How to Write HP ArcSight FlexConnectors

© Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.

How to Write HP ArcSight FlexConnectorsAaron Kramer, CISSP, CEHJune 25, [email protected]

© Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.2

Agenda

• Logistics• SmartConnector Capabilities• FlexConnectors• Sources of Help• FlexConnector Toolkit Demo• Questions and Answers


Logistics

• Lots of Material• Submit Questions via the Questions section in this Virtual Room• My background

– Over 20 years in Network, Application, and Computer Security (CISSP, CEH)– currently a Global Field Support Engineer for HP ArcSight– >9 years of ArcSight experience– Presented at previous ArcSight Protect User Conference on FlexConnectors, Logger,

ESM– Regular contributor to the Protect724 User Community


SmartConnector Capabilities


SmartConnector Event Collection


SmartConnector Event Collection


Connectors: Robust Collection

Follows NIST 800-92 Log Aggregation Guidelines

HP ArcSight Logger HP ArcSight ESM/Express

ArcSight Connector

Centralized Updates/Upgrades

Bandwidth ManagementHeartbeat Connection

Encrypted & Compressed


My device or Application or Source is NOT one of the 350+ listed Supported sources?

Why FlexConnectors?

Enter the HP ArcSight FlexConnector


HP ArcSight FlexConnectors


HP ArcSight FlexConnectors

• Has same capabilities as SmartConnectors (Caching, Batching, Compression, etc)

• The FlexConnector Developer Toolkit is the same Toolkit that Developers use to write the 350+ SmartConnectors

• The Toolkit is a fully-supported and documented offering

• The FlexConnector Development Kit is a licensed item; must be purchased.

• GOAL: Produce the Properties File


HP ArcSight FlexConnectors can be written for various Files and Formats and Sources

FlexConnector Types

• Regularly-formatted Files

• Files processed better by use of Regular Expressions


FlexConnector Types

JSON Files XML Files



FlexConnector Types

Read from Databases Various sources in a Syslog Stream



FlexConnector Types

SNMP Over a RESTful API

• REST API endpointshttps://abc.com/events?created_after=<>&maxEvents=<>...

• JSON output• OAuth2



Where do FlexConnectors Run?

• Windows• Linux• Solaris• AIX• Connector Appliance


ArcSight FlexConnector Wizard on Connector Appliance

Step 1 Upload

the Device Log File

Step 2 Parse the

Device Log File

Step 3 Generat

e the FlexConnector


flexagentwizard regex

Flex Connector Helpers


ArcSight Flex Connectors• GOAL: Produce the Properties File, with 3 sections– Parsing– Tokens, types, and formats– Mapping

• Delimited File: Delimiter, Tokens, Mappings• Regular Expression: Words, Tokens, Mappings• Database: Query, Tokens, Mappings•… and so on


HP ArcSight FlexConnector Further Capabilities• Follow File Rotations and Follow Folders• Consume Multiline events• Advanced functions to parse, manipulate, convert• __concatenate(String1,String2….)

• __extractNTDomain(“AMERICAS\WABC123”) yields AMERICAS

• __regexToken(TOKEN,regex)

• __simpleMAP(TOKEN,Case1,Case2…)

• __safeToLong(TOKEN)

• Lots n lots more

• Pull pieces of filename or filepath

• Chaining – where one type of Flex Connector calls another– A text file of events, where each event has a field that is XML in structure

• Can read compressed files directly


Sources of Help

• Documentation– FlexConnector Developer’s Guide– REST FlexConnector Developer’s Guide

• http://Protect724.HP.Com Forums– Question and Answer– Previous HP Protect Content

• Tech Support – supporting the FlexConnector Developer Toolkit, not the FlexConnector itself

• HP Partners• HP ArcSight Education

– 3-day course• HP ArcSight User Gatherings

http://protect724.hp.com/




How To Write a FlexConnector


How To Write a FlexConnector

• Confirm that your organization is licensed for the FlexConnector Developer Toolkit• Research to see if a FlexConnector was already written by someone else, somewhere

else• Gather Sample Log events and/or files• Decide on which FlexConnector is best (File reader, database reader, Syslog subagent)• Consult the FlexConnector Developer Guide for step-by-step example


Switch to Live Demo


Questions and Answers

For more information, and future webinars, please visit:

https://protect724.hp.com/community/events/enterprise-security-webinars


Thank you

Documents

How to Write HP ArcSight FlexConnectors