Details
| ID | ArcSight Logger |
|---|---|
| Provider | OpenText |
| Category | Analytics & SIEM |
| From Version | 5.0.0 |
| Supported Modules | Agentix XSIAM |
README
ArcSight Logger delivers a universal log management solution that unifies searching, reporting, alerting, and analysis across any type of enterprise machine data.
The Cortex XSOAR-ArcSight Logger integration allows you to run a search session, refine or limit the search and retrieve a list of events detected in the search.
To set up Arcsight Logger to work with Cortex XSOAR:
- Make sure you have the Arcsight Logger server url.
- Make sure you have credentials for Arcsight Logger.
To set up the integration on Cortex XSOAR:
- Go to ‘Settings > Integrations > Servers & Services’
- Locate ‘ArcSight Logger’ by searching for it using the search box on the top of the page.
- Click ‘Add instance’ to create and configure a new integration. You should configure the following settings:
Name: A textual name for the integration instance.
Server URL and Port: The API server URL and port number.
Credentials and Password: User and password used to access ArcSight Logger.
Import events as incidents - Mark to automatically create Cortex XSOAR incidents from ArcSight Logger events.
Incident type: Choose the incident type from the drop-down list. This incident type will be triggered when an event is received from the integration.
Events query - The events query received from the integration.Do not validate server certificate (insecure) - Select to avoid server certification validation. You may want to do this in case Cortex XSOAR cannot validate the integration server certificate (due to missing CA certificate).Use system proxy settings: Select whether to communicate via the system proxy server or not.
Cortex XSOAR engine: If relevant, select the engine that acts as a proxy to the server.
Engines are used when you need to access a remote network segments and there are network devices such as proxies, firewalls, etc. that prevent the Cortex XSOAR server from accessing the remote networks.
For more information on Cortex XSOAR engines see:
Cortex XSOAR 6.13 - Engines
Cortex XSOAR 8 Cloud- Engines
Cortex XSOAR 8.7 On-prem - Engines
Require users to enter additional password: Select whether you’d like an additional step where users are required to authenticate themselves with a password. - Press the ‘Test’ button to validate connection.
- After completing the test successfully, press the ‘Done’ button.
Fetched incidents data:
The integration imports events as incidents. All events from 24 hours prior to the instance configuration and up to the current time will be fetched.
Top Use-case:
Arcsight Logger integration can be used to run a search session, refine or limit the search, and retrieve a list of events detected in the search.
This can be achieved in two possible ways:
- Use ‘as-search-events’ for the complete flow of the use case to be executed.
‘as-search-events’ starts a new search session, waits until the search status is complete or reaches the required number of hits, and then returns the list of detected events.
- Alternatively, the explicit commands can be used to ‘breakdown’ the search-events process. A possible flow of commands can be:
- Use ‘as-search’ to start a new search session and receive the session ID and search session ID to be used in the following commands.
- Use ‘as-drilldown’ to narrow-down the search results to the specified time range.
- Use ‘as-status’ to inquire if the search session is complete or still running, view the number of scanned events and hits.
- Use ‘as-events’ to get a list of all events detected in the search.
- Use ‘as-close’ to stop the execution of the search and clear the session data from the server.
