Micro Focus ArcSight ESM v4.0.0

About the connector

Micro Focus ArcSight Enterprise Security Manager (ESM) is a threat detection, analysis, triage, and compliance management SIEM platform, This connector can be use to ingesting events from Micro Focus ArcSight, search and case management

This document provides information about the Micro Focus ArcSight ESM Connector, which facilitates automated interactions, with a Micro Focus ArcSight ESM server using FortiSOAR™ playbooks. Add the Micro Focus ArcSight ESM connector as a step in FortiSOAR™ playbooks and perform automated operations with Micro Focus ArcSight ESM.

Version information

Connector Version: 4.0.0

FortiSOAR™ Version Tested on: 7.4.3-3294

Micro Focus ArcSight ESM Version Tested on: 7.6.0.2729.0

Authored By: Fortinet

Certified: Yes

Release Notes for version 4.0.0

• Re-developed the connector with new Micro Focus ArcSight ESM Detect REST APIs; hence all the actions, output schemas, and playbooks are updated.
  • Added parameters From Date and To Date to the action Get Event Details.
  • Added parameter Column Names List to the action Delete Active List Entries.
  • Renamed the following actions:
    • Update Active List to Add Active List Entries.
    • Get Fields to Get Event Fields.
    • Delete Report to Delete Archive Report.
  • Renamed the following parameters for specified actions:
    • In action Update Case, Custom Fields is now Additional Attributes. The parameter type is now JSON.
    • In action Create Case, Additional attributes in json format is now Additional Attributes. The parameter type is now JSON.
    • In action Add Events To Case, Case ID is now Resource ID.
    • In action Get Case Information, Case ID is now Resource ID.
  • Removed parameters Time Field Names and Date Time Format from the action Get Event Details.
  • Removed parameter Deprecated from the action Create Case.
  • Removed parameters Deprecated and Notification Group IDs from the action Update Case.
  • Updated output schema for following actions:
    • Get Case Information
    • Get Event Fields (previously Get Fields)
• Fixed a bug where the credentials were displayed in plain-text when connector configuration failed.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-arcsight

IMPORTANT: Upgrading the connector from 2.x to 3.x is not backward compatible because explicit changes are needed in the existing playbooks to delete the Active List Entries after alerts have been created in FortiSOAR™.

Prerequisites to configuring the connector

• You must have the IP Address or FQDN of the Micro Focus ArcSight ESM server and credentials to access the server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Micro Focus ArcSight ESM server.

Minimum Permissions Required

• You need Read and Write access on the resources to use this connector and run actions.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Micro Focus ArcSight ESM connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations:

operation: Annotate Event

You can annotate Micro Focus ArcSight Events using the Micro Focus ArcSight Console to update the Stage and Assignee of the event and to add comments to the event.

You can also perform similar operations using the Annotate Event function in FortiSOAR™ playbooks.

Input parameters

Output

The output contains a non-dictionary value.

operation: Annotate Event By Stage ID

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": ""
}

operation: Run Report with Default Parameters

You can get the ID for a report (Resource ID) from the Micro Focus ArcSight Console, as shown in the following image:

You can get the URI for a report from the Micro Focus ArcSight Console. To get the URI, you must add the report name to the parent resource, as shown in the following image:

Input parameters

Output

The output contains a non-dictionary value.

operation: Run Report

Input parameters

{"StartTime": "$Now - 3h", "Report Format": "0"}

Output

The output contains a non-dictionary value.

operation: Delete Archive Report

Input parameters

Output

The output contains a non-dictionary value.

operation: Download Report

Input parameters

Output

The JSON output contains the details of the attachment in FortiSOAR™.

{
    "id": "",
    "@id": "",
    "file": {
        "id": "",
        "@id": "",
        "size": "",
        "uuid": "",
        "@type": "",
        "assignee": "",
        "filename": "",
        "metadata": [],
        "mimeType": "",
        "thumbnail": "",
        "uploadDate": ""
    },
    "name": "",
    "type": "",
    "uuid": "",
    "@type": "",
    "tasks": [],
    "alerts": [],
    "assets": [],
    "owners": [],
    "people": [],
    "tenant": {
        "id": "",
        "@id": "",
        "name": "",
        "role": "",
        "uuid": "",
        "@type": "",
        "region": "",
        "license": "",
        "industry": "",
        "tenantId": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": "",
        "description": "",
        "isDedicated": "",
        "allowRemoteMMDModification": ""
    },
    "@context": "",
    "assignee": "",
    "comments": [],
    "conflict": "",
    "warrooms": [],
    "incidents": [],
    "createDate": "",
    "createUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "indicators": [],
    "modifyDate": "",
    "modifyUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "recordTags": [],
    "userOwners": [],
    "description": "",
    "tenantRecordId": ""
}

operation: Get Event Details

Input parameters

API Returned NULL Values

The Micro Focus ArcSight APIs returns following values if the event field is not set:

