---
title: Micro Focus ArcSight ESM
slug: connectors/micro-focus-arcsight-esm
docTags: 
createdAt: 2026-06-09T16:29:33.140Z
---

This Connector integrates Micro Focus ArcSight ESM's REST API with Swimlane Turbine.

## Prerequisites

The ArcSight ESM Asset requires an `URL`, `login` and `password` for authentication.
More Information on Authentication can be found [here](https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.6.4/ESM_ServiceLayer_DevGuide/Content/ESM_ServiceLayer_DevGuide/Using_the_LoginService_f.htm#examples_rest_765902027_1137748).

## Capabilities

The Micro Focus ArcSight ESM Connector has the following capabilities:

- Get Event Data by QueryViewerID
- Get Security Events by IDs

## Notes

- More information on ArcSight ESM can be found [here](https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.6.4/ESM_ServiceLayer_DevGuide/#ESM_ServiceLayer_DevGuide/Using_Services_from_mana.htm#examples_rest_765902027_1160981?TocPath=Developing%2520REST%2520Clients%257CExamples%253A%2520Using%2520the%2520ESM%2520Services%257CUsing%2520Services%2520from%2520manager-service%257C_____5)

# Configurations

## Asset

Micro Focus ArcSight ESM Asset

### Configuration Parameters

| **Parameter** | **Description**                          | **Type** | **Required** |
| ------------- | ---------------------------------------- | -------- | ------------ |
| url           | A URL to the target host.                | string   | Required     |
| login         | The login or username for authentication | string   | Required     |
| password      | The password for authentication          | string   | Required     |
| verify\_ssl   | Verify SSL certificate                   | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through.       | string   | Optional     |

# Actions

## Get Event Data by Query Viewer ID

Retrieve the matrix data identified by the specified resource ID.

### Endpoint

- **URL:** `/v1/queryviewers/matrixData/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                             |
| -------------------- | -------- | ------------ | ----------------------------------------------------------- |
| `path_parameters.id` | string   | Required     | Parameters for the Get Event Data by Query Viewer ID action |

### Input Example

`{"path_parameters":{"id":"7B7wtYzEBABCAGyLqkEdj+g=="}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}`

## Get Security Events by IDs

Retrieve the events specified by the IDs and within specified time limits.

### Endpoint

- **URL:** `/detect-api/rest/events/retrieve`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**   |
| ----------------- | -------- | ------------ | ----------------- |
| `ids`             | array    | Optional     | Unique identifier |
| `startTime`       | number   | Optional     | Time value        |
| `endTime`         | number   | Optional     | Time value        |

### Input Example

`{"json_body":{"ids":[10019743],"startTime":1700112949,"endTime":1700120149}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"eventId":10019743,"managerId":-128,"name":"Monitor Event","type":"BASE","startTime":1700122244521,"endTime":1700122244521,"managerReceiptTime":1700122244521,"bytesIn":-2147483648,"bytesOut":-2147483648,"sessionId":-9223372036854776000,"agent":{},"device":{},"concentratorAgents":[],"category":{},"modelConfidence":4}]}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |