ArcSight Logger

ArcSight events logger.

Category

Analytics & SIEM

Pack

ArcSightLogger

Configuration parameters

• url — Server URL (e.g. https://192.168.0.1)* (required)
• port — Port (required)
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• eventsQuery — Events query
• fields — Fields
• aggregate — Aggregate events into one incident
• fetchlimit — Fetch limit
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• credentials — Credentials

Commands (7)

• as-close — Stops the execution of the search and clears the search session data from the server.
• as-drilldown — Narrows-down the search results to the specified time range
• as-events — Returns the list of events found in the specified search.
• as-search — In opposite to as-search-events, as-search-events waits until the search query is complete and returns the events, as-search initiates new logger search query, and returns sessionId and searchSessionId which should be used in other commands like as-status, as-stop, as-events, etc.
• as-search-events — Start a new search, wait until the search status is complete and then return the events. This command combine 3 commands - as-search, as-status, as-events
• as-status — Returns the latest status of the specified search.
• as-stop — Stops the search operation but keeps the search session so that the search results can be narrowed down later