Micro Focus ArcSight ESM v3.1.1

About the connector

ArcSight Enterprise Security Manager (ESM) is a threat detection, analysis, triage, and compliance management SIEM platform.

This document provides information about the Micro Focus ArcSight ESM connector, which facilitates automated interactions, with an ArcSight ESM server using FortiSOAR™ playbooks. Add the Micro Focus ArcSight ESM connector as a step in FortiSOAR™ playbooks and perform automated operations, such as annotating events, running a report based on a report ID, and uploading an ArcSight report file as an attachment in FortiSOAR™.

You can configure ArcSight ESM and FortiSOAR™ so that FortiSOAR™ ingests correlated events from ArcSight ESM and converts them into an alert in FortiSOAR™. For more information, see the ArcSight ESM and FortiSOAR™ integration section. If you are using sample data ingestion playbooks that belong to version earlier to 3.1.1 and you want to address the data loss issue, then follow the steps mentioned in the Data Ingestion Playbooks - Solving the Data Loss Issue section.

Version information

Connector Version: 3.1.1

FortiSOAR™ Version Tested on: 6.4.3-2885

Micro Focus ArcSight ESM Version Tested on: 7.0

Authored By: Fortinet

Certified: Yes

Release Notes for version 3.1.1

Following enhancements have been made to the Micro Focus ArcSight ESM connector in version 3.1.1:

• Renamed the connector from Micro Focus ArcSight to Micro Focus ArcSight ESM.
• Updated the output schema of the "Get Event Details" action.
• Deprecated the "Enable Pull ArcSight Events Service(Listener)" configuration parameter.
• Updated the data ingestion playbooks to address data loss. Earlier, the active list entries were deleted as soon as FortiSOAR™ reads the entries using the listener, but if playbooks fail to create records for those entries, which could lead to data (record) loss. Now, the playbooks have been we have updated to add those entries back to an active list.
• Changed the Listener script to address backward compatibility by deleting the active list entries immediately after the active list entries are read.
• Fixed an ArcSight event listener script bug to resolve the issue of the listener stopping intermittently.
• Changed the "Update Active List" operation to make the 'Active List ID' parameter as optional.
• Added input validation for actions.

Installing the connector

From FortiSOAR™ 5.0.0 onwards, use the Connector Store to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root user to install connectors from an SSH session:

yum install cyops-connector-arcsight

Important: Upgrading the connector from 2.x to 3.x is not backward compatible because explicit changes are needed in the existing playbooks to delete the 'Active List Entries" after Alerts are created in FortiSOAR™.

Prerequisites to configuring the connector

• You must have the IP Address or FQDN of ArcSight ESM server and credentials to access the server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the ArcSight ESM server.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Micro Focus ArcSight connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from version 4.10.0 onwards:

operation: Annotate Event

You can annotate ArcSight Events using the ArcSight Console to update the Stage and Assignee of the event and to add comments to the event.

You can also perform similar operations using the Annotate Event function in FortiSOAR™ playbooks.

Input parameters

Output

The JSON output returns a Success message if the ArcSight ESM event is annotated successful or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Annotate Event By Stage ID

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Event Details

Input parameters

Output

The JSON output contains the details of the event, based on the specified event ID and other input parameters, retrieved from ArcSight ESM.