Output

The output contains the following populated JSON schema:

[
    {
        "ttl": "",
        "name": "",
        "type": "",
        "agent": {
            "id": "",
            "name": "",
            "type": "",
            "zone": {
                "id": "",
                "uri": "",
                "referenceID": "",
                "isModifiable": "",
                "referenceName": "",
                "referenceType": "",
                "referenceString": ""
            },
            "address": "",
            "mutable": "",
            "version": "",
            "hostName": "",
            "macAddress": "",
            "assetLocalId": "",
            "addressAsBytes": "",
            "translatedAddress": ""
        },
        "device": {
            "zone": {
                "id": "",
                "uri": "",
                "referenceID": "",
                "isModifiable": "",
                "referenceName": "",
                "referenceType": "",
                "referenceString": ""
            },
            "vendor": "",
            "address": "",
            "assetId": "",
            "mutable": "",
            "product": "",
            "version": "",
            "hostName": "",
            "assetName": "",
            "macAddress": "",
            "assetLocalId": "",
            "addressAsBytes": "",
            "translatedAddress": ""
        },
        "bytesIn": "",
        "endTime": "",
        "eventId": "",
        "bytesOut": "",
        "category": {
            "object": "",
            "mutable": "",
            "outcome": "",
            "behavior": "",
            "deviceGroup": "",
            "significance": ""
        },
        "locality": "",
        "priority": "",
        "severity": "",
        "domainFp1": "",
        "domainFp2": "",
        "domainFp3": "",
        "domainFp4": "",
        "domainFp5": "",
        "domainFp6": "",
        "domainFp7": "",
        "domainFp8": "",
        "flexDate1": "",
        "managerId": "",
        "relevance": "",
        "sessionId": "",
        "startTime": "",
        "dummyField": "",
        "originator": "",
        "destination": {
            "geo": {
                "mutable": "",
                "latitude": "",
                "longitude": "",
                "latitudeLong": "",
                "longitudeLong": ""
            },
            "port": "",
            "zone": {
                "id": "",
                "uri": "",
                "referenceID": "",
                "isModifiable": "",
                "referenceName": "",
                "referenceType": "",
                "referenceString": ""
            },
            "address": "",
            "assetId": "",
            "mutable": "",
            "hostName": "",
            "assetName": "",
            "processId": "",
            "macAddress": "",
            "assetLocalId": "",
            "addressAsBytes": "",
            "translatedPort": "",
            "translatedAddress": ""
        },
        "domainDate1": "",
        "domainDate2": "",
        "domainDate3": "",
        "domainDate4": "",
        "domainDate5": "",
        "domainDate6": "",
        "finalDevice": {
            "zone": {
                "id": "",
                "uri": "",
                "referenceID": "",
                "isModifiable": "",
                "referenceName": "",
                "referenceType": "",
                "referenceString": ""
            },
            "vendor": "",
            "address": "",
            "assetId": "",
            "mutable": "",
            "product": "",
            "version": "",
            "hostName": "",
            "assetName": "",
            "macAddress": "",
            "assetLocalId": "",
            "addressAsBytes": "",
            "translatedAddress": ""
        },
        "flexNumber1": "",
        "flexNumber2": "",
        "persistence": "",
        "deviceCustom": {
            "mutable": "",
            "number1Label": "",
            "string1Label": "",
            "string2Label": ""
        },
        "agentSeverity": "",
        "domainNumber1": "",
        "domainNumber2": "",
        "domainNumber3": "",
        "domainNumber4": "",
        "domainNumber5": "",
        "domainNumber6": "",
        "domainNumber7": "",
        "domainNumber8": "",
        "domainNumber9": "",
        "originalAgent": {
            "id": "",
            "name": "",
            "type": "",
            "zone": {
                "id": "",
                "uri": "",
                "referenceID": "",
                "isModifiable": "",
                "referenceName": "",
                "referenceType": "",
                "referenceString": ""
            },
            "address": "",
            "mutable": "",
            "version": "",
            "hostName": "",
            "macAddress": "",
            "assetLocalId": "",
            "addressAsBytes": "",
            "translatedAddress": ""
        },
        "baseEventCount": "",
        "deviceSeverity": "",
        "domainNumber10": "",
        "domainNumber11": "",
        "domainNumber12": "",
        "domainNumber13": "",
        "objectTypeName": "",
        "deviceDirection": "",
        "deviceProcessId": "",
        "domainIpv4addr1": "",
        "domainIpv4addr2": "",
        "domainIpv4addr3": "",
        "domainIpv4addr4": "",
        "eventAnnotation": {
            "flags": "",
            "stage": {
                "id": "",
                "uri": "",
                "managerID": "",
                "referenceID": "",
                "isModifiable": "",
                "referenceName": "",
                "referenceType": "",
                "referenceString": ""
            },
            "endTime": "",
            "eventId": "",
            "version": "",
            "auditTrail": "",
            "stageUpdateTime": "",
            "modificationTime": "",
            "managerReceiptTime": ""
        },
        "modelConfidence": "",
        "agentReceiptTime": "",
        "assetCriticality": "",
        "deviceCustomDate1": "",
        "deviceCustomDate2": "",
        "deviceReceiptTime": "",
        "concentratorAgents": [
            {
                "id": "",
                "name": "",
                "type": "",
                "zone": {
                    "id": "",
                    "uri": "",
                    "referenceID": "",
                    "isModifiable": "",
                    "referenceName": "",
                    "referenceType": "",
                    "referenceString": ""
                },
                "address": "",
                "mutable": "",
                "version": "",
                "hostName": "",
                "macAddress": "",
                "assetLocalId": "",
                "addressAsBytes": "",
                "translatedAddress": ""
            }
        ],
        "deviceEventClassId": "",
        "managerReceiptTime": "",
        "concentratorDevices": [
            {
                "zone": {
                    "id": "",
                    "uri": "",
                    "referenceID": "",
                    "isModifiable": "",
                    "referenceName": "",
                    "referenceType": "",
                    "referenceString": ""
                },
                "vendor": "",
                "address": "",
                "assetId": "",
                "mutable": "",
                "product": "",
                "version": "",
                "hostName": "",
                "assetName": "",
                "macAddress": "",
                "assetLocalId": "",
                "addressAsBytes": "",
                "translatedAddress": ""
            }
        ],
        "deviceCustomNumber1": "",
        "deviceCustomNumber2": "",
        "deviceCustomNumber3": "",
        "deviceCustomString1": "",
        "deviceCustomString2": "",
        "deviceEventCategory": "",
        "aggregatedEventCount": "",
        "correlatedEventCount": "",
        "deviceCustomFloatingPoint1": "",
        "deviceCustomFloatingPoint2": "",
        "deviceCustomFloatingPoint3": "",
        "deviceCustomFloatingPoint4": ""
    }
]

