Skip to main content

Cyware Orchestrate

Micro Focus ArcSight Logger

App Vendor: Micro Focus

App Category: Analytics & SIEM

Connector Version: V1.0.0

API Version: Software Version 6

About App

ArcSight Logger is a log management solution that is optimized for extremely high event throughput, efficient long-term storage, and rapid data analysis. Logger receives and stores events; supports search, retrieval, and reporting; and can optionally forward selected events. Logger compresses raw data, but can always retrieve unmodified data on demand for forensics-quality litigation data.

The ArcSight app is configured with the Orchestrate application to perform the following actions:

Action Name

Description

Close search operation

This action stops the execution of the search and clears the search session data from the server.

Create new search

This action starts/creates a new search.

Drilldown search

This action drills down search and narrows down search results to the specified time range. For example, you can use this action to narrow down the search results to be shown in the grid when a bar of the histogram is clicked.

Search events

This action retrieves a list of events found in the specified search.

Histogram search

This action retrieves the data you can use to display a histogram (a column chart with no gap between columns) of the event distribution over an already searched time range.

Status of search

This action checks the latest status of the specified search.

Stop search operation

This action stops the search operation but keeps the search session active so that the search results can be narrowed down later.

Search raw events

This action retrieves the raw events for the specified row IDs.

Search chart data

This action retrieves data you can use to display a chart and the table under the chart. This action also returns the results of aggregate operators like sort, tail, and head.

Configuration Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Base url

Enter the base URL to access ArcSight Logger.

Example:

"http[s]://domain.tld[:port]"

Text

Required

Username

Enter the username to authenticate ArcSight Logger.

Text

Required

Password

Enter the password to authenticate ArcSight Logger.

Password

Required

TLS verification

Specify the preference to verify or skip the TLS certificate.

Boolean

Optional

Allowed values:

  • True

  • False

Default value:

  • False

Action: Close search operation

This action can be used to stops the execution of the search and clears the search session data from the server.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Search session ID

Enter the search session ID.

Example:

"10234567"

Integer

Required

Example Request

[
    {
        "search_session_id": "10234567"
    }
]
Action: Search events

This action retrieves a list of events found in the specified search.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Search session ID

Enter search session ID.

Example:

"10234567"

Integer

Required

Additional parameters

Enter the additional parameters.

Key Value

Optional

Allowed values:

  • dir(str) - forward, backward

  • fields(str): the list of fields in the order to show

  • length(int) - default (1000), max (10000)

  • offset(int) - default 0

Example Request

[
  {
    "search_session_id": "10234567",
    "extra_params": 
    {
      "dir": "forward",
      "length": 100,
      "offset": 10
    }
  }
]
Action: Stop search operation

This action stops the search operation but keeps the search session active so that the search results can be narrowed down later.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Search session ID

Enter the search session ID.

Example:

"10234567"

Integer

Required

Example Request

[
    {
        "search_session_id": "10234567"
    }
]
Action: Search raw events

This action retrieves the raw events for the specified row IDs.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Search session ID

Enter search session ID.

Example:

"10234567"

Text

Required

Raw ID

Enter the raw IDs as a list.

Example:

"[“101”, “102”, “103”]"

List

Required

Example Request

[
  {
    "search_session_id": "10234567",
    "row_ids": ["101", "102", "103"]
  }
]
Action: Search chart data

This action retrieves data you can use to display a chart and the table under the chart. This action also returns the results of aggregate operators like sort, tail, and head.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Search session ID

Enter search session ID.

Example:

"10234567"

Text

Required

Length

Enter the length of the results.

Example:

"10"

Integer

Optional

Default value:

  • 25

Offset

Enter the offset.

Example:

"5"

Integer

Optional

Default value:

  • 0

Example Request

[
  {
    "search_session_id": "10234567",
    "length": 10,
    "offset": 5
  }
]