The output contains the following populated JSON schema:
[{
"ttl": "",
"name": "",
"type": "",
"agent": {
"id": "",
"name": "",
"type": "",
"zone": {
"id": "",
"uri": "",
"managerID": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"address": "",
"assetId": "",
"mutable": "",
"version": "",
"hostName": "",
"assetName": "",
nbsp; "macAddress": "",
"assetLocalId": "",
"addressAsBytes": "",
"translatedAddress": ""
},
"device": {
"zone": {
"id": "",
"uri": "",
"managerID": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"vendor": "",
"address": "",
"assetId": "",
"mutable": "",
"product": "",
"version": "",
"hostName": "",
"assetName": "",
"macAddress": "",
"assetLocalId": "",
"addressAsBytes": "",
"translatedAddress": ""
},
"bytesIn": "",
"endTime": "",
"eventId": "",
"bytesOut": "",
"category": {
"object": "",
"mutable": "",
"outcome": "",
"behavior": "",
"deviceGroup": "",
"significance": ""
},
"locality": "",
"priority": "",
"severity": "",
"domainFp1": "",
"domainFp2": "",
"domainFp3": "",
"domainFp4": "",
"domainFp5": "",
"domainFp6": "",
"domainFp7": "",
"domainFp8": "",
"flexDate1": "",
"managerId": "",
"relevance": "",
"sessionId": "",
"startTime": "",
"originator": "",
"destination": {
"geo": {
"mutable": "",
"latitude": "",
"longitude": "",
"latitudeLong": "",
"longitudeLong": ""
},
"port": "",
"zone": {
"id": "",
"uri": "",
"managerID": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"address": "",
"assetId": "",
"mutable": "",
"hostName": "",
"assetName": "",
"processId": "",
"macAddress": "",
"assetLocalId": "",
"addressAsBytes": "",
"translatedPort": "",
"translatedAddress": ""
},
"domainDate1": "",
"domainDate2": "",
"domainDate3": "",
"domainDate4": "",
"domainDate5": "",
"domainDate6": "",
"finalDevice": {
"zone": {
"id": "",
"uri": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"vendor": "",
"address": "",
"assetId": "",
"mutable": "",
"product": "",
"version": "",
"hostName": "",
"assetName": "",
"macAddress": "",
"assetLocalId": "",
"addressAsBytes": "",
"translatedAddress": ""
},
"flexNumber1": "",
"flexNumber2": "",
"persistence": "",
"deviceCustom": {
"mutable": "",
"number1Label": "",
"string1Label": "",
"string2Label": ""
},
"agentSeverity": "",
"domainNumber1": "",
"domainNumber2": "",
"domainNumber3": "",
"domainNumber4": "",
"domainNumber5": "",
"domainNumber6": "",
"domainNumber7": "",
"domainNumber8": "",
"domainNumber9": "",
"originalAgent": {
"id": "",
"name": "",
"type": "",
"zone": {
"id": "",
"uri": "",
"managerID": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"address": "",
"assetId": "",
"mutable": "",
"version": "",
"hostName": "",
"assetName": "",
"macAddress": "",
"assetLocalId": "",
"addressAsBytes": "",
"translatedAddress": ""
},
"baseEventCount": "",
"deviceSeverity": "",
"domainNumber10": "",
"domainNumber11": "",
"domainNumber12": "",
"domainNumber13": "",
"deviceDirection": "",
"deviceProcessId": "",
"domainIpv4addr1": "",
"domainIpv4addr2": "",
"domainIpv4addr3": "",
"domainIpv4addr4": "",
"eventAnnotation": {
"flags": "",
"stage": {
"id": "",
"uri": "",
"managerID": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"comment": "",
"endTime": "",
"eventId": "",
"version": "",
"stageUser": {
"id": "",
"uri": "",
"managerID": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"auditTrail": "",
"modifiedBy": {
"id": "",
"uri": "",
"managerID": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"stageUpdateTime": "",
"modificationTime": "",
"managerReceiptTime": ""
},
"modelConfidence": "",
"agentReceiptTime": "",
"assetCriticality": "",
"deviceCustomDate1": "",
"deviceCustomDate2": "",
"deviceReceiptTime": "",
"concentratorAgents": {
"id": "",
"name": "",
"type": "",
"zone": {
"id": "",
"uri": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"address": "",
"assetId": "",
"mutable": "",
"version": "",
"hostName": "",
"assetName": "",
"macAddress": "",
"assetLocalId": "",
"addressAsBytes": "",
"translatedAddress": ""
},
"deviceEventClassId": "",
"managerReceiptTime": "",
"concentratorDevices": {
"zone": {
"id": "",
"uri": "",
"managerID": "",
"referenceID": "",
"isModifiable": "",
"referenceName": "",
"referenceType": "",
"referenceString": ""
},
"vendor": "",
"address": "",
"assetId": "",
"mutable": "",
"product": "",
"version": "",
"hostName": "",
"assetName": "",
"macAddress": "",
"assetLocalId": "",
"addressAsBytes": "",
"translatedAddress": ""
},
"deviceCustomNumber1": "",
"deviceCustomNumber2": "",
"deviceCustomNumber3": "",
"deviceCustomString1": "",
"deviceCustomString2": "",
"deviceEventCategory": "",
"aggregatedEventCount": "",
"correlatedEventCount": "",
"deviceCustomFloatingPoint1": "",
"deviceCustomFloatingPoint2": "",
"deviceCustomFloatingPoint3": "",
"deviceCustomFloatingPoint4": ""
}]

