Completing Optional Post-Upgrade Tasks

This section describes optional post-upgrade tasks. Ensure that the upgrade was successful before you perform these tasks.

To complete optional post-upgrade tasks:

  1. Archive backup files that the upgrade program created.

    The upgrade program creates backup files for rollback purposes. These files might contain outdated JREs and other components that include vulnerabilities. Security scanners can detect these vulnerabilities. To avoid issues with security scanners, you can archive these backup files and restore them if necessary.

    To archive the backup files, run the following script:

    opt/arcsight/manager/bin/arcsight hide_obsolete_files

    The archive is created in /opt/arcsight. You can relocate the archive, but you must move it back to /opt/arcsight in order to restore it.

    If you need to revert to the previous version of ESM for any reason, you must restore the archive first. To restore the archive, run the following script:

    opt/arcsight/manager/bin/arcsight hide_obsolete_files -u <archive name>

    For example, opt/arcsight/manager/bin/arcsight hide_obsolete_files -u BLXXXX.

  2. Convert from compact mode to distributed correlation mode.

    For more information, see Completing Optional Post-Upgrade Tasks.

  3. Convert appliances to prefer IPv6.

    For more information, see Completing Optional Post-Upgrade Tasks.

  4. Install the following packages:

    • ArcSight SocView

    • ArcSight ClusterView

    • Threat Intelligence Platform

    • Security Threat Monitoring

    • ArcSight ESM SOAR Integration

    For descriptions of these packages, see the ArcSight Administration and ArcSight System Standard Content Guide.

    ESM automatically installs content packages for new installations. However, when you upgrade, new packages are not automatically installed. You can install these packages from the ArcSight Console after the upgrade.

    For information about installing these packages, see the ArcSight Console User's Guide.

  5. Install NetFlow SmartConnectors.

    NetFlow events from the following SmartConnectors trigger NetFlow Monitoring content:

    • ArcSight IP Flow SmartConnector
    • ArcSight QoSient ARGUS SmartConnector

    These SmartConnectors are not installed with ESM. To use the NetFlow Monitoring content, install and configure these SmartConnectors. For information about obtaining the SmartConnectors, contact your sales representative.

  6. Install the ArcSight Platform.

    The ArcSight Platform enables you to visualize, identify, and analyze potential threats by incorporating intelligence from the multiple layers of security sources that might be installed in your security environment:

    • Real-time event monitoring and correlation with data from ESM
    • Analyzing end-user behavior with Interset

    To help you get started, the ArcSight Platform provides a Dashboard with a set of out-of-the-box widgets and dashboards. Users can organize the widgets into personalized dashboards.

    For information about deploying, configuring, and maintaining this product, see the Platform Release Notes and the Administrator's Guide for the ArcSight Platform.

    Note: This release allows you to connect to a single ESM instance.

  7. If you want the ability to view Command Center from the ArcSight Platform, install ESM in the ArcSight Platform and then configure the ESM host in the ArcSight Platform. For more information, see the Administrator's Guide for the ArcSight Platform.

    This feature allows you to view Command Center from the ArcSight Platform without having to switch to the ESM host for Command Center. After you install ESM and configure the host in the ArcSight Platform, refresh the dashboard to display the Command Center menu in the ArcSight Platform. Click the menu to start Command Center. To go back to the ArcSight Platform dashboard from Command Center, use the ArcSight Platform menu from the Dashboard menu in Command Center.

  8. Configure Recon access.

    For more information, see Completing Optional Post-Upgrade Tasks.

  9. Configure Transformation Hub access.

    For more information, see the applicable topic:

  10. Configure integration with ServiceNow® IT Service Management (ITSM).

    For more information, see Completing Optional Post-Upgrade Tasks.

After you complete optional post-upgrade tasks, check the following topics for any additional changes you want to complete or continue to Upgrading the ArcSight Console and Smart Connectors.