operation: Get Active List Information

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resourceId": "",
    "name": "",
    "alias": "",
    "description": "",
    "reference": {
        "id": "",
        "uri": "",
        "externalID": "",
        "referenceString": "",
        "referenceID": "",
        "managerID": "",
        "referenceType": "",
        "isModifiable": "",
        "referenceName": ""
    },
    "type": "",
    "typeName": "",
    "subType": "",
    "isAdditionalLoaded": "",
    "modificationCount": "",
    "externalID": "",
    "createdTimestamp": "",
    "modifiedTimestamp": "",
    "versionID": "",
    "contentVersionID": "",
    "referencePage": "",
    "disabled": "",
    "disabledReason": "",
    "inactive": "",
    "inactiveReason": "",
    "deprecated": "",
    "localID": "",
    "state": "",
    "creatorName": "",
    "modifierName": "",
    "notificationGroupIDs": [],
    "optimizeData": "",
    "capacity": "",
    "entryTimeToLive": "",
    "multiMap": "",
    "partialCache": "",
    "timePartitioned": "",
    "activeListType": "",
    "caseSensitiveType": "",
    "countLimit": "",
    "cacheModel": "",
    "initialized": "",
    "inCache": "",
    "uri": "",
    "attributeInitializationInProgress": "",
    "signature": {
        "id": "",
        "modificationCount": ""
    },
    "displayName": "",
    "fields": [
        {
            "name": "",
            "type": "",
            "subType": "",
            "key": ""
        }
    ]
}

operation: Get Active List Entries

Input parameters

Output

The output contains a non-dictionary value.