Commands:
- as-search-events
Input:
|
query, discover_fields, endTime, startTime, summary_fields, field_summary, local_search, timeout, lastDays, offset, length, dir, fields for example:
Find more query examples at wikis/ArcsightLogger. |
Context output (example):
|
{ "ArcSightLogger": { "Events": [ { "destinationAddress": ##.##.##.##, "agentSeverity": "1", "Version": "0", "Logger": "Local", "ReceiptTime": 1513249919185, "deviceCustomNumber1Label": "Percent Usage", "deviceCustomNumber1": 2, "deviceAddress": ##.##.##.##, "deviceCustomString2Label": "timeframe", "deviceVendor": "ArcSight", "Device": "Logger", "deviceProduct": "Logger", "EventTime": 1513249440017, "baseEventCount": 1, "deviceReceiptTime": 1513249440017, "startTime": 1513249440017, "deviceEventClassId": "cpu:100", "deviceCustomString2": "CurrentValue", "name": "CPU Usage", "deviceEventCategory": "/Monitor/CPU/Usage", "rowId": "347259-26@Local", "endTime": 1513249440017, "deviceVersion": "6.2.0.7633.0" }, … ] } } |
Raw output (example):
|
[ { Device:Logger EventTime:1513249693332 Logger:Local ReceiptTime:1513249693838 Version:0 agentSeverity:3 baseEventCount:1 cn1label:Session destinationAddress: ##.##.##.##, destinationUserId:1 destinationUserName:admin deviceCustomNumber1: 741618068 deviceEventCategory:/Platform/Authentication/Login deviceEventClassId:platform:230 deviceProduct:Logger deviceVendor:ArcSight deviceVersion:L7633 name:Successful login rowId:347186-0@Local sourceAddress: ##.##.##.##, }, … ]
|
- as-search
Input:
|
query, discover_fields, endTime, startTime, summary_fields, field_summary, local_search, timeout, lastDays for example:
Find more query examples at wikis/ArcsightLogger. |
Context output (example):
|
{ "ArcSightLogger": { "Search": { "SearchSessionId": 1513260595933, "SessionId": "3dxITLyDE9FyRiflQD7UFG_hSsUPq4uCTM4B6Y5D3p4." } } } |
Raw output (example):
|
{ searchSessionId:1513260595933 sessionId:3dxITLyDE9FyRiflQD7UFG_hSsUPq4uCTM4B6Y5D3p4. } |
- as-drilldown
Input:
|
searchSessionId, sessionId, startTime, endTime, lastDays for example:
|
Context output:
|
The command has no context. |
Raw output:
|
The command has no raw output. |
- as-status
Input:
|
searchSessionId, sessionId |
Context output (example):
|
{ "ArcSightLogger": { "Status": { "Status": "complete", "Hit": 2462, "Elapsed": "00:00:00.290", "ResultType": "histogram", "Scanned": 2520, "SearchSessionId": "1513272858387", "Message": [] } |
Raw output (example):
|
{ elapsed: 00:00:00.290 hit:2462 message: [] result_type: histogram scanned: 2520 status: complete } |
- as-events
Input:
|
searchSessionId, sessionId, length, dir, offset, fields Command use example
|
Context output (example):
|
{ "ArcSightLogger": { "Events": [ { "destinationAddress": ##.##.##.##, "agentSeverity": "1", "Version": "0", "Logger": "Local", "ReceiptTime": 1513249919185, "deviceCustomNumber1Label": "Percent Usage", "deviceCustomNumber1": 2, "deviceAddress": ##.##.##.##, "deviceCustomString2Label": "timeframe", "deviceVendor": "ArcSight", "Device": "Logger", "deviceProduct": "Logger", "EventTime": 1513249440017, "baseEventCount": 1, "deviceReceiptTime": 1513249440017, "startTime": 1513249440017, "deviceEventClassId": "cpu:100", "deviceCustomString2": "CurrentValue", "name": "CPU Usage", "deviceEventCategory": "/Monitor/CPU/Usage", "rowId": "347259-26@Local", "endTime": 1513249440017, "deviceVersion": "6.2.0.7633.0" }, … ] } } |
Raw output (example):
|
[ { Device:Logger EventTime:1513249693332 Logger:Local ReceiptTime:1513249693838 Version:0 agentSeverity:3 baseEventCount:1 cn1label:Session destinationAddress: ##.##.##.##, destinationUserId:1 destinationUserName:admin deviceCustomNumber1: 741618068 deviceEventCategory:/Platform/Authentication/Login deviceEventClassId:platform:230 deviceProduct:Logger deviceVendor:ArcSight deviceVersion:L7633 name:Successful login rowId:347186-0@Local sourceAddress: ##.##.##.##, }, … ]
{ |
- as-stop
Input:
|
searchSessionId, sessionId |
Context output (example):
|
The command has no context. |
Raw output (example):
|
The command has no raw output. |
- as-close
Input:
|
searchSessionId, sessionId |
Context output (example):
|
The command has no context. |
Raw output (example):
|
The command has no raw output. |
Additional info:
-
Search time range: When no time limitations are applied on a search session, Arcsight Logger will use its default time limitation and will search events in time range of the last 2 hours.
