Fortinet black logo

ArcSight

Home FortiSOAR Connectors ArcSight

ArcSight v2.2.0

2.2.0
2.2.0
2.1.1
2.1.0
2.0.0
1.3.1
1.3.0
Copy Link
Copy Doc ID 395e8a76-9bc1-4bde-b84c-927537ae194d:1

About the connector

ArcSight Enterprise Security Manager (ESM) is a threat detection, analysis, triage, and compliance management SIEM platform.

This document provides information about the HP ArcSight connector, which facilitates automated interactions, with an ArcSight ESM server using FortiSOAR™ playbooks. Add the HP ArcSight connector as a step in FortiSOAR™ playbooks and perform automated operations, such as annotating events, running a report based on a report ID, and uploading an ArcSight report file as an attachment in FortiSOAR™.

Version information

Connector Version: 2.2.0

FortiSOAR™ Version Tested on: 5.1.0-464

HP ArcSight Version Tested on: 6.11

Authored By: Fortinet

Certified: Yes

Release Notes for version 2.2.0

Following enhancements have been made to the HP ArcSight Connector in version 2.2.0:

  • Updated the configuration schema in the >ArcSight > Fetch data ingestion playbook to include a tooltip and placeholder content for the Event IDs parameter present on the Fetch Data screen in the FortiSOAR™ Data Ingestion Wizard. For information about data ingestion, see the "Data Ingestion" chapter in the FortiSOAR™ product documentation.
  • Rename the input parameter "Event ID" to "Event IDs" in the "Get Event Details" action and included support for retrieving details of multiple events based on the event IDs you have specified. You can enter multiple event IDs in the CSV or list format.
  • Renamed the action "Upload Report" to "Download Report".
  • Updated the script that pulls events from ArcSight. Updates include adding error handling in the script, etc.
  • Fixed bugs such as adding a default .html file extension to the report downloaded using the "Download Report" action.

Installing the connector

From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the yum command to install connectors. Connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and run the yum command as a root user to install connectors:

yum install cyops-connector-arcsight

Prerequisites to configuring the connector

  • You must have the IP Address or FQDN of ArcSight ESM server and credentials to access the server.
  • To access the FortiSOAR™ UI, ensure that port 443 is open through the firewall for the FortiSOAR™ instance.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the HP ArcSight connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Parameter Description
Server URL IP Address or FQDN of the ArcSight ESM server to which you will connect and perform automated operations.
ESM Port REST API port of the ArcSight ESM server.
Defaults to 8443.
Username Username to access the ArcSight ESM server.
Password Password to access the ArcSight ESM server.
Verify SSL Specifies whether the SSL certificate for the server is to be verified or not.
By default, this option is set as True.
Do Not Fail Connector Function On API Error? If you select this option, i.e., set this option as True, then connector operation will not fail even when the ArcSight REST API returns a failure.
Enable Pull ArcSight Events Service If you select this option, i.e., set this option as True (default), then ArcSight events will be pulled.
If you select this option, then you must specify the following parameters:
  • Active List ID: Resource ID of the Active List for which you want to retrieve events from ArcSight ESM.
  • Playbook Trigger: The string used to trigger the playbook.
    Note: The playbook authentication method should be set as HMAC.
  • Reader Port: Port used for communication between FortiSOAR™ and the ArcSight Active List Reader. 10012 is the default port number. You can specify any unused port number if the default port is unavailable. You can also use a similar port number for multiple ArcSight connector configurations as the ArcSight Active List Reader process is capable of communicating with multiple ArcSight servers.
  • Poll Interval: Poll Interval, in seconds, that determines how frequently the ArcSight Active List Reader polls the active list for event IDs.
    Note: 300 seconds is the default poll interval.

Important: To run the Enable Pull ArcSight Events Service, you must Import the CyOPs_Package.arb in ArcSight. Steps to import the CyOPs_Package.arb in ArcSight, is mentioned in the "Importing the CyOPs_Package.arb package in ArcSight" section.
Also, ensure that the playbook whose trigger you have specified in the Playbook Trigger parameter is in the Active state. This ensures that you experience seamless event reading from ArcSight ESM.

Importing the CyOPs_Package.arb package in ArcSight

  1. Locate the CyOPs_Package.arb package that is present in the ArcSight connector folder (/opt/cyops-integrations/integrations/connectors/arcsight_2_0_0/CyOPs_Package.arb). The .arb file is also attached with this document and can be downloaded for use.
  2. To import the CyOPs_Package.arb package in ArcSight, navigate to the Packages tab in ArcSight as shown in the following image:
  3. Click Import and select the CyOPs_Package.arb package.
    The CyOPs_Package.arb package contains two items: Active List (CyOPs_Event_collector) and Rule (CyOPs Active List Rule).
    Once the CyOPs_Package.arb package is imported successfully, the CyOPs Active List Rules will appear in ArcSight as follows:
    Once the CyOPs_Package.arb package is imported successfully, the CyOPs_Event_collector will appear in ArcSight as follows:

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 onwards:

Function Description Annotation and Category
Annotate Event Updates an ArcSight Event Stage, assigns it to a user and adds a comment. annotate_event
Investigation
Get Event Details Retrieves information for events from the ArcSight ESM server, based on event IDs and other input parameters you have specified. get_event_info
Investigation
Run Report with Default Parameters Runs a report based on an ID or URI and default inputs on the ArcSight ESM server. run_report
Investigation
Run Report Runs a report based on an ID and custom user inputs on the ArcSight ESM server. run_report
Investigation
Delete Report Deletes an archived report from the ArcSight ESM server, based on the Resource ID you have specified. delete_report
Remediation
Create Case Creates a case in ArcSight ESM, based on the input parameters you have specified. create_case
Investigation
Update Case Updates an existing case in ArcSight ESM, based on the input parameters you have specified. update_case_info
Investigation
Get Case Information Retrieves information about a case from ArcSight ESM, based on the case ID you have specified. get_case_info
Investigation
Add Events to Case Adds the specified events to an existing case in ArcSight ESM, based on the case ID you have specified. add_events
Investigation
Delete Case Events Deletes the specified events from an existing case from ArcSight ESM, based on the case ID you have specified. delete_events
Remediation
Search Query Searches ArcSight ESM records based on the query you have specified. search_query
Investigation
Download Report Downloads a report based on an ID from ArcSight ESM and then upload that report as an attachment in the FortiSOAR™ Attachment Module. upload_report
Investigation
Get Active List Information Retrieves information about an active list from ArcSight ESM, based on the Active List ID you have specified. get_active_list_info
Investigation
Update Active List Adds new items to a specified on ArcSight ESM, based on the Active List ID and other input parameters you have specified. update_active_list
Investigation
Get Active List Entries Retrieves entries for a specified active list, based on the Active List ID you have specified. get_active_list_entries
Investigation
Clear Active List Entries Clear entries for a specified active list, based on the Active List ID you have specified. clear_active_list_entries
Remediation
Get Fields Retrieves details of all fields from ArcSight ESM. get_fields
Investigation

operation: Annotate Event

You can annotate ArcSight Events using the ArcSight Console to update the Stage and Assignee of the event and to add comments to the event.

