Sharing Connectors in ArcSight Marketplace
You can share FlexConnectors and parser overrides with other users.
A FlexConnector is a custom connector that you define to gather security events from log files, databases, and other software and devices. You can share the following FlexConnector types:
-
Syslog FlexConnectors (to read events from syslog messages)
-
Log File FlexConnectors (to read fixed-format log files)
-
Regular Expression Log File FlexConnectors (to read variable-format log files)
-
Regular Expression Folder Follower FlexConnectors (to read variable-format log files recursively in a folder)
-
Regular Expression Multiple Folder Follower FlexConnectors (to read events in real time or batch mode from multiple folders)
-
XML FlexConnectors (to read events recursively from XML-based files in a folder)
A parser override is a file provided by ArcSight used to resolve an issue with the parser for a specific connector, or to support a newer version of a supported device where the log file format changed slightly or new event types were added. You can share parser overrides for all connector types that use a parser.
To share a FlexConnector or parser override, you need to package and upload it to ArcSight Marketplace on the ArcSight online community or to your local machine. You can also download a FlexConnector or parser override that you need from ArcSight Marketplace or from your local machine and add it to a container.
Note: ArcSight Marketplace will not be able to reach the ArcSight Community if access is attempted through a proxy server.
Packaging and Uploading Connectors
Before uploading your FlexConnector or parser override to ArcSight Community or to your local computer, you need to package it into a zip file (called an AUP package) using the upload wizard.
A FlexConnector AUP package contains the connector properties file, categorization file, connector parameters, and a manifest file with all the metadata on the package required for successful deployment. Metadata includes information about the AUP package, such as the package type, connector type, connector description, and so on. You can create only one AUP package per connector per device type. You can package a FlexConnector in Basic or Advanced mode. In Basic mode:
-
The wizard packages the FlexConnector properties file automatically. If the wizard finds more than one properties file, you are prompted to select the file you want to package.
-
The wizard packages the categorization file automatically only if it can be determined based on the device vendor and product information found in the properties file.
-
The wizard does not package connector parameters. You are prompted to configure the connector when it is downloaded and deployed.
In Advanced mode:
-
The wizard packages the FlexConnector properties file automatically. If the wizard finds more than one properties file, you are prompted to select the file you want to package. (Same as Basic mode.)
-
The wizard packages the categorization file automatically if it can be determined based on the device vendor and product information found in the properties file. If the categorization file cannot be determined, you are prompted to select the categorization file you want to package from the list of files found in the container.
-
The wizard displays connector parameters so you can configure the ones you want to display and set the default values you want to provide during connector deployment (download). The parameters you do not configure for display are pre-configured with the current values and will not be displayed during connector deployment.
A parser override package contains the parser override properties file and the manifest file only.
Follow the steps below to package and upload a FlexConnector or parser override.
-
To upload to ArcSight Marketplace, you must have a valid username and password for ArcSight Community.
-
Make sure that you have configured network settings under Administration > System Admin > Network and that ArcSight Management Center can communicate with the ArcSight Community server.
To package and upload a FlexConnector or parser override:
-
Click Node Management.
-
In the navigation tree, browse to the connector for which you wish to upload a package. In the management panel, the Connector summary tab is displayed.
-
On the Connector details page, click
.The upload wizard is launched.
-
Click Next and follow the steps in the wizard to:
-
Select the type of AUP package you want to create for the selected connector.
ArcSight Management Center scans the container and displays the relevant files that can be packaged.
-
For a FlexConnector, select Basic to create a default package or select Advanced to customize the package to meet your needs.
-
If the connector contains several properties files, you are prompted to select the properties file you want to package. Certain connectors, for example, syslog connectors, can have more than one parser override folder, in this case, you are prompted to select the folder you want to package.
-
If you previously selected Advanced mode for a FlexConnector, and the categorization file cannot be determined, you are prompted to select the categorization file you want to package from a list of files found in the container.
Note: Categorization files are not packaged for parser overrides.
-
If you previously selected Advanced mode for a FlexConnector, select the configuration parameters you want to display when the connector is deployed and then provide default values for these parameters. Parameters you do not select are pre-configured with the current values.
If any advanced connector parameters were previously modified from their defaults, the wizard displays these parameters so that you can select which ones you want to be configured automatically during deployment.
Note: Configuration parameters are not displayed for parser overrides. If the connector has table parameters, they are not displayed during packaging. However, when the connector is downloaded to a container, you are prompted to provide values for all the table parameters.
-
Provide a description of the AUP package and instructions on how to configure the device used by the connector.
-
Provide the vendor, product, and version of the device used by the connector.
If the wizard can determine the vendor, product, and version of the device, the information is displayed in the fields provided. You can change the information to meet your needs.
-
Upload the created AUP package to ArcSight Marketplace or to your local machine. You will require a username and password for the OpenText Community.
Downloading Connectors
You can download a FlexConnector or parser override that is available from ArcSight Marketplace on the OpenText Community or from your local computer. You download a FlexConnector or parser override directly to a container.
You can download only one FlexConnector per container using the download wizard. However, there is no limit to the number of parser overrides you can download to a container.
-
When downloading a parser override to a container, the download wizard overwrites any existing parser override with the same name in the container without prompting for confirmation. To avoid overwriting an existing parser override, send a Get Status command to the existing parser override to check the parser information before you download a new one. For information on sending a Get Status command, refer to Sending a Command to a Connector.
-
Always back up the container to the Backup Files repository before downloading a connector or parser override so you can revert to the previous configuration if the download produces unexpected results.
Follow the steps below to download a FlexConnector or parser override to a container.
To download to ArcSight Marketplace, you must have a valid username and password for ArcSight Community. Also, make sure that you have configured network settings under Administration > System Admin > Network and that the appliance can communicate with the ArcSight Community server.
To download a FlexConnector or parser override:
-
Click Node Management.
-
In the navigation tree, browse to the host on which the container resides.
-
In the management panel, click the Containers tab.
-
From the list of containers, locate the container into which you want to download the connector. In the Action drop-down, select Run FlexConnector Wizard.
-
Click Next and follow the steps in the wizard to:
-
Select whether you want to download the connector from ArcSight Marketplace on ArcSight Community or from your local computer.
-
Select the AUP package you want to download.
On the OpenText Community, you can search for a parser override or FlexConnector AUP package using a keyword or a combination of keywords.
Note: You can only download a parser override package to a container that has a connector of the same type as the package. You can download only one FlexConnector per container using the download wizard. If the container already contains a FlexConnector of the same type as the one you want to download, you can replace the existing FlexConnector with the one you are downloading, but you cannot create a new one.
-
For a FlexConnector, provide connector configuration parameters, if needed.
Pre-configured and advanced parameters are deployed automatically with the values that were packaged; you are not prompted to configure these parameters. The configurable parameters are displayed with suggested defaults, which you can modify if necessary. The table parameters are displayed with no configured values, you have to provide the values manually, as needed.
-
Add or select a destination for the connector.
If you are downloading the connector to a container that has an existing connector of the same type, you are not prompted for a destination.
The wizard copies the properties and categorization files to the appropriate locations and also installs the zip file for the AUP package in the user/agent/deployedaups
folder on ArcSight Management Center to keep track of the deployment history.
After a successful download, the container is restarted automatically.