To set the search time range:
- When starting a new search session, using ‘as-search’: pass both startTime and endTime parameters to set the time range for the search. Alternatively, you can use the lastDays parameter.
- When in an active search session: use ‘as-drilldown’ to narrow-down the search results to a specified time range.
- When starting a new search, using ‘as-search-events’: pass both startTime and endTime parameters to set the time range for the search. Alternatively, use lastDays parameter.
- Date/time format: Use the compliant date/time format when passing startTime and endTime parameters.
-
Expected date/time format: yyyy-MM-dd’T’HH:mm:ss.SSSXXX.
For example, May 26 2014 at 21:49:46 PM could have a format like one of the following:
- Format in PDT: 2014-05-26T21:49:46.000-07:00
- Format in UTC: 2014-05-26T21:49:46.000Z
- Events list default limitation: The default events list length is 100. To set a new length specify the path length parameter in the relevant commands.
- Local/global search: In ‘as-search’ and ‘as-search-events’ you can optionally pass the ‘local_search’ parameter, to Indicate whether the search is local only, and does not include peers. Please note that local search is the default option for a search session.
Known Limitations
-
Session limitations: Arcsight Logger has default limitations for running maximum sessions simultaneously, and for inactive sessions.
To change the default limitation for both, use administrator credentials to login to Archsight Logger UI, navigate to ‘System Admin’->’Users/Groups’->’Authentication’ and set new limitations for ‘Max Simultaneous Logins/User’ and ‘Logout Inactive Session After’.
Troubleshooting
- Reoccurring ‘timeout’ error when using commands ‘as-search-events’ or ‘as-events’:
This may indicate that a large amount of data returned from Arcsight Logger. To resolve this error, try to limit the search time range or the events list length. See additional ways to set the search time range in ‘Additional info’ above.
DBot error snap-shot
- Reoccurring ‘Login failed’ error when using ‘as-search’ or ‘as-search-events’:
First eliminate the case of wrong credentials configured in the Arcsight Logger instance.
If this error still araises, it may indicate that Arcsight Logger is failing to generate a new search session. New sessions cannot be generated by Arcsight Logger when the maximum allowed number of simultaneous sessions was reached.
To resolve this problem, use administrator credentials to login to Archsight Logger UI and set a new limitation for maximum simultaneous sessions.
See ’Known Limitations’ above for more information.
If administrator credentials are not available for you, use ‘as-close’ to close the running sessions.
DBot error snap-shot
- Reoccurring ‘User session id is not valid’ error:
The search session timed out.
Search session timeout can be caused by the followings:
- Low ‘timeout’ passed to ‘as-search’. This can be resolved by passing a higher ‘timeout’ value to ‘as-search’.
- Arcsight Logger limitation on inactive sessions - Inactive sessions are automatically terminated after a defined period of time determined by Arcsight Logger, even if the ‘timeout’ argument is changed to ‘as-search’.
To resolve this problem, use administrator credentials to login to Archsight Logger UI and set a new limitation for inactive sessions. See ’Known Limitations’ above for more information.
DBot error snap-shot
Configuration parameters
url— Server URL (e.g. https://192.168.0.1)* (required)port— Port (required)isFetch— Fetch incidentsincidentType— Incident typeincidentFetchInterval— Incidents Fetch IntervaleventsQuery— Events queryfields— Fieldsaggregate— Aggregate events into one incidentfetchlimit— Fetch limitinsecure— Trust any certificate (not secure)proxy— Use system proxy settingscredentials— Credentials
Commands (7)
-
as-closeStops the execution of the search and clears the search session data from the server.
