ArcSight XML Deprecated

Deprecated. Use the ArcSight ESM v2 integration instead.

Analytics & SIEM · ArcSight XML (Deprecated)

Details

IDArcSight XML
ProviderOpenText
CategoryAnalytics & SIEM
From Version5.0.0
Docker Imagedemisto/python:2.7.18.27799
Supported ModulesAgentix

README

Deprecated. Use the ArcSight ESM v2 integration instead.

Configure ArcSight XML in Cortex

Parameter Required
Fetch incidents False
Incident type False
Directory from which to get XML files and create incidents. True
Directory to which put command XML files. True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

arcsight-update-case

Create an XML to update a case.

Base Command

arcsight-update-case

Input

Argument Name Description Required
caseId ID of the case. Required
name Name of the case. Required
stage The stage of the case. Required

arcsight-fetch-xml

Used for testing. Should fetch XML file and return an XSOAR incident object.

Base Command

arcsight-fetch-xml

Input

There is are no inputs for this command.

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • inputDirPath — Directory from which to get XML files and create incidents. (required)
  • commandsDirPath — Directory to which put command XML files. (required)

Commands (2)

  • arcsight-fetch-xml

    Used for testing. Should fetch XML file and return an XSOAR incident object.

  • arcsight-update-case

    Create an XML to update a case.

Source

ArcSightXML.py ArcSightXML.yml
Download History Raw 
commonfields:
  id: ArcSight XML
  version: -1
name: ArcSight XML
display: ArcSight XML (Deprecated)
category: Analytics & SIEM
provider: OpenText
description: Deprecated. Use the ArcSight ESM v2 integration instead.
deprecated: true
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Directory from which to get XML files and create incidents.
  name: inputDirPath
  defaultvalue: ''
  type: 0
  required: true
- display: Directory to which put command XML files.
  name: commandsDirPath
  defaultvalue: ''
  type: 0
  required: true
script:
  script: ''
  type: python
  subtype: python2
  commands:
  - name: arcsight-update-case
    arguments:
    - name: caseId
      required: true
      description: ID of the case.
    - name: name
      required: true
      description: Name of the case.
    - name: stage
      required: true
      description: The stage of the case.
    description: Create an XML to update a case.
  - name: arcsight-fetch-xml
    arguments: []
    description: Used for testing. Should fetch XML file and return an XSOAR incident object.
  isfetch: true
  dockerimage: demisto/python:2.7.18.27799
tests:
- No test
fromversion: 5.0.0