operation: Add Active List Entries

Input parameters

    [
        {
            "fields": ["val1", "val2"]
        },

        {
            "fields": ["val3", "val4"]
        }
    ]

Output

The output contains the following populated JSON schema:

{
    "result": ""
}

operation: Delete Active List Entries

Input parameters

    [
        {
            "fields": ["val1", "val2"]
        },

        {
            "fields": ["val3", "val4"]
        }
    ]

Output

The output contains the following populated JSON schema:

{
    "result": ""
}

operation: Clear Active List Entries

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": ""
}

operation: Create Case

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resourceId": "",
    "name": "",
    "alias": "",
    "description": "",
    "reference": {
        "id": "",
        "uri": "",
        "externalID": "",
        "referenceString": "",
        "referenceID": "",
        "managerID": "",
        "referenceType": "",
        "isModifiable": "",
        "referenceName": ""
    },
    "type": "",
    "typeName": "",
    "subType": "",
    "isAdditionalLoaded": "",
    "modificationCount": "",
    "externalID": "",
    "createdTimestamp": "",
    "modifiedTimestamp": "",
    "versionID": "",
    "contentVersionID": "",
    "referencePage": "",
    "disabled": "",
    "disabledReason": "",
    "inactive": "",
    "inactiveReason": "",
    "deprecated": "",
    "localID": "",
    "state": "",
    "creatorName": "",
    "modifierName": "",
    "notificationGroupIDs": [],
    "displayID": "",
    "ticketType": "",
    "stage": "",
    "frequency": "",
    "operationalImpact": "",
    "securityClassification": "",
    "consequenceSeverity": "",
    "reportingLevel": "",
    "originator": "",
    "detectionTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "estimatedStartTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "estimatedRestoreTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "affectedServices": "",
    "affectedElements": "",
    "estimatedImpact": "",
    "affectedSites": "",
    "attackMechanism": "",
    "attackAgent": "",
    "vulnerability": "",
    "sensitivity": "",
    "associatedImpact": "",
    "action": "",
    "securityClassificationCode": "",
    "actionsTaken": "",
    "plannedActions": "",
    "recommendedActions": "",
    "followupContact": "",
    "attackTarget": "",
    "attackService": "",
    "attackProtocol": "",
    "attackOS": "",
    "attackProgram": "",
    "attackImpact": "",
    "attackTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "finalReportAction": "",
    "attackLocationID": "",
    "attackNode": "",
    "attackAddress": "",
    "vulnerabilityType1": "",
    "vulnerabilityType2": "",
    "vulnerabilityEvidence": "",
    "vulnerabilitySource": "",
    "vulnerabilityData": "",
    "history": "",
    "numberOfOccurences": "",
    "lastOccurenceTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "resistance": "",
    "recordedData": "",
    "inspectionResults": "",
    "conclusions": "",
    "incidentSource1": "",
    "incidentSource2": "",
    "sourceAddress": "",
    "attachmentIDs": [],
    "eventIDs": [],
    "initialized": "",
    "uri": "",
    "inCache": "",
    "attributeInitializationInProgress": "",
    "signature": {
        "id": "",
        "modificationCount": ""
    },
    "displayName": ""
}

operation: Add Events To Case

Input parameters

Output

The output contains the following populated JSON schema:

{
    "result": ""
}

operation: Get Case Information

Input parameters

Output

The output contains the following populated JSON schema:

{
    "uri": "",
    "name": "",
    "type": "",
    "alias": "",
    "stage": "",
    "state": "",
    "inCache": "",
    "localID": "",
    "disabled": "",
    "eventIDs": [],
    "inactive": "",
    "typeName": "",
    "displayID": "",
    "frequency": "",
    "reference": {
        "id": "",
        "uri": "",
        "managerID": "",
        "externalID": "",
        "isModifiable": "",
        "referenceName": "",
        "referenceType": "",
        "referenceString": ""
    },
    "signature": {
        "id": "",
        "modificationCount": ""
    },
    "deprecated": "",
    "externalID": "",
    "resourceId": "",
    "ticketType": "",
    "creatorName": "",
    "description": "",
    "displayName": "",
    "initialized": "",
    "modifierName": "",
    "detectionTime": {
        "day": "",
        "hour": "",
        "year": "",
        "month": "",
        "minute": "",
        "second": "",
        "timezoneID": "",
        "milliSecond": ""
    },
    "reportingLevel": "",
    "createdTimestamp": "",
    "modificationCount": "",
    "modifiedTimestamp": "",
    "operationalImpact": "",
    "estimatedStartTime": {
        "day": "",
        "hour": "",
        "year": "",
        "month": "",
        "minute": "",
        "second": "",
        "timezoneID": "",
        "milliSecond": ""
    },
    "isAdditionalLoaded": "",
    "numberOfOccurences": "",
    "consequenceSeverity": "",
    "securityClassification": "",
    "securityClassificationCode": "",
    "attributeInitializationInProgress": ""
}

operation: Update Case

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resourceId": "",
    "name": "",
    "alias": "",
    "description": "",
    "reference": {
        "id": "",
        "uri": "",
        "externalID": "",
        "referenceString": "",
        "referenceID": "",
        "managerID": "",
        "referenceType": "",
        "isModifiable": "",
        "referenceName": ""
    },
    "type": "",
    "typeName": "",
    "subType": "",
    "isAdditionalLoaded": "",
    "modificationCount": "",
    "externalID": "",
    "createdTimestamp": "",
    "modifiedTimestamp": "",
    "versionID": "",
    "contentVersionID": "",
    "referencePage": "",
    "disabled": "",
    "disabledReason": "",
    "inactive": "",
    "inactiveReason": "",
    "deprecated": "",
    "localID": "",
    "state": "",
    "creatorName": "",
    "modifierName": "",
    "notificationGroupIDs": [],
    "displayID": "",
    "ticketType": "",
    "stage": "",
    "frequency": "",
    "operationalImpact": "",
    "securityClassification": "",
    "consequenceSeverity": "",
    "reportingLevel": "",
    "originator": "",
    "detectionTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "estimatedStartTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "estimatedRestoreTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "affectedServices": "",
    "affectedElements": "",
    "estimatedImpact": "",
    "affectedSites": "",
    "attackMechanism": "",
    "attackAgent": "",
    "vulnerability": "",
    "sensitivity": "",
    "associatedImpact": "",
    "action": "",
    "securityClassificationCode": "",
    "actionsTaken": "",
    "plannedActions": "",
    "recommendedActions": "",
    "followupContact": "",
    "attackTarget": "",
    "attackService": "",
    "attackProtocol": "",
    "attackOS": "",
    "attackProgram": "",
    "attackImpact": "",
    "attackTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "finalReportAction": "",
    "attackLocationID": "",
    "attackNode": "",
    "attackAddress": "",
    "vulnerabilityType1": "",
    "vulnerabilityType2": "",
    "vulnerabilityEvidence": "",
    "vulnerabilitySource": "",
    "vulnerabilityData": "",
    "history": "",
    "numberOfOccurences": "",
    "lastOccurenceTime": {
        "year": "",
        "month": "",
        "day": "",
        "hour": "",
        "minute": "",
        "second": "",
        "milliSecond": "",
        "timezoneID": ""
    },
    "resistance": "",
    "recordedData": "",
    "inspectionResults": "",
    "conclusions": "",
    "incidentSource1": "",
    "incidentSource2": "",
    "sourceAddress": "",
    "attachmentIDs": [],
    "eventIDs": [],
    "initialized": "",
    "inCache": "",
    "uri": "",
    "attributeInitializationInProgress": "",
    "signature": {
        "id": "",
        "modificationCount": ""
    },
    "displayName": ""
}

operation: Delete Case Events

Input parameters

Output

The output contains a non-dictionary value.

operation: Get Event Fields

Input parameters

None.