-
as-drilldownNarrows-down the search results to the specified time range
-
as-eventsReturns the list of events found in the specified search.
-
as-searchIn opposite to as-search-events, as-search-events waits until the search query is complete and returns the events, as-search initiates new logger search query, and returns sessionId and searchSessionId which should be used in other commands like as-status, as-stop, as-events, etc.
-
as-search-eventsStart a new search, wait until the search status is complete and then return the events. This command combine 3 commands - as-search, as-status, as-events
-
as-statusReturns the latest status of the specified search.
-
as-stopStops the search operation but keeps the search session so that the search results can be narrowed down later
commonfields: id: ArcSight Logger version: -1 name: ArcSight Logger display: ArcSight Logger category: Analytics & SIEM sectionorder: - Connect - Collect provider: OpenText description: ArcSight events logger. configuration: - display: Server URL (e.g. https://192.168.0.1)* name: url defaultvalue: "" type: 0 required: true section: Connect - display: Port name: port defaultvalue: "9000" type: 0 required: true section: Connect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 advanced: true section: Collect - display: Events query name: eventsQuery defaultvalue: "" type: 0 required: false section: Collect - display: Fields name: fields defaultvalue: "" type: 0 additionalinfo: Fields to be fetched. The Fields specify columns that you can see in the arcsight logger interface. The fields that you select will be fetched as data. required: false section: Collect - display: Aggregate events into one incident name: aggregate defaultvalue: "false" type: 8 additionalinfo: By enabling this you take all the events that happened in the last minute and aggregate them into one Events key. This will result in having all the data for the last minute fetched into one incident. required: false section: Collect - display: Fetch limit name: fetchlimit defaultvalue: "100" type: 0 additionalinfo: This parameter limits the maximum number of events that can be fetched at once. In case the aggregate parameter is checked this parameter will limit the number of events in the aggregated Events key. required: false section: Collect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Credentials name: credentials defaultvalue: "" type: 9 required: false section: Connect script: script: '' type: javascript commands: - name: as-search-events arguments: - name: discover_fields auto: PREDEFINED predefined: - "true" - "false" description: Indicates that the search should try to discover fields in the events found. - name: startTime description: 'The date and time string for the start time in the search time range. If startTime is provided, endTime must be present as well. Format: - InPDT:2014-05-26T21:49:46.000-07:00 - InUTC:2014-05-26T21:49:46.000Z.' - name: endTime description: 'The date and time string for the end time in the search time range. If endTime is provided, startTime must be present as well. See Integration tips for correct date/time format. Format: - InPDT:2014-05-26T21:49:46.000-07:00 - InUTC:2014-05-26T21:49:46.000Z.' - name: summary_fields description: Comma separated list of fields. To be used to calculate summary when field_summary is true. - name: field_summary auto: PREDEFINED predefined: - "true" - "false" description: Indicates to use the field summary. - name: local_search auto: PREDEFINED predefined: - "true" - "false" description: Indicates the search is local only, and does not include peers. The default value for this parameter is 'true'. If the local search option is configured to 'False' on your ArcSight Logger instance, make sure to include this argument with a value of 'false' for the command. - name: query description: The search query string to filter/process the events. - name: timeout description: The number of milliseconds to keep the search after processing has stopped. Default timeout is 10 minutes. defaultValue: "120000" - name: lastDays description: 'The number of days from from current time . Use to limit the search time range. ' - name: offset description: The offset from the first even. - name: length description: The length or number of events to retrieve. Maximum number is 10000. Default is 100. defaultValue: "100" - name: dir auto: PREDEFINED predefined: - forward - backward description: The sort direction based on event time. forward/backward (default is forward). - name: fields description: comma separated list of fields in the order to show. If not specified, all fields will be used. description: Start a new search, wait until the search status is complete and then return the events. This command combine 3 commands - as-search, as-status, as-events - name: as-status arguments: - name: searchSessionId required: true description: The Search Session ID returned from as-search command. - name: sessionId required: true description: The Session ID returned from as-search command. outputs: - contextPath: ArcSightLogger.Status.Status description: The