Esm management console_userguide_6.0c

Management Console
User’s Guide
For ArcSight ESM™ 6.0c
with CORR Engine
September 12, 2012

Management Console User’s Guide, ArcSight ESM™ 6.0c
Copyright © 2012 Hewlett-Packard Development Company, LP. All rights reserved.
Confidential computer software. Valid license from HP required for possession, use or copying. Consistent
with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and
Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard
commercial license.
The information contained herein is subject to change without notice. The only warranties for HP products
and services are set forth in the express warranty statements accompanying such products and services.
Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for
technical or editorial errors or omissions contained herein.
Follow this link to see a complete statement of copyrights and acknowledgements:
http://www.hpenterprisesecurity.com/copyright
The network information used in the examples in this document (including IP addresses and hostnames) is
for illustration purposes only.
This document is confidential.
Revision History
Contact Information
Date Product Version Description
09/12/12 ESM 6.0c Management Console Guide for ESM 6.0c
Phone 1-866-535-3285 (North America)
+44 203-564-1189 (EMEA)
+49 69380789455 (Germany)
Support Web Site http://support.openview.hp.com
Protect 724 Community https://protect724.arcsight.com

Confidential Management Console User’s Guide 3
Contents
Chapter 1: Introduction ...................................................................................................... 5
Overview ....................................................................................................................... 5
Starting the Management Console ..................................................................................... 6
Management Console Navigation ....................................................................................... 7
Help Link ....................................................................................................................... 7
: Administration .................................................................................................................. 9
Navigation ...................................................................................................................... 9
User Management ........................................................................................................... 9
Add or Edit a User Group ......................................................................................... 10
Clone a User Group ................................................................................................. 10
Delete a User Group ................................................................................................ 11
Delete a User from a Group ...................................................................................... 11
Edit Advanced Permissions ....................................................................................... 11
Add or Edit a User ................................................................................................... 13
Delete a User ......................................................................................................... 14
Copy a User ........................................................................................................... 14
Search for a User .................................................................................................... 14
CORR Engine Management ............................................................................................. 15
Overview ............................................................................................................... 15
Event & Resource Storage ........................................................................................ 16
Event Storage .................................................................................................. 16
System Storage ................................................................................................ 18
Notification List ................................................................................................. 18
Archive Jobs ........................................................................................................... 18
Configure Automatic Archiving ............................................................................ 21
Archives ................................................................................................................ 22
Registered Connectors ................................................................................................... 23
Connector Editor ..................................................................................................... 24
Connector Commands .............................................................................................. 25
Configuration Management ............................................................................................. 31
License Information ................................................................................................. 31
Server Management ................................................................................................ 31
Manager Heap Size ........................................................................................... 31
Enable Notifications ........................................................................................... 31
External Mail Server Information ......................................................................... 32
Enable Acknowledgements ................................................................................. 32

4 Management Console User’s Guide Confidential
Restart ............................................................................................................ 33
Authentication Configuration .................................................................................... 33
How external authentication works ...................................................................... 33
Guidelines for setting up external authentication ................................................... 33
Password Based Authentication ........................................................................... 34
Password Based and SSL Client Based Authentication ............................................ 37
Password Based or SSL Client Based Authentication .............................................. 37
SSL Client Only Authentication ........................................................................... 37
Chapter 3: Management Console Dashboards ................................................................... 39
Dashboard Overview ..................................................................................................... 39
Viewing Dashboards ...................................................................................................... 40
Edit Menu .................................................................................................................... 40
Arrange ................................................................................................................. 40
Auto Arrange .......................................................................................................... 40
Background Options ................................................................................................ 41
View Menu ................................................................................................................... 41
Tools Menu ................................................................................................................... 41
Animation .............................................................................................................. 42
Refresh ................................................................................................................. 42
Reload Button ............................................................................................................... 42
Save Button ................................................................................................................. 42
Dashboard Element Right-Click Options ............................................................................ 42
Auto Arrange .......................................................................................................... 42
Save ..................................................................................................................... 43
Drilldown ............................................................................................................... 43
Data Monitor Disable/Enable ..................................................................................... 43
View As ................................................................................................................. 44
Choose Colors ........................................................................................................ 44
Chapter 4: Preferences ..................................................................................................... 45
Custom Modules ........................................................................................................... 45
Skins & Effects .............................................................................................................. 45
Logging ....................................................................................................................... 46
Account Settings ........................................................................................................... 47
Index ...................................................................................................................................................... 49

Chapter 1
Introduction
This section provides a general overview of the ArcSight Management Console navigation
and functions. Click on the Welcome module to see what’s new.
Overview
The ArcSight Management Console provides a streamlined interface that enables you to:
 Manage user accounts and user groups
 Manage data and event storage, archiving, and notifications
 Configure Connectors, notifications, and authentication
 Monitor events and resources from the dashboard
 Update your license
 Access ArcSight Web
In addition, you can install a separate ArcSight Console on other machines. This ArcSight
Console is documented in the ArcSight Console User Guide. It enables you to create and
manage resources, dashboards, and other objects, investigate events and patterns, and
perform other necessary functions that the Management Console cannot do.
Streamlined Event Archiving
The CORR Engine enables scheduled archiving of daily event data, holding it for a specified
retention period, and restoring older archives if they are needed for analysis.
Real-Time Correlation & Analytics
The CORR Engine provides the foundation for correlation, and draws upon ArcSight's
modeling, priority formula, and correlation conditions framework to identify, infer meaning,
prioritize, and act upon events of interest.
Overview
Starting the Management Console
Management Console Navigation
Help Link

