Micro Focus ArcSight ESM

this connector integrates micro focus arcsight esm's rest api with swimlane turbine prerequisites the arcsight esm asset requires an url , login and password for authentication more information on authentication can be found https //www microfocus com/documentation/arcsight/arcsight esm 7 6 4/esm servicelayer devguide/content/esm servicelayer devguide/using the loginservice f htm#examples rest 765902027 1137748 capabilities the micro focus arcsight esm connector has the following capabilities get event data by queryviewerid get security events by ids notes more information on arcsight esm can be found https //www microfocus com/documentation/arcsight/arcsight esm 7 6 4/esm servicelayer devguide/#esm servicelayer devguide/using services from mana htm#examples rest 765902027 1160981?tocpath=developing%2520rest%2520clients%257cexamples%253a%2520using%2520the%2520esm%2520services%257cusing%2520services%2520from%2520manager service%257c 5 configurations asset micro focus arcsight esm asset configuration parameters parameter description type required url a url to the target host string required login the login or username for authentication string required password the password for authentication string required verify ssl verify ssl certificate boolean optional http proxy a proxy to route requests through string optional actions get event data by query viewer id retrieve the matrix data identified by the specified resource id endpoint url /v1/queryviewers/matrixdata/{{id}} method get input argument name type required description path parameters id string required parameters for the get event data by query viewer id action input example {"path parameters" {"id" "7b7wtyzebabcagylqkedj+g=="}} output parameter type description status code number http status code of the response reason string response reason phrase output example {"status code" 200,"response headers" {},"reason" "ok","json body" {}} get security events by ids retrieve the events specified by the ids and within specified time limits endpoint url /detect api/rest/events/retrieve method post input argument name type required description ids array optional unique identifier starttime number optional time value endtime number optional time value input example {"json body" {"ids" \[10019743],"starttime" 1700112949,"endtime" 1700120149}} output parameter type description status code number http status code of the response reason string response reason phrase output example {"status code" 200,"response headers" {},"reason" "ok","json body" \[{"eventid" 10019743,"managerid" 128,"name" "monitor event","type" "base","starttime" 1700122244521,"endtime" 1700122244521,"managerreceipttime" 1700122244521,"bytesin" 2147483648,"bytesout" 2147483648,"sessionid" 9223372036854776000,"agent" {},"device" {},"concentratoragents" \[],"category" {},"modelconfidence" 4}]} response headers header description example content type the media type of the resource application/json date the date and time at which the message was originated thu, 01 jan 2024 00 00 00 gmt