[ 1 Connect ArcSight Logger with Devo SOAR ] [ 2 Actions for ArcSight Logger ] [ 2.1 Search Events ] [ 2.1.1 Input Field ] [ 2.1.2 Output ] [ 3 Release Notes ]

ArcSight Logger delivers a universal log management solution that unifies searching, reporting, alerting, and analysis across any type of enterprise machine data.

Connect ArcSight Logger with Devo SOAR

Navigate to Automations > Integrations.
Search for ArcSight Logger.
Click Details, then the + icon. Enter the required information in the following fields.
Label: Enter a connection name.
Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
Remote Agent: Run this integration using the Devo SOAR Remote Agent.
Server URL: Application server URL to connect to the ArcSight Logger. Example: abc.abcd.net or 10.10.10.10.
Server Port (Optional): Application server port to connect to the ArcSight Logger (Default is 443).
Login ID: The Login ID to connect to the ArcSight Logger.
Password: The Password to connect to the ArcSight Logger.
After you've entered all the details, click Connect.

Actions for ArcSight Logger

Search Events

Search event objects in ArcSight Logger.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Jinja Template for Query	Jinja-templated text containing the search query string to filter/process the events.
Example: message CONTAINS {{query_column_name}}.	Required
Start Time	Column name from the parent table to lookup value for start time (Default is Batch start time). Example: 2020-08-25T21:49:46.000-07:00.	Optional
End Time	Column name from the parent table to lookup value for end time (Default is Batch end time). Example: 2020-08-26T21:49:46.000-07:00.	Optional
Search Time	Select option for search time, it indicates the field date used for searching events (Default is Received Time).	Optional
Jinja Template for Fields	Jinja-templated text containing comma separated list of fields in order to show (Default is all fields). Example: {{fields_column1}}, {{fields_column2}}.	Optional
Number of results	Maximum number of results to return, must be between 1 through 10,000 (Default is 100).	Optional
Timeout	Maximum timeout duration per search in milliseconds for results to return (Default is 600000 milliseconds, 10 minutes).	Optional
Discover Fields	Select option for discovering fields, It indicates that the search should try to discover fields in the events found. Will be considered when Field Summary is set to True. Otherwise, ignored. (Default is False).	Optional
Jinja Template for Summary Fields	Jinja-templated text containing comma separated list of fields to be used to calculate summary when Field Summary is true (Default is empty). Example: {{summary_fields_column1}}, {{summary_fields_column2}}.	Optional
Field Summary	Select option for field summary, It indicates to use the field summary (Default is False).	Optional
Local Search	Select option for local search. Setting it as True indicates that the search is local only and does not include peers. Set it as False if you want to include peers in the search. (Default is False).	Optional

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: List of events.

Search Event Result

{
  "Device": "Logger",
  "Event Time": 1598959891935,
  "Logger": "Local",
  "Receipt Time": 1598960492511,
  "Version": "0",
  "_rowId": "531-0@Local",
  "agentSeverity": "2",
  "baseEventCount": 1,
  "destinationUserId": "1",
  "destinationUserName": "admin",
  "deviceCustomString4": "F3B80A1A9548F6FF7A962708E559D967",
  "deviceCustomString4Label": "Session ID",
  "deviceEventCategory": "/Logger/Resource/Dashboard/Configuration/Add",
  "deviceEventClassId": "logger:580",
  "deviceProduct": "Logger",
  "deviceReceiptTime": 1598959891883,
  "deviceVendor": "ArcSight",
  "deviceVersion": "7.1.0.8337.0",
  "endTime": 1598959891883,
  "error": null,
  "fileId": "1369094286720630795",
  "fileName": "Summary",
  "fileType": "Dashboard",
  "globalEventId": 0,
  "has_error": false,
  "message": "Dashboard [Summary] has been added",
  "name": "Dashboard added",
  "startTime": 1598959891883
},
{
  "Device": "Logger",
  "Event Time": 1598959891987,
  "Logger": "Local",
  "Receipt Time": 1598960492511,
  "Version": "0",
  "_rowId": "531-1@Local",
  "agentSeverity": "2",
  "baseEventCount": 1,
  "destinationUserId": "1",
  "destinationUserName": "admin",
  "deviceCustomString4": "F3B80A1A9548F6FF7A962708E559D967",
  "deviceCustomString4Label": "Session ID",
  "deviceEventCategory": "/Logger/Resource/Dashboard/Configuration/Update",
  "deviceEventClassId": "logger:582",
  "deviceProduct": "Logger",
  "deviceReceiptTime": 1598959891985,
  "deviceVendor": "ArcSight",
  "deviceVersion": "7.1.0.8337.0",
  "endTime": 1598959891985,
  "error": null,
  "fileId": "1369094286720630795",
  "fileName": "Summary",
  "fileType": "Dashboard",
  "globalEventId": 0,
  "has_error": false,
  "message": "Dashboard [Summary] has been updated",
  "name": "Dashboard updated",
  "startTime": 1598959891985
}

Release Notes

v2.0.0 - Updated architecture to support IO via filesystem

Devo latest

Micro Focus ArcSight Logger