operation: Run Report with Default Parameters

You can get the ID for a report (Resource ID) from the ArcSight Console, as shown in the following image:

You can get the URI for a report from the ArcSight Console. To get the URI, you must add the report name to the parent resource, as shown in the following image:

Input parameters

Output

The JSON output returns the Download ID of the report. You can use this Download ID to download the report subsequently when the report is ready. You can use the "Download Report" operation to download the report and add it as an attachment in FortiSOAR™.

The output contains a non-dictionary value.

operation: Run Report

Input parameters

Output

The JSON output returns the Download ID of the report. You can use this Download ID to download the report subsequently when the report is ready. You can use the "Download Report" operation to download the report and add it as an attachment to FortiSOAR™.

The output contains a non-dictionary value.

operation: Delete Report

Input parameters

Output

The JSON output returns a Success message if the specified report is deleted from ArcSight ESM, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Create Case

Input parameters

Output

The JSON output contains the case ID and the details of the case created on ArcSight ESM.

The output contains the following populated JSON schema:
{
"modifierName": "",
"creatorName": "",
"type": "",
"reference": {
"referenceType": "",
"uri": "",
"referenceString": "",
"referenceName": "",
"isModifiable": "",
"id": "",
"managerID": ""
},
"displayID": "",
"createdTimestamp": "",
"attributeInitializationInProgress": "",
"deprecated": "",
"isAdditionalLoaded": "",
"state": "",
"estimatedRestoreTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTimestamp": "",
"name": "",
"localID": "",
"description": "",
"URI": "",
"initialized": "",
"disabled": "",
"reportingLevel": "",
"numberOfOccurences": "",
"inCache": "",
"inactive": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
}
}

operation: Update Case

Input parameters

Output

The JSON output contains the details of the case updated on ArcSight ESM.

The output contains the following populated JSON schema:
{
"modifierName": "",
"creatorName": "",
"alias": "",
"type": "",
"reference": {
"referenceType": "",
"uri": "",
"referenceString": "",
"referenceName": "",
"isModifiable": "",
"id": "",
"managerID": ""
},
"displayID": "",
"initialized": "",
"createdTimestamp": "",
"attributeInitializationInProgress": "",
"deprecated": "",
"isAdditionalLoaded": "",
"state": "",
"estimatedRestoreTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTimestamp": "",
"name": "",
"localID": "",
"description": "",
"URI": "",
"estimatedStartTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"disabled": "",
"reportingLevel": "",
"numberOfOccurences": "",
"inCache": "",
"inactive": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"eventIDs": "",
"detectionTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
}
}

operation: Get Case Information

Input parameters

Output

The JSON output contains the details of the case, retrieved from ArcSight ESM, based on the specified case ID.

The output contains the following populated JSON schema:
{
"modifierName": "",
"creatorName": "",
"type": "",
"reference": {
"referenceType": "",
"uri": "",
"referenceString": "",
"referenceName": "",
"isModifiable": "",
"id": "",
"managerID": ""
},
"displayID": "",
"initialized": "",
"createdTimestamp": "",
"attributeInitializationInProgress": "",
"deprecated": "",
"isAdditionalLoaded": "",
"state": "",
"estimatedRestoreTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTimestamp": "",
"name": "",
"localID": "",
"description": "",
"URI": "",
"estimatedStartTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"disabled": "",
"reportingLevel": "",
"numberOfOccurences": "",
"inCache": "",
"inactive": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"modifiedTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
},
"eventIDs": "",
"detectionTime": {
"day": "",
"minute": "",
"year": "",
"hour": "",
"timezoneID": "",
"second": "",
"milliSecond": "",
"month": ""
}
}

operation: Add Events to Case

Input parameters

Output

The JSON output returns a Success message if the events are successfully added to the specified case ID, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Delete Case Events

Input parameters

Output

The JSON output returns a Success message if the events are successfully deleted from the specified case ID, or an Error message containing the reason for failure.

