ArcSight Logger

ArcSight events logger.

Analytics & SIEM · ArcSight Logger

Configuration parameters

  • url — Server URL (e.g. https://192.168.0.1)* (required)
  • port — Port (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • eventsQuery — Events query
  • fields — Fields
  • aggregate — Aggregate events into one incident
  • fetchlimit — Fetch limit
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • credentials — Credentials

Commands (7)

  • as-close

    Stops the execution of the search and clears the search session data from the server.

  • as-drilldown

    Narrows-down the search results to the specified time range

  • as-events

    Returns the list of events found in the specified search.

  • as-search

    In opposite to as-search-events, as-search-events waits until the search query is complete and returns the events, as-search initiates new logger search query, and returns sessionId and searchSessionId which should be used in other commands like as-status, as-stop, as-events, etc.

  • as-search-events

    Start a new search, wait until the search status is complete and then return the events. This command combine 3 commands - as-search, as-status, as-events

  • as-status

    Returns the latest status of the specified search.

  • as-stop

    Stops the search operation but keeps the search session so that the search results can be narrowed down later