Hey guys,
Appreciate that there are some threads that talk about Device Status Monitoring (DSM), but we have released a content pack to help you get started in ensuring that you always get your event logs. This is aimed more at people that are new to ArcSight and just getting started, as I'm sure that the more seasoned of you will already have something setup.
General Description
The success of any SIEM system relies on receiving events from the respective in scope source devices and servers. Without any events, the SIEM platform effectively becomes useless. Part of setting up a good SIEM system is creating mechanisms to ensure that these events are received and the most effective approach to do this is by using the Device Status Monitoring (DSM) capability built-in to the ArcSight platform.
This content pack utilises the DSM capability to track and alert on any event sources that stop sending events, so that you can take the appropriate action to re-establish the event flow. The pack also contains mechanisms to detect servers/devices that have potentially been removed from the network.
Other Information
+ Attached is the user guide, and the complete pack is available from our website http://www.edgeseven.com/resources.html.
+ This also ties into our blog (http://totalsiem.blogspot.com), where we are currently discussing the "Golden Rules of SIEM"
Hope you all find this useful ... please do provide feedback 😉