ArcSight Console: Update Stage and Add Comments to the event

ArcSight Console: Update Assignee of the event

You can also perform similar operations using the Annotate Event function in FortiSOAR™ playbooks.

Input parameters

Parameter Description
Event ID The ID of the ArcSight Event that you want to annotate.
Stage The Stage to be set for the Event. You can choose from one of the following values:
Queued/Initial/Monitoring/Rule Created/Follow-Up/Final/Flagged as Similar/Closed
User An existing ArcSight user to whom you want to assign the event. For example, admin.
Comment The comment that you want to add to the event.

Output

The JSON output returns a Success message if the ArcSight ESM event is annotated successful or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Get Event Details

Input parameters

Parameter Description
Event IDs IDs of ArcSight Events whose details you want to retrieve from ArcSight. You can add multiple IDs using the CSV or list format.
Replace Null Values with Empty String? If an event field is not set, the ArcSight APIs return the following values. Use this option to replace these values with an empty string. Note that, by default, the Replace Null Values with Empty String? field is set to True.
Field Type integer: Returned value in place of NULL: -2147483648 (Integer.MIN_VALUE)
Field Type long: Returned value in place of NULL: -9223372036854775808 (Long.MIN_VALUE)
Field Type double: Returned value in place of NULL: 5e-324 (Double.MIN_VALUE
IP Address Keys to Parse (Optional) ArcSight API returns the IP address fields in decimal format. Provide a comma-separated list of field names you want to convert from decimal to IP address format.
Defaults to address.
MAC Address Keys to Parse (Optional) ArcSight API returns the MAC address fields in decimal format. Provide a comma-separated list of field names you want to convert from decimal to MAC address format.
Defaults to macAddress,translatedAddress.
Fields Name (Optional) Specify field names if you wants to retrieve a specific set of columns from HP ArcSight.
Time Field Names (Optional) Specify a comma-separated list or array of field names for which you want to perform time conversion in the output of this operation.
Date Time Format (Optional) Specify the DateTime format for converting the time fields. You must specify a DateTime format that is supported by the arrow library. For more information on the arrow library, see https://arrow.readthedocs.io/en/latest/

Output

The JSON output contains the details of the event, based on the specified event ID and other input parameters, retrieved from ArcSight ESM.

The output contains the following populated JSON schema:
{
"endTime": "",
"ttl": "",
"severity": "",
"locality": "",
"domainFp5": "",
"domainFp2": "",
"domainNumber3": "",
"name": "",
"domainFp6": "",
"domainFp1": "",
"deviceCustomFloatingPoint2": "",
"deviceCustomString2": "",
"domainDate6": "",
"originalAgent": {
"name": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"type": "",
"addressAsBytes": "",
"macAddress": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"id": ""
},
"domainNumber8": "",
"domainNumber6": "",
"deviceCustomFloatingPoint4": "",
"type": "",
"startTime": "",
"domainIpv4addr1": "",
"destination": {
"translatedPort": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"geo": {
"mutable": "",
"longitude": "",
"latitudeLong": "",
"longitudeLong": "",
"latitude": ""
},
"assetId": "",
"processId": "",
"addressAsBytes": "",
"port": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
&nbsnbsp; "isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"macAddress": ""
},
"domainIpv4addr3": "",
"domainNumber5": "",
"domainFp8": "",
"domainFp4": "",
"deviceEventClassId": "",
"agentReceiptTime": "",
"persistence": "",
"managerId": "",
"deviceSeverity": "",
"deviceCustomFloatingPoint3": "",
"deviceCustomString1": "",
"flexNumber1": "",
"domainDate1": "",
"domainNumber12": "",
"deviceReceiptTime": "",
"deviceEventCategory": "",
"category": {
"outcome": "",
"object": "",
"mutable": "",
"significance": "",
"behavior": "",
"deviceGroup": ""
},
"deviceCustom": {
"mutable": "",
"number1Label": "",
"string1Label": "",
"string2Label": ""
},
"domainIpv4addr2": "",
"deviceCustomDate2": "",
"modelConfidence": "",
"correlatedEventCount": "",
"deviceCustomDate1": "",
"managerReceiptTime": "",
"baseEventCount": "",
"domainNumber13": "",
"aggregatedEventCount": "",
"deviceCustomFloatingPoint1": "",
"domainDate3": "",
"domainFp7": "",
"deviceCustomNumber3": "",
"assetCriticality": "",
"deviceDirection": "",
"domainIpv4addr4": "",
"agentSeverity": "",
"eventAnnotation": {
"endTime": "",
"stage": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"version": "",
"modificationTime": "",
"eventId": "",
"managerReceiptTime": "",
"flags": "",
"auditTrail": "",
"stageUpdateTime": ""
},
"agent": {
"name": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"type": "",
"addressAsBytes": "",
"macAddress": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"id": ""
},
"domainDate5": "",
"deviceProcessId": "",
"relevance": "",
"finalDevice": {
"product": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"addressAsBytes": "",
"vendor": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"macAddress": ""
},
"domainNumber11": "",
"sessionId": "",
"deviceCustomNumber2": "",
"flexDate1": "",
"bytesIn": "",
"concentratorDevices": {
"product": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"addressAsBytes": "",
"vendor": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"macAddress": ""
},
"domainDate2": "",
"deviceCustomNumber1": "",
"device": {
"product": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"addressAsBytes": "",
"vendor": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"macAddress": ""
},
"originator": "",
"domainNumber9": "",
"domainNumber1": "",
"priority": "",
nbsp; "domainDate4": "",
"flexNumber2": "",
"domainNumber7": "",
"eventId": "",
"domainFp3": "",
"domainNumber2": "",
"domainNumber4": "",
"concentratorAgents": {
"name": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"type": "",
"addressAsBytes": "",
"macAddress": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"id": ""
},
"bytesOut": "",
"domainNumber10": ""
}

operation: Run Report with Default Parameters

You can get the ID for a report (Resource ID) from the ArcSight Console, as shown in the following image:

ArcSight Console - Resource ID

You can get the URI for a report from the ArcSight Console. To get the URI, you must add the report name to the parent resource, as shown in the following image:

ArcSight Console - Parent Groups: Resources

Input parameters

Parameter Description
Run Report By Parameter of the report based on which you want to run a report on ArcSight ESM. You can choose between Report ID or Report URI.
Report URI or Report ID ID or URI of the ArcSight report that you want to run on ArcSight ESM.

