Ensign
Ensign
266 views

In which scenario we need to use forwarding connector?


Advantage of forwarding connector

Labels (1)
0 Likes
5 Replies
Fleet Admiral
Fleet Admiral

Kinda need a little more detail than that I am afraid.

A forwarding connector is useful for forwarding log data from either Logger or ESM to a different destination. The usual situations for doing this focus around making sure you can do something with the data received - such as forwarding from Logger to ESM for correlation purposes. Or you can look to forward correlated events from ESM to Logger for long term storage.

There are two different types of forwarder for ESM though - the correlated event forwarder and the standard forwarder. The advantage of using the correlation one is that you get the base events that triggered the correlation in the first place. With the standard forwarder, you just forward the filter matching events only - and if its a correlation event, you don't necessarily get the base events.

There is a discussion around needing the base events when forwarded, but I have always asked customers to consider what they need. For example, if you forward a 'brute force login attempt' correlation, you will have the aggregated data in the event - so the source, username and number of attempts (and hopefully the zone information too). But do you need each of the base events too? You can do the investigation you need based on the source IP and username, so it depends on what you are looking for and why.

Hope this helps.

0 Likes
Ensign
Ensign

Thank you Paul Brettle

0 Likes

Hi Paul,

I read you comment regarding the standard forwarder connector.

I have SC > ESM and Logger. and I need only correlation events to be send to the logger, without the base correlated events.

I have my Fwd User under a Custom User Group with ACL "ArcSight Correlation Events". Is there anything else need to be defined so only the correlation events are being forwarded?

Mustapha
0 Likes
Fleet Admiral
Fleet Admiral

Nope - that should be good. Or you could have a filter applied to only match events that are type = correlated. Either way works though.

0 Likes

I see, could you please point out the difference in term of implementation for the correlated event forwarder and the standard forwarder, or if you have a document reference, as I couldn't find this information in the guide, and the Fwd Connector is sending the based correlated events which I don't want.

Mustapha
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.