Highlighted
Regular Contributor.
Regular Contributor.
744 views

Importing HP UBA Integration arb package is failing on AE 4.0

Jump to solution

Hello Experts,

Facing issue while importing  "HP_UBA_Privileged_Account_Violations_1.0.arb" package to Arcsight Express 4.0.

Its failed with the following error:

"import failed , invalid archive , element type  : casesensitivetype , must be declared"

I could not find any related information on the above package. Is this package supported?

Please confirm.

Thanks & Regards

Smita

Labels (2)
0 Likes
1 Solution

Accepted Solutions
Highlighted
Honored Contributor.
Honored Contributor.

Hey

Unfortunately, we are not supporting AE 4.0 for Activate. It is just slightly older than ESM v6.5c, and we are no longer supporting that version, either. There are some bug fixes, etc., in ESM v6.8c that are now required, and there's just no way they can reasonably be back-ported to the much older systems. For more information, please see . I'm afraid the best solution is to upgrade to ESM Express (v6.9.0).

It is possible to try to hack the XML for the package to remove the "casesensitivetype" attribute, but it is not recommended. It may work for a while, but it won't be very long before there will be necessary features (fields/variables, rules, etc.), that Activate content uses but which is not available on older versions of ESM.

Hope this helps,

--

Prentice

View solution in original post

0 Likes
7 Replies
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

The package you are importing is built on a later version of ESM, ArcSight Express 4.0 doesn't support the case sensitive flag on Active Lists.

0 Likes
Highlighted
Regular Contributor.
Regular Contributor.

Thanks Richard for the confirmation.

0 Likes
Highlighted
Absent Member.
Absent Member.

Smita,

Greetings!  One additional note - once imported (or built), the content is a starter pack to show an example of UBA data within ESM (or Express), with an Active Channel, filter, field set, and dashboard for the following policy violations.

I'm happy to assist you with additional info for Express if you'd like to set up an Active Channel, for example, to view UBA data.

If you could share some additional info regarding your deployment (POC, Production, etc.), I can get you the detail you need.

Thank you!

-MacGyver

0 Likes
Highlighted
Regular Contributor.
Regular Contributor.

Hello Carman,

Thank you very much.

In my case the import is failing with the error "import failed , invalid archive , element type  : casesensitivetype , must be declared"

Is there any version  of this ARB Package available for AE 4.0 ?

Thanks & Regards

Smita

0 Likes
Highlighted
Honored Contributor.
Honored Contributor.

Hey

Unfortunately, we are not supporting AE 4.0 for Activate. It is just slightly older than ESM v6.5c, and we are no longer supporting that version, either. There are some bug fixes, etc., in ESM v6.8c that are now required, and there's just no way they can reasonably be back-ported to the much older systems. For more information, please see . I'm afraid the best solution is to upgrade to ESM Express (v6.9.0).

It is possible to try to hack the XML for the package to remove the "casesensitivetype" attribute, but it is not recommended. It may work for a while, but it won't be very long before there will be necessary features (fields/variables, rules, etc.), that Activate content uses but which is not available on older versions of ESM.

Hope this helps,

--

Prentice

View solution in original post

0 Likes
Highlighted
Regular Contributor.
Regular Contributor.

Hello Prentice,

Thank you very much for your response.

Regards

Smita

0 Likes
Highlighted
Honored Contributor.. Honored Contributor..
Honored Contributor..

On windows: rename arb to zip, extract,  edit xml with wordpad, find caseSensitive, delete those complete lines, save xml. Then select both the xml and META dir, add to zip. Rename zip to package.arb, import in ArcSight.    

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.