Output

The JSON output returns the Download ID of the report. You can use this Download ID to download the report subsequently when the report is ready. You can use the "Download Report" operation to download the report and add it as an attachment to FortiSOAR™.

The output contains a non-dictionary value.

operation: Run Report

Input parameters

Parameter Description
Report Id ID of the ArcSight report that you want to run.
Input parameters Input parameters in the JSON format.
For example, {'StartTime': '$Now - 3h', 'Report Format': '0'}.
The keys are the same as seen on the ArcSight console. Note that the values for the drop-down fields are their integer positions. For example, the Report Format should be specified as 0, 1, 2, etc., and not as pdf, csv, html, etc.

Output

The JSON output returns the Download ID of the report. You can use this Download ID to download the report subsequently when the report is ready. You can use the "Download Report" operation to download the report and add it as an attachment to FortiSOAR™.

The output contains a non-dictionary value.

operation: Delete Report

Input parameters

Parameter Description
Report ID ID of the archived ArcSight report that you want to delete from ArcSight ESM.

Output

The JSON output returns a Success message if the specified report is deleted from ArcSight ESM, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Create Case

Input parameters

Parameter Description
Parent Group ID Parent Group ID of the case you want to create.
Case Name Name of the case that you want to create.
Alias (Display Name) (Optional) Alias or Display Name of the case that you want to create.
Ticket Type (Optional) Ticket type of the case you want to create.
You can choose from the following options: INTERNAL, CLIENT, or INCIDENT.
Stage (Optional) Stage that you want to assign to the created case.
You can choose from the following options: QUEUED, INITIAL, FOLLOW_UP, FINAL, or CLOSED.
Frequency (Optional) Frequency that you want to assign to the created case.
You can choose from the following options: TEN_TO_FIFTEEN, NEVER_OR_ONCE, FIFTEEN, LESS_THAN_TEN, or MORE_THAN_FIFTEEN.
Operational Impact (Optional) Operational Impact that you want to assign to the created case.
You can choose from the following options: NO_IMPACT, NO_IMMEDIATE_IMPACT, LOW_PRIORITY_IMPACT, HIGH_PRIORITY_IMPACT, or IMMEDIATE_IMPACT.
Security Classification (Optional) Security Classification that you want to assign to the created case.
You can choose from the following options: UNCLASSIFIED, CONFIDENTIAL, SECRET, or TOP_SECRET.
Consequence Severity (Optional) Consequence Severity that you want to assign to the created case.
You can choose from the following options: NONE, INSIGNIFICANT, MARGINAL, CRITICAL, or CATASTROPHIC.
External ID (Optional) Unique ID of the case you want to create.
Description (Optional) Description of the case you want to create.
Deprecated (Optional) Whether or not the created case is deprecated.
Additional attributes in json format (Optional) Use this field to set values that are not displayed in FortiSOAR™.

Output

The JSON output contains the case ID and the details of the case created on ArcSight ESM.

The output contains the following populated JSON schema:
{
"modifierName": "",
"creatorName": "",
"type": "",
"reference": {
"referenceType": "",
"uri": "",
"referenceString": "",
"referenceName": "",
"isModifiable": "",
"id": "",
"managerID": ""
},
"displayID": "",
"createdTimestamp": "",
"attributeInitializationInProgress": "",
"deprecated": "",
"isAdditionalLoaded": "",
"state": "",
"estimatedRestoreTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTimestamp": "",
"name": "",
"localID": "",
"description": "",
"URI": "",
"initialized": "",
"disabled": "",
"reportingLevel": "",
"numberOfOccurences": "",
"inCache": "",
"inactive": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
}
}

operation: Update Case

Input parameters

Parameter Description
Case ID ID of the case you want to update.
Case Name (Optional) Updated case name, if you want to update the name of an existing case.
Alias (Display Name) (Optional) Alias or Display Name of the case that you want to update.
Ticket Type (Optional) Ticket type of the case you want to update.
You can choose from the following options: INTERNAL, CLIENT, or INCIDENT.
Stage (Optional) Updated stage, if you want to update the stage of an existing case.
You can choose from the following options: QUEUED, INITIAL, FOLLOW_UP, FINAL, or CLOSED.
Frequency (Optional) Updated frequency, if you want to update the frequency of an existing case.
You can choose from the following options: TEN_TO_FIFTEEN, NEVER_OR_ONCE, FIFTEEN, LESS_THAN_TEN, or MORE_THAN_FIFTEEN.
Operational Impact (Optional) Updated operational impact, if you want to update the operational impact of an existing case.
You can choose from the following options: NO_IMPACT, NO_IMMEDIATE_IMPACT, LOW_PRIORITY_IMPACT, HIGH_PRIORITY_IMPACT, or IMMEDIATE_IMPACT.
Security Classification (Optional) Updated security classification, if you want to update the security classification of an existing case.
You can choose from the following options: UNCLASSIFIED, CONFIDENTIAL, SECRET, or TOP_SECRET.
Consequence Severity (Optional) Updated consequence severity, if you want to update the consequence severity of an existing case.
You can choose from the following options: NONE, INSIGNIFICANT, MARGINAL, CRITICAL, or CATASTROPHIC.
Estimated Restore Date Time (Optional) Updates the Date and time for restoring the case, if required.
External ID (Optional) Updated External ID, if you want to update the Unique ID of the case.
Description (Optional) Updated description of the case.
Deprecated (Optional) Updates whether or not the case is deprecated.
Notification Group IDs (Optional) IDs of groups that should be notified when the case is updated.
Custom Fields (Optional) Use this field to set or update values that are not displayed in FortiSOAR™.

Output

The JSON output contains the details of the case updated on ArcSight ESM.

The output contains the following populated JSON schema:
{
"modifierName": "",
"creatorName": "",
"alias": "",
"type": "",
"reference": {
"referenceType": "",
"uri": "",
"referenceString": "",
"referenceName": "",
"isModifiable": "",
"id": "",
"managerID": ""
},
"displayID": "",
"initialized": "",
"createdTimestamp": "",
"attributeInitializationInProgress": "",
"deprecated": "",
"isAdditionalLoaded": "",
"state": "",
"estimatedRestoreTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTimestamp": "",
"name": "",
"localID": "",
"description": "",
"URI": "",
"estimatedStartTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"disabled": "",
"reportingLevel": "",
"numberOfOccurences": "",
"inCache": "",
"inactive": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"eventIDs": "",
"detectionTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
}
}

operation: Get Case Information

Input parameters

Parameter Description
Case ID ID of the case for which you want to retrieve the information from ArcSight ESM.

