Installing Standalone SmartConnectors

You can install SmartConnectors on the machine hosting a standalone instance of ArcMC, another host machine, or the device. Standalone SmartConnectors do not require ArcMC.

If you install the connector on a virtual machine, enable NTP for both host and guest systems to ensure proper timekeeping. For more information, see “Timekeeping best practices for Linux guests (1006427)” on the VMWare Customer Connect website.

To download the files, you will need your AWS IAM user and the information provided by the OpenText SaaS team:

  1. Log in to the Amazon S3 Console as the AWS IAM user that you created for data ingestion.

  2. To download data ingestion component installers from the S3 bucket, browse to the URL provided by the OpenText SaaS team.

    By default, the URL uses the format https://s3.console.aws.amazon.com/s3/buckets/<tenant bucket name>/connector-download/.

    For example: https://s3.console.aws.amazon.com/s3/buckets/222222222-ap-southeast-1-secopstn01-avro/connector-download/

  3. Click your user name, and then select Switch Roles from the user menu.

    If you performed the Switch Roles procedure earlier and did not clear the browser cache, the role to switch to appears under Role History which you can select, skip step 4, and save time.

  4. Click the Switch Role button and enter the following details you received from the OpenText SaaS team to download the data ingestion component installers:

    1. Account

    2. Role

    3. (Optional) Display Name

    4. (Optional) Color

  5. Click Switch Role.

  1. Download the installation files for SmartConnectors.

  2. Install the SmartConnectors.

  3. Configure the SmartConnector. For more information about configuring the SmartConnector, see the see the SmartConnectors Grand List - (A-Z) page to refer to the documentation relevant for your SmartConnector.

    When configuring a connector to use the Amazon S3 destination to send data to ArcSight, you must use the same Amazon Access Key for all connectors.

  4. Configure one of the following destinations depending, on the SaaS services that you use:

    Services in use Destination SmartConnector behavior

    Log Management and Compliance only

    		 Amazon S3 Sends batches of events to ArcSight

    Either of the following scenarios:

      •  Real-time Threat Detection only

      •  Log Management & Compliance and Real-time Threat Detection

    		 ArcSight SaaS Sends a real-time stream of events to ArcSight

    For more information about configuring destinations, see the Installation Guide for ArcSight SmartConnectors.

  5. (Conditional) Apply the latest parser update to the SmartConnectors:

    To download the parser update files for your SmartConnectors, go to ArcSight SmartConnector Parser Update in the ArcSight Marketplace. By default, the ArcSight-x.x.x.xxxx.x-ConnectorParsers.aup file that you download also includes the unobfuscated parser update, which allows you to modify the parsing logic as desired. For example, use the file ArcSight-8.3.3.8815.0-ConnectorParsers.aup.

  6. Optimize the configuration of your SmartConnectors.