Managing Configurations
A configuration is a group of related appliance or software settings and their associated values, which applies to one or more node types. A configuration created for a node can be pushed to nodes of the same type managed by ArcSight Management Center, assuring uniformity across a group of nodes.
Configurations come in these kinds:
- A subscriber configuration is for the routine management of multiple managed ArcSight products. You can easily assign values to, propagate, and maintain the same settings across multiple nodes of the same type, including connectors, Collectors, Connector Appliances, Loggers, or other ArcMCs.
- A initial configuration is for the rapid, uniform setup of multiple ArcSight Loggers (only). Use an initial configuration to expedite the initial deployment of ArcSight Loggers to a production environment.
Configuration management tasks include:
-
Configuration Creation: A configuration for a node type can be created (as well as edited or deleted) in ArcSight Management Center.
-
Configuration Import: A configuration can be created directly on a managed node, exported, then imported into ArcSight Management Center for sharing with nodes of the same type.
- Configuration Push: A configuration can be pushed from ArcMC to managed nodes. This copies the configuration from ArcMC and changes the settings on each destination node.
-
Subscriptions: Managed nodes can be subscribed to a subscriber configuration, so they can receive a new or updated configuration pushed from ArcSight Management Center.
-
Compliance Checks: Check whether the settings and their values on a managed node match the ones for a configuration type specified in ArcSight Management Center. If so, the node is said to be in compliance with the configuration.
- Comparisons: Compare two configurations of the same type quickly, with a field by field breakdown of each setting, its value, and any differences. You can compare the values of a configuration on a subscriber node to the values of the baseline or reference configuration on an ArcMC which manages it. You can also compare two configurations of the same type on a single ArcMC.
For example, a typical workflow for a subscriber configuration might work as follows: you can create a suitable DNS configuration for an appliance, specifying primary DNS server, secondary DNS server, and search domains for the appliance. (See Destination Configuration Types.) You can then push your DNS configuration to subscribing appliances, and so ensure that DNS settings for all subscribed nodes are configured identically with a single action.
If you later updated the configuration to use a new primary DNS server, you could push the new configuration to all subscribers, and all of them would be updated for the new DNS server with one action.
At any time, you could verify any managed node’s compliance with the configuration to determine if its settings were assigned the desired values.
The following topics are discussed here.