Output

The JSON output contains the details of the case, retrieved from ArcSight ESM, based on the specified case ID.

The output contains the following populated JSON schema:
{
"modifierName": "",
"creatorName": "",
"type": "",
"reference": {
"referenceType": "",
"uri": "",
"referenceString": "",
"referenceName": "",
"isModifiable": "",
"id": "",
"managerID": ""
},
"displayID": "",
"initialized": "",
"createdTimestamp": "",
"attributeInitializationInProgress": "",
"deprecated": "",
"isAdditionalLoaded": "",
"state": "",
"estimatedRestoreTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTimestamp": "",
"name": "",
"localID": "",
"description": "",
"URI": "",
"estimatedStartTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"disabled": "",
"reportingLevel": "",
"numberOfOccurences": "",
"inCache": "",
"inactive": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"eventIDs": "",
"detectionTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
}
}

operation: Add Events to Case

Input parameters

Parameter Description
Case ID ID of the case in which you want to add events.
Events IDs IDs of the events that you want to add to the specified case.
You must provide the Event IDs in the list format.

Output

The JSON output returns a Success message if the events are successfully added to the specified case ID, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Delete Case Events

Input parameters

Parameter Description
Case ID ID of the case from which you want to delete events.
Events IDs IDs of the events that you want to delete from the specified case.
You must provide the Event IDs in the list format.

Output

The JSON output returns a Success message if the events are successfully deleted from the specified case ID, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Search Query

Input parameters

Parameter Description
Query Query using which you want to search ArcSight ESM.
Start Position Position from where you want to start the search.
By default, this is set to 0.
Page Size Number of result records that you want to display on one page.
By default, this is set to 10.

Output

The JSON output contains the search results retrieved from ArcSight ESM, based on the specified query.

The output contains the following populated JSON schema:
{
"elapsed": "",
"queryStr": "",
"hitCount": "",
"statusString": "",
"searchHits": [
{
"uri": "",
"score": "",
"uuid": "",
"name": ""
}
],
"queryTerms": [],
"rewrittenQueryString": ""
}

operation: Download Report

Input parameters

Parameter Description
Report ID Download ID of the ArcSight report that you want to upload as an attachment in FortiSOAR™.
Note: You can get the ID of the report using the Run Report function.
Name of the file when added as an attachment in Cybersponse Name of the file when it is added as an attachment in FortiSOAR™.
If you do not specify any name, then the file by default is named as 'ArcSight Report'.

Output

The JSON output contains the details of the attachment in FortiSOAR™.

The output contains a non-dictionary value.

operation: Get Active List Information

Input parameters

Parameter Description
Active List ID Resource ID of the Active List for which you want to retrieve details from ArcSight ESM.

Output

The JSON output contains the details of the active list, retrieved from ArcSight ESM, based on the specified active list ID.

The output contains the following populated JSON schema:
{
"modifierName": "",
"multiMap": "",
"creatorName": "",
"inactive": "",
"type": "",
"reference": {
"referenceType": "",
"referenceString": "",
"isModifiable": "",
"referenceName": "",
"id": "",
"managerID": "",
"uri": ""
},
"caseSensitiveType": "",
"capacity": "",
"isAdditionalLoaded": "",
"keyFields": "",
"createdTimestamp": "",
"modifiedTimestamp": "",
"deprecated": "",
"timePartitioned": "",
"state": "",
"optimizeData": "",
"activeListType": "",
"attributeInitializationInProgress": "",
"name": "",
"localID": "",
"fieldTypes": "",
"fieldSubTypes": {},
"URI": "",
"initialized": "",
"entryTimeToLive": "",
"disabled": "",
"partialCache": "",
"inCache": "",
"fieldNames": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"timezoneID": "",
"milliSecond": "",
"month": "",
"second": "",
"year": "",
"minute": "",
"hour": ""
},
"modifiedTime": {
"day": "",
"timezoneID": "",
"milliSecond": "",
"month": "",
"second": "",
"year": "",
"minute": "",
"hour": ""
}
}

operation: Update Active List

Input parameters

Parameter Description
Active List ID Resource ID of the Active List that you want to update on ArcSight ESM.
Column Names List (Optional) List of column names that you want to update, i.e., columns in which you want to add entries.
By default, all the column names are included.
Entry List List of entries to add to the specified active list.
You must add the values in the same sequence as the columns specified.
For example, [[“val1”, “val2”], [“val3”, “val4”]]

Output

The JSON output returns a Success message if the active list is successfully updated on ArcSight or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Get Active List Entries

Input parameters

Parameter Description
Active List ID Resource ID of the active list for which you want to retrieve entries from HP ArcSight.
Clear Active List Entries Select this option, i.e., set it to True (default), to clear the entries of the specified active list after the active list is read.

Output

The output contains the following populated JSON schema:
{
"act.getEntriesResponse": {
"act.return": {
"columns": "",
"entryList": [
{
"entry": ""
}
]
}
}
}

operation: Clear Active List Entries

Input parameters

Parameter Description
Active List ID Resource ID of the Active List for which you want to clear entries from ArcSight ESM.

Output

The output response appears as follows if the entries are cleared successfully from the specified Active List:
Active List: <Active List ID> entries are cleared successfully.

operation: Get Fields

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"sei.getFieldsResponse": {
"sei.return": [
{
"fieldDisplayName": "",
"fieldType": {
"type": "",
"javaTypeName": "",
"name": ""
},
"sidetable": "",
"derived": "",
"groupDisplayName": "",
"simple": "",
"fieldName": "",
"reference": "",
"fieldIndex": "",
"copyOfFieldName": "",
"groupName": ""
}
]
}
}

Included playbooks

The Sample - HP ArcSight - 2.2.0 playbook collection comes bundled with the HP ArcSight connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the HP ArcSight connector.

  • Active List : Clear Active List Entries
  • Active List : Get Active List Entries
  • Active List : Get Active List Information
  • Active List : Update Active List
  • ArcSight > Create Alert (Uses the Get Event Details operation)
  • ArcSight > Fetch (Has ArcSight > Get Base Events as its child playbook)
  • >> ArcSight > Get Base Events
  • ArcSight > Ingest
  • Case : Add Events to Case
  • Case : Create Case
  • Case : Delete Case Events
  • Case : Get Case Information
  • Case : Update Case
  • Event : Annotate Event
  • Event : Get Fields
  • Report : Delete Report
  • Report : Download Report
  • Report : Run Report
  • Report : Run Report with Default Parameters
  • Search Query

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Troubleshooting

For troubleshooting, any issues with the Pull ArcSight Events Service, see the /var/log/cyops/cyops-integrations/arcsight/arcsight_reader.log log file.

