Transitioning Event Consumers to the mf-event-avro-enriched Topic
This procedure is required only when you have deployed Transformation Hub. It must be performed prior to upgrade.
ArcSight provides a new topic to Transformation Hub, mf-event-avro-enriched, which enables Transformation Hub to execute enrichment tasks, which include generating a Global Event ID (GEID), on events from the configured source topic using a stream processor.
Events are then routed to the topic mf-event-avro-enriched. Event consumers, such as the ArcSight Database, ArcSight Intelligence, and (optional) ArcSight Enterprise Security Manager (ESM), will be able to receive richer event information from this topic either directly or indirectly via an intermediate (filtered) topic.
As a result of the upgrade, Transformation Hub consumers will switch to the new topic. These instructions ensure that you will not have lost or duplicated events.