ArcSight ESM v2

ArcSight ESM SIEM by Micro Focus (Formerly HPE Software).

Configuration parameters

server — Server full URL (e.g., https://192.168.0.1:8443) (required)
credentials — Credentials (required)
viewerId — Fetch events as incidents via Query Viewer ID. Mandatory fields for query are "Start Time" and "Event ID".
casesQueryViewerId — Fetch cases as incidents via Query Viewer ID. Mandatory fields for query are "Create Time" and "ID".
max_unique — The maximum number of unique IDs expected to be fetched.
fetch_chunk_size — The maximum number of incidents to fetch each time. Default is 50, maximum is 300.
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
use_rest — Use REST Endpoints
productVersion — Product Version
incidentType — Incident type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

as-add-entries — Adds new entries to the Active List.
as-case-delete — Deletes a case.
as-clear-entries — Deletes all entries in the Active List.
as-delete-entries — Delete entries from the Active List.
as-fetch-incidents — Fetches incidents.
as-get-all-cases — (Deprecated) Retrieves all case resource IDs.
as-get-all-query-viewers — Returns all the query viewer IDs.
as-get-case — Gets information about a single case.
as-get-case-event-ids — Returns all case event IDs.
as-get-entries — Returns all entries in the Active List.
as-get-matrix-data — Retrieves query viewer results (query viewer must be configured to be refreshed every minute, see documentation).
as-get-query-viewer-results — Retrieves query viewer results (query viewer must be configured to be refreshed every minute, see documentation).
as-get-security-events — Returns the security event details.
as-update-case — Updates a specific case.