Connection refusal while requesting to run the wrapper

This generally occurs in the case of self-signed SSL certificates. If you are using self-signed certificates for testing or staging, keep in mind this problem will not occur in production, and you might need to switch the certificates on or off.

Resolution:

Ensure that the SSL certificates are trusted or that SSL checking is turned off in the wrapper script. This is not advised for production instances.

Playbook fails after the ingestion is triggered

There are many reasons for a playbook failure, for example, if a required field is null in the target module record, or there are problems with the Playbook Appliance keys.

Resolution:

Investigate the reason for failure using the Running Playbooks tab in the Playbook Administration page. Review the step in which the failure is being generated and the result of the step, which should contain the trace of the error. Once you have identified the error and if you cannot troubleshoot the error, contact CyberSponse support for further assistance.https://arrow.readthedocs.io/en/latest/

Previous
Next

About the connector

ArcSight Enterprise Security Manager (ESM) is a threat detection, analysis, triage, and compliance management SIEM platform.

This document provides information about the HP ArcSight connector, which facilitates automated interactions, with an ArcSight ESM server using FortiSOAR™ playbooks. Add the HP ArcSight connector as a step in FortiSOAR™ playbooks and perform automated operations, such as annotating events, running a report based on a report ID, and uploading an ArcSight report file as an attachment in FortiSOAR™.

Version information

Connector Version: 2.2.0

FortiSOAR™ Version Tested on: 5.1.0-464

HP ArcSight Version Tested on: 6.11

Authored By: Fortinet

Certified: Yes

Release Notes for version 2.2.0

Following enhancements have been made to the HP ArcSight Connector in version 2.2.0:

Installing the connector

From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the yum command to install connectors. Connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and run the yum command as a root user to install connectors:

yum install cyops-connector-arcsight

Prerequisites to configuring the connector

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the HP ArcSight connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Parameter Description
Server URL IP Address or FQDN of the ArcSight ESM server to which you will connect and perform automated operations.
ESM Port REST API port of the ArcSight ESM server.
Defaults to 8443.
Username Username to access the ArcSight ESM server.
Password Password to access the ArcSight ESM server.
Verify SSL Specifies whether the SSL certificate for the server is to be verified or not.
By default, this option is set as True.
Do Not Fail Connector Function On API Error? If you select this option, i.e., set this option as True, then connector operation will not fail even when the ArcSight REST API returns a failure.
Enable Pull ArcSight Events Service If you select this option, i.e., set this option as True (default), then ArcSight events will be pulled.
If you select this option, then you must specify the following parameters:
  • Active List ID: Resource ID of the Active List for which you want to retrieve events from ArcSight ESM.
  • Playbook Trigger: The string used to trigger the playbook.
    Note: The playbook authentication method should be set as HMAC.
  • Reader Port: Port used for communication between FortiSOAR™ and the ArcSight Active List Reader. 10012 is the default port number. You can specify any unused port number if the default port is unavailable. You can also use a similar port number for multiple ArcSight connector configurations as the ArcSight Active List Reader process is capable of communicating with multiple ArcSight servers.
  • Poll Interval: Poll Interval, in seconds, that determines how frequently the ArcSight Active List Reader polls the active list for event IDs.
    Note: 300 seconds is the default poll interval.

Important: To run the Enable Pull ArcSight Events Service, you must Import the CyOPs_Package.arb in ArcSight. Steps to import the CyOPs_Package.arb in ArcSight, is mentioned in the "Importing the CyOPs_Package.arb package in ArcSight" section.
Also, ensure that the playbook whose trigger you have specified in the Playbook Trigger parameter is in the Active state. This ensures that you experience seamless event reading from ArcSight ESM.

Importing the CyOPs_Package.arb package in ArcSight

  1. Locate the CyOPs_Package.arb package that is present in the ArcSight connector folder (/opt/cyops-integrations/integrations/connectors/arcsight_2_0_0/CyOPs_Package.arb). The .arb file is also attached with this document and can be downloaded for use.
  2. To import the CyOPs_Package.arb package in ArcSight, navigate to the Packages tab in ArcSight as shown in the following image:
  3. Click Import and select the CyOPs_Package.arb package.
    The CyOPs_Package.arb package contains two items: Active List (CyOPs_Event_collector) and Rule (CyOPs Active List Rule).
    Once the CyOPs_Package.arb package is imported successfully, the CyOPs Active List Rules will appear in ArcSight as follows:
    Once the CyOPs_Package.arb package is imported successfully, the CyOPs_Event_collector will appear in ArcSight as follows:

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 onwards:

Function Description Annotation and Category
Annotate Event Updates an ArcSight Event Stage, assigns it to a user and adds a comment. annotate_event
Investigation
Get Event Details Retrieves information for events from the ArcSight ESM server, based on event IDs and other input parameters you have specified. get_event_info
Investigation
Run Report with Default Parameters Runs a report based on an ID or URI and default inputs on the ArcSight ESM server. run_report
Investigation
Run Report Runs a report based on an ID and custom user inputs on the ArcSight ESM server. run_report
Investigation
Delete Report Deletes an archived report from the ArcSight ESM server, based on the Resource ID you have specified. delete_report
Remediation
Create Case Creates a case in ArcSight ESM, based on the input parameters you have specified. create_case
Investigation
Update Case Updates an existing case in ArcSight ESM, based on the input parameters you have specified. update_case_info
Investigation
Get Case Information Retrieves information about a case from ArcSight ESM, based on the case ID you have specified. get_case_info
Investigation
Add Events to Case Adds the specified events to an existing case in ArcSight ESM, based on the case ID you have specified. add_events
Investigation
Delete Case Events Deletes the specified events from an existing case from ArcSight ESM, based on the case ID you have specified. delete_events
Remediation
Search Query Searches ArcSight ESM records based on the query you have specified. search_query
Investigation
Download Report Downloads a report based on an ID from ArcSight ESM and then upload that report as an attachment in the FortiSOAR™ Attachment Module. upload_report
Investigation
Get Active List Information Retrieves information about an active list from ArcSight ESM, based on the Active List ID you have specified. get_active_list_info
Investigation
Update Active List Adds new items to a specified on ArcSight ESM, based on the Active List ID and other input parameters you have specified. update_active_list
Investigation
Get Active List Entries Retrieves entries for a specified active list, based on the Active List ID you have specified. get_active_list_entries
Investigation
Clear Active List Entries Clear entries for a specified active list, based on the Active List ID you have specified. clear_active_list_entries
Remediation
Get Fields Retrieves details of all fields from ArcSight ESM. get_fields
Investigation

operation: Annotate Event

You can annotate ArcSight Events using the ArcSight Console to update the Stage and Assignee of the event and to add comments to the event.

