jfrisch Absent Member.
Absent Member.

Rule action to export fields to external SQL ruby on rails database?

Hi everyone,

I am fairly new to ArcSight.  I am trying to figure out the /best/ way to forward field data to a SQL database (within RoR) on a different server when a rule triggers.  So far, I have tried having the action trigger a command on the ESM server which blasts the data over UDP or TCP.  This is not ideal because 1) ArcSight seems to be very finicky about the parameters of the command, and I want this to be easily replicable over a lot of rules, and 2) I want to keep as much programming/scripting as possible on the external server, not on the ESM server.

I'm now examining the idea of a forwarding connector which writes to a CSV file, but I don't want to put a lot of effort into that if there's a better option.

Is there a standard way to do this? 



Labels (2)
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.