Filtering Events for ESM

Transformation Hub is capable of filtering and routing from a source topic of type event-avro to a destination topic of type event-avro. This capability can be used to filter events from a source topic such as mf-event-avro-enriched to a destination topic which ESM can consume from, such as mf-event-avro-esmfiltered. Both of these are default topics described here.

1. Use ArcSight Smart Connectors or any producer that supports sending Avro formatted events to send the events directly to an event-avro topic. Smart Connectors by default will send Avro formatted events to the th-arcsight-avro topic.

2. Filter the events using Transformation Hub's Avro routing rules using ArcMC 2.96 or later. Create a routing rule with an event-avro topic as source topic (such as mf-event-avro-enriched) and an event-avro topic as destination topic (such as mf-event-avro-esmfiltered). For more information, please refer to the routing section in the ArcMC Administration Guide.

   Earlier versions of Transformation Hub that did not yet support Avro routing rules required using a combination of CEF routing rules and CEF-to-Avro conversion. Using Avro routing rules is a more efficient way to filter Events for ESM, however, so it is now the recommended approach.
   As a general guideline, th-arcsight-avro is no longer a recommended source topic for Avro routing; use mf-event-avro-enriched instead. For more information, see About Routes.