The output contains a non-dictionary value.

operation: Search Query

Input parameters

Output

The JSON output contains the search results retrieved from ArcSight ESM, based on the specified query.

The output contains the following populated JSON schema:
{
"elapsed": "",
"queryStr": "",
"hitCount": "",
"statusString": "",
"searchHits": [
{
"uri": "",
"score": "",
"uuid": "",
"name": ""
}
],
"queryTerms": [],
"rewrittenQueryString": ""
}

operation: Download Report

Input parameters

Output

The JSON output contains the details of the attachment in FortiSOAR™.

The output contains a non-dictionary value.

operation: Get Active List Information

Input parameters

Output

The JSON output contains the details of the active list, retrieved from ArcSight ESM, based on the specified active list ID.

The output contains the following populated JSON schema:
{
"modifierName": "",
"multiMap": "",
"creatorName": "",
"inactive": "",
"type": "",
"reference": {
"referenceType": "",
"referenceString": "",
"isModifiable": "",
"referenceName": "",
"id": "",
"managerID": "",
"uri": ""
},
"caseSensitiveType": "",
"capacity": "",
"isAdditionalLoaded": "",
"keyFields": "",
"createdTimestamp": "",
"modifiedTimestamp": "",
"deprecated": "",
"timePartitioned": "",
"state": "",
"optimizeData": "",
"activeListType": "",
"attributeInitializationInProgress": "",
"name": "",
"localID": "",
"fieldTypes": "",
"fieldSubTypes": {},
"URI": "",
"initialized": "",
"entryTimeToLive": "",
"disabled": "",
"partialCache": "",
"inCache": "",
"fieldNames": "",
"resourceid": "",
"typeName": "",
"modificationCount": "",
"createdTime": {
"day": "",
"timezoneID": "",
"milliSecond": "",
"month": "",
"second": "",
"year": "",
"minute": "",
"hour": ""
},
"modifiedTime": {
"day": "",
"timezoneID": "",
"milliSecond": "",
"month": "",
"second": "",
"year": "",
"minute": "",
"hour": ""
}
}

operation: Update Active List

Input parameters

Output

The JSON output returns a Entry list added successfully message if the active list is successfully updated on ArcSight or an Error message containing the reason for failure.

operation: Get Active List Entries

Input parameters

Output

No output schema is available at this time.

operation: Clear Active List Entries

Input parameters

Output

The output response appears as follows if the entries are cleared successfully from the specified Active List:
Active List: <Active List ID> entries are cleared successfully.

operation: Delete Active List Entries

Input parameters

Output

The JSON output returns a Entries deleted successfully message if the active list entries are is successfully deleted on ArcSight or an Error message containing the reason for failure.

operation: Get Fields

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"sei.getFieldsResponse": {
"sei.return": [
{
"fieldDisplayName": "",
"fieldType": {
"type": "",
"javaTypeName": "",
"name": ""
},
"sidetable": "",
"derived": "",
"groupDisplayName": "",
"simple": "",
"fieldName": "",
"reference": "",
"fieldIndex": "",
"copyOfFieldName": "",
"groupName": ""
}
]
}
}

operation: Get Query Viewer Data

Input parameters

Output

No output schema is available at this time.

Included playbooks

The Sample - Micro Focus ArcSight ESM - 3.1.1 playbook collection comes bundled with the Micro Focus ArcSight connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Micro Focus ArcSight connector.

