Developing FlexConnectors

FlexConnectors are custom, user-designed SmartConnectors that can read and parse information from third-party devices and map that information to ArcSight’s event schema.

ArcSight Management Center provides a FlexConnector Development wizard that enables you to quickly and easily develop a FlexConnector by creating a parser file, and enables you to test and package your new FlexConnector before deploying it. The wizard generates regular expressions and provides event field mapping suggestions automatically so you do not need to be an expert in regular expression authoring, parser syntax, or ArcSight event schema.

Use the FlexConnector Development wizard to develop FlexConnectors for simple log files. For complex log files, use the FlexConnector SDK (available from the ArcSight Customer Support site)

The FlexConnector Development wizard supports Regex Files, Folder Follower, and Syslog (Daemon, File, Pipe) FlexConnectors only.

The FlexConnector Development wizard does not support the extra processors property or multiple sub-messages. If you need these features, use the FlexConnector SDK to create your FlexConnector.

Caution: A FlexConnector that you develop with the FlexConnector Development wizard might perform more slowly than an ArcSight SmartConnector.

To develop a FlexConnector:

  1. Click Node Management.

  2. In the navigation tree, browse to the container where you wish to develop the connector.

  3. In the management panel, click the Connectors tab.

  4. On the Connectors tab, in the Action drop-down, click Edit FlexConnector. The FlexConnector Development wizard is launched.

  5. Provide the vendor and product name of the device for which you are creating a FlexConnector, and then click Next.

  6. Select the data source type, and then click Next:

    • Select Syslog to create a Syslog FlexConnector to read events from Syslog messages.

    • Select File to create a FlexConnector to parse variable-format log files using regular expressions (ArcSight FlexConnector Regex File) or to parse variable-format log files in batch mode (ArcSight FlexConnector Folder Follower).

  7. Upload a sample log file for the data source type you selected in the previous step, and then click Next.

  8. The wizard finds the first unparsed line in the log file, generates a regular expression to match and extract tokens from that line, and displays the suggested field mappings for each extracted token in the Mappings table.

    Note: The mappings are displayed in descending order of probability (based on ArcSight training data). You can change the mappings by selecting from the list.

    The percentage of parsed lines in the file is shown in the top right of the panel. You can use this percentage to estimate where you are in the log file. The percentage of unparsed lines skipped in the file is also shown in the top right of the panel.

    • To change the regular expression in the Regex box and recalculate the mappings, edit the expression and then click the Recalculate button.You can set the regular expression back to the suggested value by clicking the Reset button.

    • Field mappings that do not correspond directly to the extracted tokens in the unparsed line of the log file are displayed in the Extra Mappings table. You can change the Event Field and provide a token operation. To add a new Event Field, click Add Row.

      You can use extra mappings to:

      • Remap an extracted token to a different Event Field in addition to the existing mapping. For example, you can add an Event Field with the value $3 where $3 is the third token in the list of suggested mappings.

      • Map a modified token or combination of tokens to an Event Field. For example, you can add an Event Field with the value __operation($1,$3).

      • Map an Event Field to a constant string or integer. For example, you can add an Event Field with the value __stringConstant(constant).

        For a list of the token operations used when tokens are mapped to ArcSight event fields, refer to the FlexConnector Developer’s Guide (available from the ArcSight Customer Support site).

  9. Click Next to save the mapping to the parser file and display the next unparsed line in the log file.

    After all unparsed lines in the log file have corresponding regular expressions and mappings, the wizard displays the parser file for review.

  10. Review the parser file and make changes, if necessary, directly in the Review Parser File panel.

  11. Click Next to save and package the parser file.

  12. Choose how you want to deploy the FlexConnector:

    • Select Deploy parser to existing connector in container, and then click Next to use the parser file with an existing connector. Click Done to close the FlexConnector wizard and re-display the Container tab.

      Note: The Deploy parser to existing connector in container option displays only if the container already contains a connector of the same type.

    • Select Add new connector to container, and then click Next to add the parser as a new connector. Follow the steps to add the connector to the container.

You can share FlexConnectors with other users. See Sharing Connectors in ArcSight Marketplace.