Output

The output schema exceeds the document size.

operation: Get Query Viewer Data

Input parameters

Output

The output contains the following populated JSON schema:

{
    "resourceId": "",
    "name": "",
    "alias": "",
    "description": "",
    "reference": {
        "id": "",
        "uri": "",
        "externalID": "",
        "referenceString": "",
        "referenceID": "",
        "managerID": "",
        "referenceType": "",
        "isModifiable": "",
        "referenceName": ""
    },
    "type": "",
    "typeName": "",
    "subType": "",
    "isAdditionalLoaded": "",
    "modificationCount": "",
    "externalID": "",
    "createdTimestamp": "",
    "modifiedTimestamp": "",
    "versionID": "",
    "contentVersionID": "",
    "referencePage": "",
    "disabled": "",
    "disabledReason": "",
    "inactive": "",
    "inactiveReason": "",
    "deprecated": "",
    "localID": "",
    "state": "",
    "creatorName": "",
    "modifierName": "",
    "notificationGroupIDs": [],
    "supportsToggle": "",
    "enabled": "",
    "supportedDataTypes": [],
    "queryViewerId": "",
    "data": {
        "timestamp": "",
        "startTimestamp": "",
        "endTimestamp": "",
        "rows": [
            {}
        ],
        "columnHeaders": [],
        "colHeaderTS": "",
        "maxColumns": "",
        "properties": {
            "additionalProp1": {
                "propertyValue": {}
            }
        }
    },
    "columnAliasMap": {
        "additionalProp1": "",
        "additionalProp2": "",
        "additionalProp3": ""
    },
    "refreshInterval": "",
    "drilldownList": {
        "resourceId": "",
        "name": "",
        "alias": "",
        "description": "",
        "reference": {
            "id": "",
            "uri": "",
            "externalID": "",
            "referenceString": "",
            "referenceID": "",
            "managerID": "",
            "referenceType": "",
            "isModifiable": "",
            "referenceName": ""
        },
        "type": "",
        "typeName": "",
        "subType": "",
        "isAdditionalLoaded": "",
        "modificationCount": "",
        "externalID": "",
        "createdTimestamp": "",
        "modifiedTimestamp": "",
        "versionID": "",
        "contentVersionID": "",
        "referencePage": "",
        "disabled": "",
        "disabledReason": "",
        "inactive": "",
        "inactiveReason": "",
        "deprecated": "",
        "localID": "",
        "state": "",
        "creatorName": "",
        "modifierName": "",
        "notificationGroupIDs": [],
        "role": "",
        "drilldowns": [
            {
                "resourceId": "",
                "name": "",
                "alias": "",
                "description": "",
                "reference": {
                    "id": "",
                    "uri": "",
                    "externalID": "",
                    "referenceString": "",
                    "referenceID": "",
                    "managerID": "",
                    "referenceType": "",
                    "isModifiable": "",
                    "referenceName": ""
                },
                "type": "",
                "typeName": "",
                "subType": "",
                "isAdditionalLoaded": "",
                "modificationCount": "",
                "externalID": "",
                "createdTimestamp": "",
                "modifiedTimestamp": "",
                "versionID": "",
                "contentVersionID": "",
                "referencePage": "",
                "disabled": "",
                "disabledReason": "",
                "inactive": "",
                "inactiveReason": "",
                "deprecated": "",
                "localID": "",
                "state": "",
                "creatorName": "",
                "modifierName": "",
                "notificationGroupIDs": [],
                "drilldownDefinition": {
                    "destinationID": "",
                    "destinationDisplayName": "",
                    "destinationType": "",
                    "menuPrompt": "",
                    "type": ""
                },
                "initialized": "",
                "inCache": "",
                "uri": "",
                "attributeInitializationInProgress": "",
                "signature": {
                    "id": "",
                    "modificationCount": ""
                },
                "displayName": ""
            }
        ],
        "defaultDrilldown": {
            "resourceId": "",
            "name": "",
            "alias": "",
            "description": "",
            "reference": {
                "id": "",
                "uri": "",
                "externalID": "",
                "referenceString": "",
                "referenceID": "",
                "managerID": "",
                "referenceType": "",
                "isModifiable": "",
                "referenceName": ""
            },
            "type": "",
            "typeName": "",
            "subType": "",
            "isAdditionalLoaded": "",
            "modificationCount": "",
            "externalID": "",
            "createdTimestamp": "",
            "modifiedTimestamp": "",
            "versionID": "",
            "contentVersionID": "",
            "referencePage": "",
            "disabled": "",
            "disabledReason": "",
            "inactive": "",
            "inactiveReason": "",
            "deprecated": "",
            "localID": "",
            "state": "",
            "creatorName": "",
            "modifierName": "",
            "notificationGroupIDs": [],
            "drilldownDefinition": {
                "destinationID": "",
                "destinationDisplayName": "",
                "destinationType": "",
                "menuPrompt": "",
                "type": ""
            },
            "initialized": "",
            "inCache": "",
            "uri": "",
            "attributeInitializationInProgress": "",
            "signature": {
                "id": "",
                "modificationCount": ""
            },
            "displayName": ""
        },
        "default": "",
        "initialized": "",
        "inCache": "",
        "uri": "",
        "attributeInitializationInProgress": "",
        "signature": {
            "id": "",
            "modificationCount": ""
        },
        "displayName": ""
    },
    "initialized": "",
    "inCache": "",
    "uri": "",
    "attributeInitializationInProgress": "",
    "signature": {
        "id": "",
        "modificationCount": ""
    },
    "displayName": ""
}