• Active List : Clear Active List Entries
• Active List : Delete Active List Entries
• Active List : Get Active List Entries
• Active List : Get Active List Information
• Active List : Update Active List
• >>> ArcSight > Fetch
• >> Arcsight > Fetch and Create
• >>>> ArcSight > Get Base Events
• ArcSight > Ingest (Scheduled)
• ArcSight > Ingest (with EventIDs as input)
• Case : Add Events to Case
• Case : Create Case
• Case : Delete Case Events
• Case : Get Case Information
• Case : Update Case
• Event : Annotate Event
• Event : Annotate Event By Stage ID
• Event : Get Fields
• Get Query Viewer Data
• Report : Delete Report
• Report : Download Report
• Report : Run Report
• Report : Run Report with Default Parameters
• Search Query

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Troubleshooting

For troubleshooting, any issues with the Pull ArcSight Events Service, see the /var/log/cyops/cyops-integrations/arcsight/arcsight_reader.log log file.

Connection refused while requesting to run the wrapper

This generally occurs in the case of self-signed SSL certificates. If you are using self-signed certificates for testing or staging, keep in mind this problem will not occur in production, and you might need to switch the certificates on or off.

Resolution:

Ensure that the SSL certificates are trusted or that SSL checking is turned off in the wrapper script. This is not advised for production instances.

Playbook fails after the ingestion is triggered

There are many reasons for a playbook failure, for example, if a required field is null in the target module record, or there are problems with the Playbook Appliance keys.

Resolution:

Investigate the reason for failure using the Running Playbooks tab in the Playbook Administration page. Review the step in which the failure is being generated and the result of the step, which should contain the trace of the error. Once you have identified the error and if you cannot troubleshoot the error, contact Fortinet support for further assistance.

Post-upgrade the connector is in the Disconnected state when you enable the listener service

When you upgrade your connector and select the Enable Pull ArcSight Events Service checkbox, then sometimes the connector goes into the "Disconnected" state, due to an issue with the notification service.

Resolution

To resolve this issue, deactivate and then again activate the connector.

ArcSight ESM and FortiSOAR™ integration

ArcSight ESM and FortiSOAR™ integration is achieved by the following simple steps:

• Setup an Active List in ArcSight ESM
• Create a user in ArcSight ESM
• Setup the ArcSight ESM connector in FortiSOAR™
• Configure Data Ingestion

Setup an Active List in ArcSight ESM

An Active List in ArcSight ESM holds correlated events, which can be read by FortiSOAR™ and then converted into alerts.

To ingest data from ArcSight, you need to create an “Active List” and configure “Rules” in ArcSight ESM, so that events from ArcSight ESM can be pulled into FortiSOAR™ as described in the following sections.

Use the “FortiSOAR_ArcSight.arb” package to create the Active List in ArcSight ESM and configure the Rule that forwards desired events to the created active list. You have to create and configure a rule to define the type of events you want to forward and investigate in FortiSOAR™. Once the active list is added and the rule is configured, FortiSOAR™ monitors the active list pulls the desired events from ArcSight ESM, and creates alerts in FortiSOAR™.

Download the FortiSOAR_ArcSight.arb package, which is attached to this article, and then import the same into ArcSight ESM, as described Importing the FortiSOAR_ArcSight.arb package in ArcSight section.

Alternatively, you can manually set up the active list and the rules using the standard ArcSight interface. Points to be considered while manually setting up rules:

Rule:

• Create a rule (generally a “Lightweight Rule”) that would populate events in the FortiSOAR Active List.
• Specify conditions to filter out undesired events, such as add a rule to exclude low priority events so that unnecessary alerts would not be pushed to FortiSOAR™.

The following image displays a sample ArcSight Rule to Forward Events to an Active list:

The following image displays an Active List populated with desired events and the Resource ID is highlighted in the right pane:

Create a user in ArcSight ESM

FortiSOAR™ requires a user account and password to connect to ArcSight ESM. You could use an existing user, or create a new standard user for this purpose. This user account will be used by FortiSOAR™ to fetch and/or update events and invoke other supported actions. Ensure that the user has the following permissions:

• Read and write access to the FortiSOAR Active List (“FortiSOAR AL”).
• Access to all required events in ArcSight ESM, including the base events.

