Creating or Editing Packages

When you add a group to a package, all the group’s contents are automatically included. For top level groups (<Resources>/All <Resources>), the package therefore includes all folders that come with ArcSight, which may present a problem if the package is imported in another ArcSight system. If you defined resources directly under the All <Resources> node and you want to add these resources to a package, create a group and add the resources there.

It is also important to note that when you delete a package containing a group, you delete members of the group that were added after the package was created. If it is a top-level group (<Resources>/All <Resources>), you would be deleting all of those resources. Packaging sub groups gives you more flexibility and less risk. Also see Backing Up and Restoring with Packages.

When editing packages, you should consider whether you need to export it before you change it so you have a backup, and possibly export it when you are done, to update or create a new backup.

Where: Navigator > Packages tab

To create or edit a package:

1. To create a package, right-click a package group and select New Package.

   To edit a package, right-click the package and select Edit Package.

2. In the Inspect/Edit panel, set or change the attributes as appropriate.Some of these attributes may not appear if they do not apply. The only required field is the Name field and many field values are supplied by the system:

   Package Editor Attributes
   Name Enter a name for the new package.
   Required Packages Specify the packages that must be installed for this package to function.
   Optional Packages Specify packages that are related to this package, but which are not required for it to function.
   Required Features Enter any features that must be available for this package to function. The list contains Threat Detector.
   Installed This is a read-only status indicator. If it is checked, it indicates that the package is installed, which new packages are, by default. You can uninstall a package by right-clicking it in the tree after you have created it, and selecting Uninstall Package. The icon for uninstalled packages is grayed out.
   Update Available This is a read-only status indicator. If checked, it indicates that a different version of the package was imported, but has not been installed. The icon for packages in this state has a small white up arrow in the lower left corner ().
   Author Name Enter the name of the author or source for the new package.
   Package Version The package version can be any string, but the recommended format is n.n.n.n, with numbers in decreasing importance (major, minor, release, build).
   ArcSight Version This is a read-only ESM version that is the minimum product version needed to support this package.
   Format Specifies the format to use for archiving. This affects the resources that are included in the package, the resource attributes that are retained in the package, and how conflicts are handled during package installation. Tip: If your package contains lists, see also List Data for additional help with formats you can use. Contentsync - Use this if you intend to synchronize content among other Manager peers. The Manager that is the source of the contentsync package is the designated publisher, while other Managers are the subscribers (content management feature). For details on content management and the establishment of peer relationships, refer to the Command Center User’s Guide. Note: Not all packages are eligible for content synchronization. See Supported Packages for Content Synchronization for more information. Default - Use this for backing up resources on a Manager. This format includes additional, such as data in active lists, including information specific to a Manager, whereas other options do not. Export - Use this for packaging resources for transport between systems. Manager-specific information is excluded from the exported package for resources with attributes that would otherwise retain such information upon a "Default" export. For example, a trend packaged in "Export" format does not include Start End Time trend attributes nor original table IDs. Instead, the imported trend uses Start and End times corresponding to when the package is installed on a new system. Also at install, a new trend table is created. (See descriptions of Imported Trend Start Time and Imported Trend End Time fields under Trend Attributes.) Similarly, active lists and session lists packaged in "export" format do not include Locked By attributes, table IDs, or session/active list entries. New tables are created when the lists are imported, and the other attributes are tracked when these resources launch on the new system. This format packages other resources similarly as a means of optimizing portability for content distribution. Standard system content is packaged using the "Export" format. Also, Managed Security Service Providers (MSSPs) who provide content to installations at various customer sites might package resources in this format. Exportuser - Use this format only for exporting user accounts with no permissions, personal group information, or relationships to other resources. If you want to export user accounts that include permissions and groups, use the default format instead. Upgrade - For use by ArcSight Professional Services only. This format might be used for resource upgrades of older systems in some circumstances. (Usually, standard upgrade utilities and processes are used instead.)
   Obfuscated Check this box to encrypt the contents of the ARB file, making it impossible to view without importing it.
   Exclude Reference IDs Check this box to remove reference IDs from the package when it is exported. Generally, you would exclude reference IDs only when you plan to import the package into a different system. Leave the box unchecked to include reference IDs, which improves performance for packages that are imported to the same Manager from which they were exported. Note: Reference IDs are not the same as resource IDs. Resource IDs are always part of the resources and included in package imports and exports.
   Creation Timestamp The date and time when this package was last exported (archived).
   Required package For Shows any other packages for which this package has been set as a required package. These other packages are therefore “Dependent Packages.”
   Optional Package For Shows any other packages for which this package has been set as an optional package.
   Archive ID This system-assigned ID that is refreshed whenever you export the resource.
   Available Archive Translations If the archive defining the package has been rendered into different languages, they are listed here.

   Also refer to the common attribute fields described in Common Resource Attribute Fields.

3. Click the Resources tab in the Package Editor.

4. Click the Add drop-down menu to select the resources that this package should contain. You can select groups or individual resources. Check the Children Only box to include resources below the specified resource in the tree. For example, selecting the group /All Session Lists/ArcSight Administration/User and checking Children Only would include only the session list resources in that group, not the group itself.

5. Check the Only If Referenced box to conditionally include resources if they are referenced by other resources. This is best when used in conjunction with the Children Only attribute, and you are adding a group resource.

6. To exclude resources from the new package, use the Removed Resources panel in the lower half of the Resources tab.

   • To exclude resources by type, click the Excluded Resource Types tab and select from the list of available types.

   • To exclude specific resources, click the Removed Resources tab, click the Add drop-down menu, then select the resources you want to exclude. This tab also includes a Children Only option, but an If Not Included option instead of an Only if Referenced option.

   Caution: The only way to exclude Asset Category resources from a package is to specify the Asset Categories explicitly using the Removed Resources tab.

   Tip: If you include locked resources or shared system resources, then when uninstalling or deleting a package, you get a message that the package framework has a number of locked resources, and therefore cannot be uninstalled or deleted.

   When that happens you can either unlock the resource and continue or choose to skip the locked resource, in which case it will not be uninstalled or deleted.

7. Optional: To add information in the Notes tab, refer to Using Notes.

About Locked Packages

You can lock packages after creating them by right-clicking on the Navigator panel and selecting Lock Package. Note that if you send locked packages, these packages cannot be installed in another ESM system.