ArcSight ESM v2

ArcSight ESM SIEM by Micro Focus (Formerly HPE Software).

Analytics & SIEM · ArcSight ESM

Configuration parameters

server — Server full URL (e.g., https://192.168.0.1:8443) (required)
credentials — Credentials (required)
viewerId — Fetch events as incidents via Query Viewer ID. Mandatory fields for query are "Start Time" and "Event ID".
casesQueryViewerId — Fetch cases as incidents via Query Viewer ID. Mandatory fields for query are "Create Time" and "ID".
max_unique — The maximum number of unique IDs expected to be fetched.
fetch_chunk_size — The maximum number of incidents to fetch each time. Default is 50, maximum is 300.
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
use_rest — Use REST Endpoints
productVersion — Product Version
incidentType — Incident type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

as-add-entries
Adds new entries to the Active List.
as-case-delete
Deletes a case.
as-clear-entries
Deletes all entries in the Active List.
as-delete-entries
Delete entries from the Active List.
as-fetch-incidents
Fetches incidents.
as-get-all-cases
(Deprecated) Retrieves all case resource IDs.
as-get-all-query-viewers
Returns all the query viewer IDs.
as-get-case
Gets information about a single case.
as-get-case-event-ids
Returns all case event IDs.
as-get-entries
Returns all entries in the Active List.
as-get-matrix-data
Retrieves query viewer results (query viewer must be configured to be refreshed every minute, see documentation).
as-get-query-viewer-results
Retrieves query viewer results (query viewer must be configured to be refreshed every minute, see documentation).
as-get-security-events
Returns the security event details.
as-update-case
Updates a specific case.