search status. Can be any of starting, running, complete, or error. If the specified search has not started yet, the status will be “starting". - contextPath: ArcSightLogger.Status.ResultType description: Indicates the type of the search results. - contextPath: ArcSightLogger.Status.Hit description: The number of events found. - contextPath: ArcSightLogger.Status.Scanned description: The number of events scanned. - contextPath: ArcSightLogger.Status.Elapsed description: The elapsed time of this search. - contextPath: ArcSightLogger.Status.Message description: The message for the search. This will be used when there is an error in the local/peer search. - contextPath: ArcSightLogger.Status.SearchSessionId description: The search session id. description: Returns the latest status of the specified search. - name: as-drilldown arguments: - name: searchSessionId required: true description: The Search Session ID returned from as-search command. - name: sessionId required: true description: The Session ID returned from as-search command. - name: startTime description: The date and time string for the start time in the search time range. If startTime is provided, endTime needs to be present as well. See Integration tips for correct date/time format. - name: endTime description: The date and time string for the end time in the search time range. If endTime is provided, startTime needs to be present as well. See Integration tips for correct date/time format. - name: lastDays description: 'The number of days from from current time . Use to limit the search time range. ' description: Narrows-down the search results to the specified time range - name: as-events arguments: - name: searchSessionId required: true description: The Search Session ID returned from as-search command. - name: sessionId required: true description: The Session ID returned from as-search command. - name: dir auto: PREDEFINED predefined: - forward - backward description: The sort direction based on event time. forward/backward (default is forward). - name: fields description: comma separated list of fields in the order to show. If not specified, all fields will be used. - name: length description: The length or number of events to retrieve. Maximum number is 10000. Default is 100. defaultValue: "100" - name: offset description: The offset from the first even. description: Returns the list of events found in the specified search. - name: as-close arguments: - name: sessionId required: true description: The Session ID returned from as-search command. - name: searchSessionId required: true description: The Search Session ID returned from as-search command. description: Stops the execution of the search and clears the search session data from the server. - name: as-stop arguments: - name: sessionId required: true description: The Session ID returned from as-search command. - name: searchSessionId required: true description: The Search Session ID returned from as-search command. description: Stops the search operation but keeps the search session so that the search results can be narrowed down later - name: as-search arguments: - name: discover_fields auto: PREDEFINED predefined: - "true" - "false" description: Indicates that the search should try to discover fields in the events found. - name: startTime description: 'The date and time string for the start time in the search time range. If startTime is provided, endTime must be present as well. Format: - InPDT:2014-05-26T21:49:46.000-07:00 - InUTC:2014-05-26T21:49:46.000Z.' - name: endTime description: 'The date and time string for the end time in the search time range. If endTime is provided, startTime must be present as well. See Integration tips for correct date/time format. Format: - InPDT:2014-05-26T21:49:46.000-07:00 - InUTC:2014-05-26T21:49:46.000Z.' - name: summary_fields description: Comma separated list of fields. To be used to calculate summary when field_summary is true. - name: field_summary auto: PREDEFINED predefined: - "true" - "false" description: Indicates to use the field summary. - name: local_search auto: PREDEFINED predefined: - "true" - "false" description: Indicates the search is local only, and does not include peers. The default value for this parameter is 'true'. If the local search option is configured to 'False' on your ArcSight Logger instance, make sure to include this argument with a value of 'false' for the command. - name: query description: The search query string to filter/process the events. - name: timeout description: The number of milliseconds to keep the search after processing has stopped. Default timeout is 10 minutes. defaultValue: "120000" - name: lastDays description: 'The number of days from from current time . Use to limit the search time range. ' description: In opposite to as-search-events, as-search-events waits until the search query is complete and returns the events, as-search initiates new logger search query, and returns sessionId and searchSessionId which should be used in other commands like as-status, as-stop, as-events, etc. isfetch: true tests: - No tests fromversion: 5.0.0