ArcSight Console: Update Stage and Add Comments to the event

ArcSight Console: Update Assignee of the event

You can also perform similar operations using the Annotate Event function in FortiSOAR™ playbooks.

Input parameters

Parameter Description
Event ID The ID of the ArcSight Event that you want to annotate.
Stage The Stage to be set for the Event. You can choose from one of the following values:
Queued/Initial/Monitoring/Rule Created/Follow-Up/Final/Flagged as Similar/Closed
User An existing ArcSight user to whom you want to assign the event. For example, admin.
Comment The comment that you want to add to the event.

Output

The JSON output returns a Success message if the ArcSight ESM event is annotated successful or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Get Event Details

Input parameters

Parameter Description
Event IDs IDs of ArcSight Events whose details you want to retrieve from ArcSight. You can add multiple IDs using the CSV or list format.
Replace Null Values with Empty String? If an event field is not set, the ArcSight APIs return the following values. Use this option to replace these values with an empty string. Note that, by default, the Replace Null Values with Empty String? field is set to True.
Field Type integer: Returned value in place of NULL: -2147483648 (Integer.MIN_VALUE)
Field Type long: Returned value in place of NULL: -9223372036854775808 (Long.MIN_VALUE)
Field Type double: Returned value in place of NULL: 5e-324 (Double.MIN_VALUE
IP Address Keys to Parse (Optional) ArcSight API returns the IP address fields in decimal format. Provide a comma-separated list of field names you want to convert from decimal to IP address format.
Defaults to address.
MAC Address Keys to Parse (Optional) ArcSight API returns the MAC address fields in decimal format. Provide a comma-separated list of field names you want to convert from decimal to MAC address format.
Defaults to macAddress,translatedAddress.
Fields Name (Optional) Specify field names if you wants to retrieve a specific set of columns from HP ArcSight.
Time Field Names (Optional) Specify a comma-separated list or array of field names for which you want to perform time conversion in the output of this operation.
Date Time Format (Optional) Specify the DateTime format for converting the time fields. You must specify a DateTime format that is supported by the arrow library. For more information on the arrow library, see https://arrow.readthedocs.io/en/latest/

Output

The JSON output contains the details of the event, based on the specified event ID and other input parameters, retrieved from ArcSight ESM.

The output contains the following populated JSON schema:
{
"endTime": "",
"ttl": "",
"severity": "",
"locality": "",
"domainFp5": "",
"domainFp2": "",
"domainNumber3": "",
"name": "",
"domainFp6": "",
"domainFp1": "",
"deviceCustomFloatingPoint2": "",
"deviceCustomString2": "",
"domainDate6": "",
"originalAgent": {
"name": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"type": "",
"addressAsBytes": "",
"macAddress": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"id": ""
},
"domainNumber8": "",
"domainNumber6": "",
"deviceCustomFloatingPoint4": "",
"type": "",
"startTime": "",
"domainIpv4addr1": "",
"destination": {
"translatedPort": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"geo": {
"mutable": "",
"longitude": "",
"latitudeLong": "",
"longitudeLong": "",
"latitude": ""
},
"assetId": "",
"processId": "",
"addressAsBytes": "",
"port": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
&nbsnbsp; "isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"macAddress": ""
},
"domainIpv4addr3": "",
"domainNumber5": "",
"domainFp8": "",
"domainFp4": "",
"deviceEventClassId": "",
"agentReceiptTime": "",
"persistence": "",
"managerId": "",
"deviceSeverity": "",
"deviceCustomFloatingPoint3": "",
"deviceCustomString1": "",
"flexNumber1": "",
"domainDate1": "",
"domainNumber12": "",
"deviceReceiptTime": "",
"deviceEventCategory": "",
"category": {
"outcome": "",
"object": "",
"mutable": "",
"significance": "",
"behavior": "",
"deviceGroup": ""
},
"deviceCustom": {
"mutable": "",
"number1Label": "",
"string1Label": "",
"string2Label": ""
},
"domainIpv4addr2": "",
"deviceCustomDate2": "",
"modelConfidence": "",
"correlatedEventCount": "",
"deviceCustomDate1": "",
"managerReceiptTime": "",
"baseEventCount": "",
"domainNumber13": "",
"aggregatedEventCount": "",
"deviceCustomFloatingPoint1": "",
"domainDate3": "",
"domainFp7": "",
"deviceCustomNumber3": "",
"assetCriticality": "",
"deviceDirection": "",
"domainIpv4addr4": "",
"agentSeverity": "",
"eventAnnotation": {
"endTime": "",
"stage": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"version": "",
"modificationTime": "",
"eventId": "",
"managerReceiptTime": "",
"flags": "",
"auditTrail": "",
"stageUpdateTime": ""
},
"agent": {
"name": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"type": "",
"addressAsBytes": "",
"macAddress": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"id": ""
},
"domainDate5": "",
"deviceProcessId": "",
"relevance": "",
"finalDevice": {
"product": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"addressAsBytes": "",
"vendor": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"macAddress": ""
},
"domainNumber11": "",
"sessionId": "",
"deviceCustomNumber2": "",
"flexDate1": "",
"bytesIn": "",
"concentratorDevices": {
"product": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"addressAsBytes": "",
"vendor": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"macAddress": ""
},
"domainDate2": "",
"deviceCustomNumber1": "",
"device": {
"product": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"addressAsBytes": "",
"vendor": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"macAddress": ""
},
"originator": "",
"domainNumber9": "",
"domainNumber1": "",
"priority": "",
nbsp; "domainDate4": "",
"flexNumber2": "",
"domainNumber7": "",
"eventId": "",
"domainFp3": "",
"domainNumber2": "",
"domainNumber4": "",
"concentratorAgents": {
"name": "",
"assetName": "",
"address": "",
"translatedAddress": "",
"assetId": "",
"version": "",
"type": "",
"addressAsBytes": "",
"macAddress": "",
"mutable": "",
"hostName": "",
"zone": {
"referenceID": "",
"managerID": "",
"uri": "",
"isModifiable": "",
"referenceString": "",
"referenceType": "",
"referenceName": "",
"id": ""
},
"assetLocalId": "",
"id": ""
},
"bytesOut": "",
"domainNumber10": ""
}

operation: Run Report with Default Parameters

You can get the ID for a report (Resource ID) from the ArcSight Console, as shown in the following image:

ArcSight Console - Resource ID

You can get the URI for a report from the ArcSight Console. To get the URI, you must add the report name to the parent resource, as shown in the following image:

ArcSight Console - Parent Groups: Resources

Input parameters

Parameter Description
Run Report By Parameter of the report based on which you want to run a report on ArcSight ESM. You can choose between Report ID or Report URI.
Report URI or Report ID ID or URI of the ArcSight report that you want to run on ArcSight ESM.

