArcSight platform.

This content pack utilises the DSM capability to track and alert on any event sources that stop sending events, so that you can take the appropriate action to re-establish the event flow. The pack also contains mechanisms to detect servers/devices that have potentially been removed from the network.

Other Information

+ Attached is the user guide, and the complete pack is available from our website http://www.edgeseven.com/resources.html.

+ This also ties into our blog (http://totalsiem.blogspot.com), where we are currently discussing the "Golden Rules of SIEM"

Hope you all find this useful ... please do provide feedback 😉

Labels (2)
Tags (3)
137 Replies
Absent Member.
Absent Member.

Hi Andrew,

Chances are that you are using an older version of ESM ... more than likely 4.5. We developed the pack on v5sp2, and should really only be used on a system with the same version, although it should work on all v5 systems.

0 Likes
Captain
Captain

Hi Hark,

Are you still providing the Device_Status_Monitoring pack for ArcSight freely?

Thank you

Regards,

Lemington

0 Likes
Absent Member.
Absent Member.

Yes we are ... only if you are an end user. Please could you message me your work email address.

0 Likes
Captain
Captain

Hi Mark,

That is very good!

Customer's mail address is ksu.lee@samsung.com

Please provide your package to the customer.

Thank you!

Regards,

Jungsoo

0 Likes
Absent Member.
Absent Member.

Hi Mark,

Can you kindly share with me the link to download the Package (Device Status Monitoring Content Pack v1.0.0.0.arb).

Thank you.

Regards,

Kayode


0 Likes
Absent Member.
Absent Member.

Good work Mark.

I am also looking for this package. Email ID is vivekatt@hcl.com

Please help.

Regards

Vivek

0 Likes
Absent Member.
Absent Member.

Hi Mark,

Can you please send me the package.

Email: carlos.alcocer@digitalsecurity.com.ec

Thnks!

0 Likes
Lieutenant Commander
Lieutenant Commander

Hi Mark,

Can you kindly share the package? Thanks.

email address is ken.lee@e-guardian.net

0 Likes
Commodore
Commodore

Hi, @sparky1

Does it works with ESM 6.9.1.2195 for device status monitoring.
And where I can find it the package.
--
Regards,
Aarush J
+91-6265258612

AJ
0 Likes

where is the pack? I searched for it but just display ads

0 Likes
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

Hi Mark,
Have you been using this for a while?  Have you had any issues with device status monitoring simply not functioning (even though configured)?

We have noticed this issue particularly with all the Windows Unified Connectors, but also with one of our syslog connectors.

ArcSight support is, as usual, at a loss - I am curious if we are the only user whos connectors stop sending the device status monitoring.

Typically if the DSM events stop sending, they will repair themselves (without any intervention) and continue sending within 1-2 hours at the most (event data functions .

Good guide and useful content in your blog!  It is odd that ArcSight doesnt include something like this as canned content

Also FYI: there was also another presentation that is extremely useful in this area given by Harry Halladay and Wells Fargo at the protect conference this year.  It allows you to set multiple 'outage' criteria (such as timeout, warning, critical, and more), with individual settings per event feed, in a single active list.  We have tweaked it quite a bit to remove some extra content that wasn't necessary to us and plan to rebuild all the static DSM we have using the method listed in their doc.  You can easily use the DSM events you mention instead of the CRES events they list.

https://protect724.arcsight.com/docs/DOC-1947

We also monitor and test a number of the 'key' functions of our SIEM to ensure they are functioning.  We have to insert specific event types at regular intervals to do this, which can be accomplished via signature products (IDS/AV), or inserting raw syslog events into a syslog connector, or creating your own flex connector...

We test and are notified of issues regarding:
Cases (hourly - via inserted events and a rule)
Notifications (hourly- via inserted events and a rule)
Active lists (hourly- via inserted events and a rule)
Rules (hourly- via inserted events and a rule)

Trend runs (hourly)

Reports (daily)

Sometimes one of those functions (most commonly for us - reports and notifications and periodically cases) will cease to function and you wouldn't know unless you were testing it intentionally.

Absent Member.
Absent Member.

Hey Ray,

Many thanks for yours and everyone else's feedback ... its really appreciated.

We've been using DSM since it was first introduced as a connector feature.

Yes, we've seen something similar ... however mostly in the older versions of the connector (pre version 5) ... and specifically around the WUC connector. Never managed to find a resolution, but a restart of the connector fixed it in most instances.

We'll certainly look into Harry's presentation.

We are also working on an updated version, that is more advanced at determining whether or not the device has actually stopped sending events.

Cheers

Mark

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.