operation: Search Query

Input parameters

Output

The output contains the following populated JSON schema:

{
    "queryStr": "",
    "rewrittenQueryString": "",
    "statusString": "",
    "elapsed": "",
    "hitCount": "",
    "searchHits": [
        {
            "uuid": "",
            "score": "",
            "name": "",
            "uri": ""
        }
    ],
    "queryTerms": []
}

Included playbooks

The Sample - Micro Focus ArcSight ESM - 4.0.0 playbook collection comes bundled with the Micro Focus ArcSight connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Micro Focus ArcSight connector.

• > ArcSight > Ingest (with EventIDs as input)
• > Arcsight > Init Macros
• >> ArcSight > Get Base Events
• >> Micro Focus ArcSight ESM > Fetch and Create
• Add Active List Entries
• Add Events To Case
• Annotate Event
• Annotate Event By Stage ID
• ArcSight > Ingest (Scheduled)
• Clear Active List Entries
• Create Case
• Delete Active List Entries
• Delete Archive Report
• Delete Case Events
• Download Report
• Get Active List Entries
• Get Active List Information
• Get Case Information
• Get Event Details
• Get Event Fields
• Get Query Viewer Data
• Run Report
• Run Report with Default Parameters
• Search Query
• Update Case

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Micro Focus ArcSight ESM and FortiSOAR™ integration

Micro Focus ArcSight ESM and FortiSOAR™ integration is achieved by the following simple steps:

• Set up an Active List in Micro Focus ArcSight ESM
• Create a user in Micro Focus ArcSight ESM
• Setup the Micro Focus ArcSight ESM connector in FortiSOAR™
• Configure Data Ingestion

Set up an Active List in Micro Focus ArcSight ESM

An Active List(AL) in Micro Focus ArcSight ESM holds correlated events, which can be read by FortiSOAR™ and then converted into alerts.

To ingest data from Micro Focus ArcSight, you need to create an Active List and configure Rules in the Micro Focus ArcSight ESM server, so that events from Micro Focus ArcSight ESM can be pulled into FortiSOAR™ as described in the following sections.

Use the FortiSOAR_ArcSight.arb package to create the Active List in Micro Focus ArcSight ESM and configure the Rule that forwards desired events to the created active list. You have to create and configure a rule to define the type of events you want to forward and investigate in FortiSOAR™. Once the active list is added and the rule is configured, FortiSOAR™ monitors the active list pulls the desired events from Micro Focus ArcSight ESM, and creates alerts in FortiSOAR™.

Download the FortiSOAR_ArcSight.arb package, which is attached to this article, and then import the same into Micro Focus ArcSight ESM, as described in the Importing the FortiSOAR_ArcSight.arb package in Micro Focus ArcSight section.

Alternatively, you can manually set up the active list and the rules using the standard Micro Focus ArcSight interface. Points to be considered while manually setting up rules:

Rule:

• Create a rule (generally referred to as a Lightweight Rule) that would populate events in the FortiSOAR Active List.
• Specify conditions to filter out undesired events, such as adding a rule to exclude low-priority events, so the unnecessary alerts are not pushed to FortiSOAR™.