Output

The JSON output returns the Download ID of the report. You can use this Download ID to download the report subsequently when the report is ready. You can use the "Download Report" operation to download the report and add it as an attachment to FortiSOAR™.

The output contains a non-dictionary value.

operation: Run Report

Input parameters

Parameter Description
Report Id ID of the ArcSight report that you want to run.
Input parameters Input parameters in the JSON format.
For example, {'StartTime': '$Now - 3h', 'Report Format': '0'}.
The keys are the same as seen on the ArcSight console. Note that the values for the drop-down fields are their integer positions. For example, the Report Format should be specified as 0, 1, 2, etc., and not as pdf, csv, html, etc.

Output

The JSON output returns the Download ID of the report. You can use this Download ID to download the report subsequently when the report is ready. You can use the "Download Report" operation to download the report and add it as an attachment to FortiSOAR™.

The output contains a non-dictionary value.

operation: Delete Report

Input parameters

Parameter Description
Report ID ID of the archived ArcSight report that you want to delete from ArcSight ESM.

Output

The JSON output returns a Success message if the specified report is deleted from ArcSight ESM, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Create Case

Input parameters

Parameter Description
Parent Group ID Parent Group ID of the case you want to create.
Case Name Name of the case that you want to create.
Alias (Display Name) (Optional) Alias or Display Name of the case that you want to create.
Ticket Type (Optional) Ticket type of the case you want to create.
You can choose from the following options: INTERNAL, CLIENT, or INCIDENT.
Stage (Optional) Stage that you want to assign to the created case.
You can choose from the following options: QUEUED, INITIAL, FOLLOW_UP, FINAL, or CLOSED.
Frequency (Optional) Frequency that you want to assign to the created case.
You can choose from the following options: TEN_TO_FIFTEEN, NEVER_OR_ONCE, FIFTEEN, LESS_THAN_TEN, or MORE_THAN_FIFTEEN.
Operational Impact (Optional) Operational Impact that you want to assign to the created case.
You can choose from the following options: NO_IMPACT, NO_IMMEDIATE_IMPACT, LOW_PRIORITY_IMPACT, HIGH_PRIORITY_IMPACT, or IMMEDIATE_IMPACT.
Security Classification (Optional) Security Classification that you want to assign to the created case.
You can choose from the following options: UNCLASSIFIED, CONFIDENTIAL, SECRET, or TOP_SECRET.
Consequence Severity (Optional) Consequence Severity that you want to assign to the created case.
You can choose from the following options: NONE, INSIGNIFICANT, MARGINAL, CRITICAL, or CATASTROPHIC.
External ID (Optional) Unique ID of the case you want to create.
Description (Optional) Description of the case you want to create.
Deprecated (Optional) Whether or not the created case is deprecated.
Additional attributes in json format (Optional) Use this field to set values that are not displayed in FortiSOAR™.

Output

The JSON output contains the case ID and the details of the case created on ArcSight ESM.

The output contains the following populated JSON schema:
{
"modifierName": "",
"creatorName": "",
"type": "",
"reference": {
"referenceType": "",
"uri": "",
"referenceString": "",
"referenceName": "",
"isModifiable": "",
"id": "",
"managerID": ""
},
"displayID": "",
"createdTimestamp": "",
"attributeInitializationInProgress": "",
"deprecated": "",
"isAdditionalLoaded": "",
"state": "",
"estimatedRestoreTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTimestamp": "",
"name": "",
"localID": "",
"description": "",
"URI": "",
"initialized": "",
"disabled": "",
"reportingLevel": "",
"numberOfOccurences": "",
"inCache": "",
"inactive": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
}
}

operation: Update Case

Input parameters

Parameter Description
Case ID ID of the case you want to update.
Case Name (Optional) Updated case name, if you want to update the name of an existing case.
Alias (Display Name) (Optional) Alias or Display Name of the case that you want to update.
Ticket Type (Optional) Ticket type of the case you want to update.
You can choose from the following options: INTERNAL, CLIENT, or INCIDENT.
Stage (Optional) Updated stage, if you want to update the stage of an existing case.
You can choose from the following options: QUEUED, INITIAL, FOLLOW_UP, FINAL, or CLOSED.
Frequency (Optional) Updated frequency, if you want to update the frequency of an existing case.
You can choose from the following options: TEN_TO_FIFTEEN, NEVER_OR_ONCE, FIFTEEN, LESS_THAN_TEN, or MORE_THAN_FIFTEEN.
Operational Impact (Optional) Updated operational impact, if you want to update the operational impact of an existing case.
You can choose from the following options: NO_IMPACT, NO_IMMEDIATE_IMPACT, LOW_PRIORITY_IMPACT, HIGH_PRIORITY_IMPACT, or IMMEDIATE_IMPACT.
Security Classification (Optional) Updated security classification, if you want to update the security classification of an existing case.
You can choose from the following options: UNCLASSIFIED, CONFIDENTIAL, SECRET, or TOP_SECRET.
Consequence Severity (Optional) Updated consequence severity, if you want to update the consequence severity of an existing case.
You can choose from the following options: NONE, INSIGNIFICANT, MARGINAL, CRITICAL, or CATASTROPHIC.
Estimated Restore Date Time (Optional) Updates the Date and time for restoring the case, if required.
External ID (Optional) Updated External ID, if you want to update the Unique ID of the case.
Description (Optional) Updated description of the case.
Deprecated (Optional) Updates whether or not the case is deprecated.
Notification Group IDs (Optional) IDs of groups that should be notified when the case is updated.
Custom Fields (Optional) Use this field to set or update values that are not displayed in FortiSOAR™.

Output

The JSON output contains the details of the case updated on ArcSight ESM.

The output contains the following populated JSON schema:
{
"modifierName": "",
"creatorName": "",
"alias": "",
"type": "",
"reference": {
"referenceType": "",
"uri": "",
"referenceString": "",
"referenceName": "",
"isModifiable": "",
"id": "",
"managerID": ""
},
"displayID": "",
"initialized": "",
"createdTimestamp": "",
"attributeInitializationInProgress": "",
"deprecated": "",
"isAdditionalLoaded": "",
"state": "",
"estimatedRestoreTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTimestamp": "",
"name": "",
"localID": "",
"description": "",
"URI": "",
"estimatedStartTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"disabled": "",
"reportingLevel": "",
"numberOfOccurences": "",
"inCache": "",
"inactive": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"eventIDs": "",
"detectionTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
}
}

operation: Get Case Information

Input parameters

Parameter Description
Case ID ID of the case for which you want to retrieve the information from ArcSight ESM.

Output

The JSON output contains the details of the case, retrieved from ArcSight ESM, based on the specified case ID.

