Micro Focus ArcSight ESM
This Connector integrates Micro Focus ArcSight ESM's REST API with Swimlane Turbine.
Prerequisites
The ArcSight ESM Asset requires an URL, login and password for authentication. More Information on Authentication can be found here.
Capabilities
The Micro Focus ArcSight ESM Connector has the following capabilities:
- Get Event Data by QueryViewerID
- Get Security Events by IDs
Notes
- More information on ArcSight ESM can be found here
Configurations
Asset
Micro Focus ArcSight ESM Asset
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
login | The login or username for authentication | string | Required |
password | The password for authentication | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Event Data by Query Viewer ID
Retrieve the matrix data identified by the specified resource ID.
Endpoint
- URL: /v1/queryviewers/matrixData/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Event Data by Query Viewer ID action |
Input Example
{"path_parameters":{"id":"7B7wtYzEBABCAGyLqkEdj+g=="}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Security Events by IDs
Retrieve the events specified by the IDs and within specified time limits.
Endpoint
- URL: /detect-api/rest/events/retrieve
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
ids | array | Optional | Unique identifier |
startTime | number | Optional | Time value |
endTime | number | Optional | Time value |
Input Example
{"json_body":{"ids":[10019743],"startTime":1700112949,"endTime":1700120149}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"eventId":10019743,"managerId":-128,"name":"Monitor Event","type":"BASE","startTime":1700122244521,"endTime":1700122244521,"managerReceiptTime":1700122244521,"bytesIn":-2147483648,"bytesOut":-2147483648,"sessionId":-9223372036854776000,"agent":{},"device":{},"concentratorAgents":[],"category":{},"modelConfidence":4}]}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |