Highlighted
Absent Member.
Absent Member.
230 views

Is there an automated way, to create a list of all the content currently in Arcsight

I am attempting to create a list of all the content currently listed in ArcSight, is it at all possible to export the arb file and create a readable list

Tags (1)
0 Likes
5 Replies
Highlighted
Fleet Admiral
Fleet Admiral

Hi Lee,

You can export all as a package.

Cheers

Gayan

Mr
0 Likes
Highlighted
Absent Member.
Absent Member.

Hi Gayan

I know you can export as a package which will produce an arb file .. I was just wondering if there was a way to get the package into a list or csv

cheers

0 Likes
Highlighted
Micro Focus Expert
Micro Focus Expert

I've done this in a manual way by right-clicking the ARB and viewing all the resources. This brings up all the resources in the Viewer panel. From here I select all and copy paste. From here, I did some manual work with importing it in to Excel and then do some formatting. This is not automated, but something I have done to see build an Excel spreadsheet to have a list of all the default content. Perhaps you've tried this already. I'm sure there's an easier way...

0 Likes
Highlighted
Fleet Admiral
Fleet Admiral

Hi Lee,

I guess you can achieve this through API. But you may need to do some home work for that

Cheers

Gayan

Mr
0 Likes
Highlighted
Commodore
Commodore

Hi Lee,

I once ran into a similar problem when I tried to retreive the email addresses from ArcSight users on my ESM. I ended up with a bash script running on the ESM that queries the system table DB. For your purposes your query could look like this:

/opt/arcsight/logger/current/arcsight/bin/mysql -u arcsight -B -e "SELECT arc_resource.id AS Resource_ID,arc_resource_ref.uri AS Resource_URI FROM arcsight.arc_resource, arcsight.arc_resource_ref WHERE arc_resource.id = arc_resource_ref.id AND arc_resource_ref.uri RLIKE 'All Filters|All Rules|All Queries';" > /target/path/for/output/list.txt

This would give you a file with resource ID and complete resource URI. Using RLIKE you can specifiy the types of resources you wish to see listed based on the top folder name, separated by '|'. Without this every resource will end up in the output file, including resources that don't show up in the Console, i.e. Database Table Schemas or Instruments.

Note that I don't specify the password for the DB user. Instead, the user has its own my.cnf with the password specified in it so there will be no prompting for a password. This way the script can run automatically using a CRON job.

Cheers

Christian

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.