The output contains the following populated JSON schema:
{
"modifierName": "",
"creatorName": "",
"type": "",
"reference": {
"referenceType": "",
"uri": "",
"referenceString": "",
"referenceName": "",
"isModifiable": "",
"id": "",
"managerID": ""
},
"displayID": "",
"initialized": "",
"createdTimestamp": "",
"attributeInitializationInProgress": "",
"deprecated": "",
"isAdditionalLoaded": "",
"state": "",
"estimatedRestoreTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTimestamp": "",
"name": "",
"localID": "",
"description": "",
"URI": "",
"estimatedStartTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"disabled": "",
"reportingLevel": "",
"numberOfOccurences": "",
"inCache": "",
"inactive": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"eventIDs": "",
"detectionTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
}
}

operation: Add Events to Case

Input parameters

Parameter Description
Case ID ID of the case in which you want to add events.
Events IDs IDs of the events that you want to add to the specified case.
You must provide the Event IDs in the list format.

Output

The JSON output returns a Success message if the events are successfully added to the specified case ID, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Delete Case Events

Input parameters

Parameter Description
Case ID ID of the case from which you want to delete events.
Events IDs IDs of the events that you want to delete from the specified case.
You must provide the Event IDs in the list format.

Output

The JSON output returns a Success message if the events are successfully deleted from the specified case ID, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Search Query

Input parameters

Parameter Description
Query Query using which you want to search ArcSight ESM.
Start Position Position from where you want to start the search.
By default, this is set to 0.
Page Size Number of result records that you want to display on one page.
By default, this is set to 10.

Output

The JSON output contains the search results retrieved from ArcSight ESM, based on the specified query.

The output contains the following populated JSON schema:
{
"elapsed": "",
"queryStr": "",
"hitCount": "",
"statusString": "",
"searchHits": [
{
"uri": "",
"score": "",
"uuid": "",
"name": ""
}
],
"queryTerms": [],
"rewrittenQueryString": ""
}

operation: Download Report

Input parameters

Parameter Description
Report ID Download ID of the ArcSight report that you want to upload as an attachment in FortiSOAR™.
Note: You can get the ID of the report using the Run Report function.
Name of the file when added as an attachment in Cybersponse Name of the file when it is added as an attachment in FortiSOAR™.
If you do not specify any name, then the file by default is named as 'ArcSight Report'.

Output

The JSON output contains the details of the attachment in FortiSOAR™.

The output contains a non-dictionary value.

operation: Get Active List Information

Input parameters

Parameter Description
Active List ID Resource ID of the Active List for which you want to retrieve details from ArcSight ESM.

Output

The JSON output contains the details of the active list, retrieved from ArcSight ESM, based on the specified active list ID.

The output contains the following populated JSON schema:
{
"modifierName": "",
"multiMap": "",
"creatorName": "",
"inactive": "",
"type": "",
"reference": {
"referenceType": "",
"referenceString": "",
"isModifiable": "",
"referenceName": "",
"id": "",
"managerID": "",
"uri": ""
},
"caseSensitiveType": "",
"capacity": "",
"isAdditionalLoaded": "",
"keyFields": "",
"createdTimestamp": "",
"modifiedTimestamp": "",
"deprecated": "",
"timePartitioned": "",
"state": "",
"optimizeData": "",
"activeListType": "",
"attributeInitializationInProgress": "",
"name": "",
"localID": "",
"fieldTypes": "",
"fieldSubTypes": {},
"URI": "",
"initialized": "",
"entryTimeToLive": "",
"disabled": "",
"partialCache": "",
"inCache": "",
"fieldNames": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"timezoneID": "",
"milliSecond": "",
"month": "",
"second": "",
"year": "",
"minute": "",
"hour": ""
},
"modifiedTime": {
"day": "",
"timezoneID": "",
"milliSecond": "",
"month": "",
"second": "",
"year": "",
"minute": "",
"hour": ""
}
}

operation: Update Active List

Input parameters

Parameter Description
Active List ID Resource ID of the Active List that you want to update on ArcSight ESM.
Column Names List (Optional) List of column names that you want to update, i.e., columns in which you want to add entries.
By default, all the column names are included.
Entry List List of entries to add to the specified active list.
You must add the values in the same sequence as the columns specified.
For example, [[“val1”, “val2”], [“val3”, “val4”]]

Output

The JSON output returns a Success message if the active list is successfully updated on ArcSight or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Get Active List Entries

Input parameters

Parameter Description
Active List ID Resource ID of the active list for which you want to retrieve entries from HP ArcSight.
Clear Active List Entries Select this option, i.e., set it to True (default), to clear the entries of the specified active list after the active list is read.

Output

The output contains the following populated JSON schema:
{
"act.getEntriesResponse": {
"act.return": {
"columns": "",
"entryList": [
{
"entry": ""
}
]
}
}
}

operation: Clear Active List Entries

Input parameters

Parameter Description
Active List ID Resource ID of the Active List for which you want to clear entries from ArcSight ESM.

Output

The output response appears as follows if the entries are cleared successfully from the specified Active List:
Active List: <Active List ID> entries are cleared successfully.

operation: Get Fields

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"sei.getFieldsResponse": {
"sei.return": [
{
"fieldDisplayName": "",
"fieldType": {
"type": "",
"javaTypeName": "",
"name": ""
},
"sidetable": "",
"derived": "",
"groupDisplayName": "",
"simple": "",
"fieldName": "",
"reference": "",
"fieldIndex": "",
"copyOfFieldName": "",
"groupName": ""
}
]
}
}

Included playbooks

The Sample - HP ArcSight - 2.2.0 playbook collection comes bundled with the HP ArcSight connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the HP ArcSight connector.

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Troubleshooting

For troubleshooting, any issues with the Pull ArcSight Events Service, see the /var/log/cyops/cyops-integrations/arcsight/arcsight_reader.log log file.

Connection refusal while requesting to run the wrapper

This generally occurs in the case of self-signed SSL certificates. If you are using self-signed certificates for testing or staging, keep in mind this problem will not occur in production, and you might need to switch the certificates on or off.

Resolution:

Ensure that the SSL certificates are trusted or that SSL checking is turned off in the wrapper script. This is not advised for production instances.

Playbook fails after the ingestion is triggered

There are many reasons for a playbook failure, for example, if a required field is null in the target module record, or there are problems with the Playbook Appliance keys.

Resolution:

Investigate the reason for failure using the Running Playbooks tab in the Playbook Administration page. Review the step in which the failure is being generated and the result of the step, which should contain the trace of the error. Once you have identified the error and if you cannot troubleshoot the error, contact CyberSponse support for further assistance.https://arrow.readthedocs.io/en/latest/

Previous
Next