Our vBulletin migration is complete.
Welcome vBulletin users! All content and user information from the Micro Focus Forums (vBulletin) site has been migrated to this site. READ MORE.

Increasing security event scalability and availability with Kafka replication

Security_Guest Frequent Contributor.
Frequent Contributor.
0 0 1,442

Guest post by Viktor Doundakov, Product Manager

Whether it is reduced complexity, greater reliability, operational efficiency, cost savings, scalability, or a wide variety of other competitive differentiators, many of the transformative advantages delivered by Micro Focus ArcSight Data Platform (ADP) are driven by the solution’s designed openness and interoperability. That’s exactly the case in the latest version of ADP, where the Kafka mirroring tool MirrorMaker has been certified to integrate with ArcSight Event Broker. To give you greater scalability, along with high availability and disaster recovery options for your data, MirrorMaker enables you to replicate data between Event Broker clusters or share it with other Kafka systems in the enterprise.

Kafka2.png Now you have the freedom or option to deploy an Event Broker cluster dedicated to data center data collection, and then mirror data as needed to other Event Broker clusters. Depending on your needs, you can replicate all data from an Event Broker cluster or take a granular approach to make only a subset of your data available. Additionally, you have the option to implement a layout where systems and applications consume security data from the local Event Broker installation closest to them. 

With your data events in multiple locations you also increase your level of availability, as well as benefit from it as an added disaster recovery option. For example, if your main Event Broker cluster is not available due to maintenance or an outage, your data isn’t lost since it’s already been replicated to your second Event Broker session and your connectors can be configured to send data to a different Event Broker cluster. Likewise, all of your downstream applications can be switched over to start consuming from the second Event Broker. 

While Kafka MirrorMaker has been tested and certified to work with ADP Event Broker, to take advantage of its replication capability you will need to familiarize yourself with MirrorMaker and implement it yourself in your environments. You can find more information about MirrorMaker in the Kafka documentation or visit the Micro Focus ArcSight community

To learn more about how using Kafka MirrorMaker with your ADP Event Broker clusters can increase your scalability, availability, and disaster recovery options, talk to your ArcSight solution architects or sales representatives, or contact us directly.

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.