The following image displays a sample Micro Focus ArcSight Rule to Forward Events to an Active list:

The following image displays an Active List populated with desired events and the Resource ID is highlighted in the right pane:

Create a user in Micro Focus ArcSight ESM

FortiSOAR™ requires a user account and password to connect to the Micro Focus ArcSight ESM server. You could use an existing user, or create a new standard user for this purpose. This user account is used by FortiSOAR™ to fetch events, update events, or invoke other supported actions. Ensure that the user has following permissions:

• Read and write access to the FortiSOAR Active List ("FortiSOAR AL").
• Access to all required events in Micro Focus ArcSight ESM, including the base events.

The following image displays a FortiSOAR™ user in the Micro Focus ArcSight ESM server with Read and Write access to FortiSOAR™ AL:

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling event data from Micro Focus ArcSight ESM. Currently, event data ingested from Micro Focus ArcSight ESM is mapped to Alerts in FortiSOAR™. For more information on the Data Ingestion Wizard, see the Connectors Guide in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the Data Ingestion Wizard to seamlessly map the incoming Micro Focus ArcSight ESM event data to FortiSOAR™'s Alerts.

The Data Ingestion Wizard helps you to configure the scheduled pulling of data from Micro Focus ArcSight ESM into FortiSOAR™. It also lets you pull some sample data from Micro Focus ArcSight ESM using which you can define the mapping of data between Micro Focus ArcSight ESM and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to the Micro Focus ArcSight ESM event data.

1. To begin configuring data ingestion, click Configure Data Ingestion on the Micro Focus ArcSight ESM connector's Configurations page.

   Click Let's Start by fetching some data, to open the Fetch Sample Data screen.

   

   Sample data is required to create a field mapping between Micro Focus ArcSight ESM data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.

2. On the Fetch Data screen, provide the configurations required to fetch event data from Micro Focus ArcSight ESM.

   Users can pull event data from Micro Focus ArcSight ESM by selecting Event IDs, Maximum Events To Pull, and Maximum Base Events To Pull Per Event.

   The fetched data is used to create a mapping between the event data from Micro Focus ArcSight ESM and FortiSOAR Alerts. Once you have completed specifying the configurations, click Fetch Data.

   

3. On the Field Mapping screen, map the fields of the ingested event data Micro Focus ArcSight ESM to the fields of a Alerts present in FortiSOAR™.

   To map a field, click the key in the sample data to add the Jinja value of the field. For example, to map the path parameter of an ingested event data from Micro Focus ArcSight ESM to the File Path parameter of a FortiSOAR™ Alerts, click the File Path field and then click the path field to populate its keys:

   

   The Data Ingestion Wizard uses the specified event IDs to pull sample data from Micro Focus ArcSight ESM into FortiSOAR™. The specified event IDs are used only as sample data and not used for subsequent data ingestion.

   For more information on field mapping, see the Data Ingestion chapter in the Connectors Guide in the FortiSOAR™ product documentation. Once you have completed the mapping of fields, click Save Mapping & Continue.

4. (Optional) Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to Micro Focus ArcSight ESM, so that the content gets pulled from the Micro Focus ArcSight ESM integration into FortiSOAR™

   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.

   In the Configure Schedule Settings section, specify the Cron expression for the schedule. For example, if you want to pull data from Micro Focus ArcSight ESM every day, click Daily, and in the minute, hour, and day of month boxes enter 0, 5, and * respectively. This means that the event data will be pulled from Micro Focus ArcSight ESM every day at 5:00 AM:

   

   Once you have completed scheduling, click Save Settings & Continue.

5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.

   

Importing the FortiSOAR_ArcSight.arb package in Micro Focus ArcSight

Note: The 'FortiSOAR_ArcSight.arb' package included with this version has been updated to remove the 'Active List Rule' from the package.

1. Download the FortiSOAR_ArcSight.arb file that is attached to this document.

2. To import the FortiSOAR_ArcSight.arb package in Micro Focus ArcSight, navigate to the Packages tab in Micro Focus ArcSight as shown in the following image:

   

3. Click Import and select the FortiSOAR_ArcSight.arb.

   The FortiSOAR_ArcSight.arb package contains the Active List (FortiSOAR_Event_collector).

   Once the FortiSOAR_ArcSight.arb package is imported successfully, the FortiSOAR Active List will appear in Micro Focus ArcSight as follows:

   

FortiSOAR_ArcSight.arb