The following image displays a FortiSOAR user in ArcSight ESM with "Read" and "Write" access to FortiSOAR AL:

Setup the ArcSight ESM connector in FortiSOAR™

Install and configure the Micro Focus ArcSight Connector in FortiSOAR™ as described in the Installing the connector and Configuring the connector sections.

Configure Data Ingestion

Configure data ingestion using the “Data Ingestion Wizard” to seamlessly map the incoming ArcSight ESM correlated event data into a FortiSOAR™ alert.

The Data Ingestion Wizard enables you to configure scheduled pulling of data from ArcSight ESM into FortiSOAR™. It also lets you pull some sample data from ArcSight ESM using which you can define mapping of data between ArcSight ESM and FortiSOAR™. Mapping of common fields are generally already done by the Data Ingestion Wizard; users mostly require to only map any custom fields that are added in the ArcSight event.

1. To begin configuring data ingestion, click Configure Data Ingestion on the ArcSight ESM connector’s Configurations page.
   
   Click Let’s Start by fetching some data, to open the “Fetch Sample Data” screen.
   Sample data is required to create a field mapping between ArcSight ESM data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.
2. On the Fetch Data screen, provide the configurations required to fetch ArcSight ESM data, i.e., specify the Event IDs of sample events to be fetched to create a mapping between ArcSight ESM events and FortiSOAR™ alerts.
   You can also specify the maximum number of base events to be fetched per event and then click Fetch Data.
   
   The Data Ingestion Wizard uses the specified event IDs to pull sample data from ArcSight ESM into FortiSOAR™. The specified event IDs are used only as sample data and not used for subsequent data ingestion.
3. On the Field Mapping screen, map the fields of an ArcSight event to the fields of an alert present in FortiSOAR™.
   To map a field, click the key in the sample data to add the “jinja” value of the field. For example, to map the path parameter of an ArcSight event to the File Path parameter of a FortiSOAR™ alert, click the Field Path field and then click the path field to populate its keys:
   
   For more information on field mapping, see the Data Ingestion Wizard chapter see the "Connectors Guide" in the FortiSOAR™ product documentation.
   Once you have completed mapping fields, click Save Mapping & Continue.
   It is recommended to schedule the pull data from ArcSight ESM using the Poll Interval parameter in the “Enable Pull ArcSight Service” section of the Micro Focus ArcSight connector Configurations page as described in the Configuring the connector section. Therefore, just click Save Setting & Continue.
4. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.

For additional information about the “Data Ingestion Wizard” and installing and configuring connectors, see the "Connectors Guide" in the FortiSOAR™ product documentation.

Importing the FortiSOAR_ArcSight.arb package in ArcSight

Note: The 'FortiSOAR_ArcSight.arb' package included with this version has been updated to remove the 'Active List Rule' from the package.

1. Download the FortiSOAR_ArcSight.arb file that is attached to this document.
2. To import the FortiSOAR_ArcSight.arb package in ArcSight, navigate to the Packages tab in ArcSight as shown in the following image:
   
3. Click Import and select the FortiSOAR_ArcSight.arb.
   The FortiSOAR_ArcSight.arb package contains the Active List (FortiSOAR_Event_collector).
   Once the FortiSOAR_ArcSight.arb package is imported successfully, the FortiSOAR Active List will appear in ArcSight as follows:
   

Data Ingestion Playbooks - Solving the Data Loss Issue

To avoid data loss while using data ingestion playbooks, do the following:

1. From the parent playbook, i.e., the "> ArcSight > Fetch Events and Create Record" playbook, select the following steps:
   
2. Move the steps selected in step 1 to a new reference playbook named ">> ArcSight > Fetch and Create":
   
3. Once you have modified the "> ArcSight > Fetch Events and Create Record" parent playbook [which been renamed to "> ArcSight > Ingest (with EventIDs as input)"] in version 3.1.1, the playbook appears as follows:
   
   Now, mark the reference playbook step to 'ignore error' YES.
4. For error handling and to add the Event ID’s back to the Active list, add the following new steps:
   
   Also, in both the new steps, in the When condition add the 'Error message' in vars.steps.Fetch_Event_Details_And_Create_Record condition:
   

FortiSOAR_ArcSight.arb