Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 10 Current »

You can perform a real-time check of whether the data transferred from Data Connector has reached the Micro Focus ArcSight ESM destination. Data Connector transfers DNS queries and logs to Micro Focus SmartConnector, which forwards them to Micro Focus ArcSight Manager, which displays the following information as soon as the data arrives at the destination:

The screenshot shows the information displayed in the Event List tab of Micro Focus ArcSight Manager. The columns are customizable, and the version in the screenshot shows the End Time, Name, Attacker Address, Target Address, Target Port, Priority, Device Vendor, and Device Product for each event.
Image: The ArcSight Command Center, a part of a security information and event management (SIEM) system displaying the "Active Channel - Live" view, showing real-time security events.

Configuring Micro Focus SmartConnector to Communicate with Data Connector

Install ArcSight SmartConnector

1. Execute the program ArcSight-<version string>-connector:
The screenshot shows the Choose Install Folder of ArcSight SmartConnector.
Image: The installation wizard for the ArcSight SmartConnector displaying a window where the user can choose the install folder for the SmartConnector.

2. Select the folder where you want to install ArcSight SmartConnector, and click Next.

Image: The installation wizard for the ArcSight SmartConnector displaying a window where the user can select an installation folder.  

3. Select the folder where you want to create links, and click Next. 
The screenshot shows the Choose Link Folder dialog box of ArcSight SmartConnector, with the In Your Home Folder checkbox selected.
Image: The installation wizard for the ArcSight SmartConnector displaying a window where the user can create links.  

4. Review the information, and click Install to confirm or Previous to go back.
The screenshot shows the Pre-Install Summary view of ArcSight SmartConnector. The view shows the configured values for fields Product Name, Install Folder, and Link Folder.
Image: The installation wizard for the ArcSight SmartConnector displaying the pre-install summary.  

5. After Micro Focus SmartConnector is installed successfully, the Connector Setup wizard appears.
The screenshot shows the Connector Setup wizard. The user is given the options to Add a Connector and to Set Global Parameters.
Image: The installation wizard for the ArcSight SmartConnector displaying the confirmation of setup page.  

6. Select Add a Connector, and click Next.

Configure Micro Focus ArcSight Manager

1. Set Type to Syslog NG Daemon, and click Next.
The screenshot shows the Connector Setup wizard, where Type is set to Syslog NG Daemon.
Image: The installation wizard for the ArcSight SmartConnector displaying the the connector setup page where a connector can be selected and configured.  

2. Enter the following details, and click Next. 
The screenshot shows the Connector Setup wizard, where the user is to configure Netwok Port to 1999, IP Address to ALL, Protocol to TLS, Forwarder to false, and EITF Standard (RFC 5424) Enabled to false.
Image: The installation wizard for the ArcSight SmartConnector displaying the the connector setup page where the connector configuration parameters can be added. 

  • Network Port: Specify the same port number as the one you specified while configuring the destination in Data Connector.
  • IP Address: Enter the IP address of Data Connector.
  • Protocol: To use the TLS encryption protocol for Syslog, select TLS.

3. Select ArcSight Manager (encrypted), and click Next.
The screenshot shows the Connector Setup wizard, where the Enter the Type of Destination field has ArcSight Manager (encrypted) selected.
Image: The installation wizard for the ArcSight SmartConnector displaying the the connector setup page where the connector destination can be selected.

4. Specify the IP address and port number of ArcSight Manager, specify other credentials, and click Next.
The screenshot shows the Connector Setup wizard, where Manager Hostname, Manager Port, User, Password, AUP Master Destination, Filter Out All Events, and Enable Demo CA are configured.

Image: The installation wizard for the ArcSight SmartConnector displaying the the connector setup page where an IP address and port number can be selected.

5. Complete the rest of the installation as per the installation wizard.

For more information, refer to the Micro Focus ArcSight ESM document.

  • No labels