1 Introduction
Real-Time Monitoring
ESM implements interactive layouts for monitoring data using dashboards. These dynamic
layouts enable users to see custom views of event and other data. You can create new
custom views in the ArcSight Console.
CORR Engine Storage and Retrieval
The Correlation Optimized Retention and Retrieval Engine (CORR Engine) is a proprietary
data storage and retrieval framework that enables ESM to receive events at high rates and
perform high-speed searches.
ESM Start-Up Content
ESM includes a set of coordinated resources that address common security and
management tasks to give you comprehensive correlation, monitoring, reporting, alerting,
and case management out of the box with minimal configuration.
Starting the Management Console
To start the console from a supported browser enter the following URL:
https://<IP address>:8443/
Where <IP address> is the host name or IP address that you specified when you first
configured ESM.
After you have logged in, there is a logout link in the upper right corner of the window.
General Prerequisites
 If the Manager is using FIPS, then configure your browser to use TLS.
 If you are using FIPS and SSL, use the runcertutil command on the Manager to
export a client certificate for the browser machine. If you are not using FIPS, export
certificates with the Keytoolgui command. Refer to the Administrator’s Guide for
more information.
Logging in with Password Authentication
Log in with your User ID and password. Your user type controls which resources you have
access to.
Logging in with SSL Authentication
Make sure you have exported a client certificate from an ArcSight Console machine. Specify
the certificate to use and click OK. When you get to the Management Console user ID and
Password screen, just click Login without specifying anything.
Logging in with SSL or Password Authentication
To log in with an SSL certificate, make sure you have exported a client certificate from an
ArcSight Console machine. Specify the certificate to use, and click OK. When you get to the
Management Console User ID and Password screen, just click Login without specifying
anything.

1 Introduction
To log in with a user ID and password, click Cancel on the certificate dialog, then provide
your user ID and password on the User ID and Password screen.
Logging in with SSL and Password Authentication
Make sure you have exported a client certificate from an ArcSight Console machine. Specify
the certificate to use and click OK. When you get to the Management Console User ID and
Password screen, specify your User ID and password.
Management Console Navigation
The Management Console home page appears when you start Management Console or
click the Home icon ( ) on the tab bar from any Management Console module.
Hover the mouse over each Management Console module icon to expand it and show a
brief description of that module’s use.
Each Module page has a tab bar at the top that provides access to the other modules.
The navigational elements on each Management Console module page are different and
are described in their respective chapters in this guide.
Help Link
Click the Help link in the upper right corner
for a page with links to documents relevant
to using ESM. The documents appear as a
comprehensive HTML Help system and there are links to a PDF version of each document.
The Installation Guide for this version of ESM is available from the customer support
download site for ESM.
The arrow buttons in the upper left of each help page take
you back and forth through topics in the order in which
they appear in the table of contents, regardless of whether
you were looking at them previously.
If you are using Microsoft Internet Explorer 9, this option does not work: If
you import a certificate, you must always use SSL (cancelling fails to load the
page). If you do not import a certificate, you can only use password
authentication.
While logging into a Manager that has been configured to use
Password-based or SSL Client Based authentication, if you try to log in using
a certificate and the login fails, all subsequent attempts to use the
username/password login will also fail during the same session. To work
around this, restart the browser and clear its cache.
If a Management Console page stops loading or presents a JavaScript error, for
example if there is a network interruption during loading, try pressing F5 to
refresh the page.

1 Introduction
ArcSight Web runs embedded in a Management
Console module. It has its own context-sensitive
online help link in the upper right corner of the
ArcSight Web window.
For ArcSight Web documentation, refer to that help
link or the ArcSight Web help and PDF link on the
Management Console’s Welcome page, shown at the top.

Administration
The Administration module enables you to control administrative functions such as users,
storage, connectors and configuration.
Navigation
The accordion panel on the left contains expandable bars for each of the Administrative
features in the Administration module.
Click the double arrow in the upper left corner
of the accordion panel to hide the whole panel.
Click it again to restore it.
When you click each function bar it expands to show the objects in this function that you
can administer. For example the User Management function shows the user group
hierarchy.
User Management
If it is not already expanded, click the User Management bar in the accordion panel to
add, edit, or remove users and user groups.The All Users list is divided into three groups:
 Administrators
 Custom User Groups
 Default User Groups
You can add and delete users and groups, and perform other user management functions.
Highlighting any group displays its members in the user panel to the right.
In general, when you are first getting started, create groups first. You can only create a
new user in an existing group
“Navigation” on page 9
“User Management” on page 9
“CORR Engine Management” on page 15
“Registered Connectors” on page 23
“Configuration Management” on page 31

2 Administration
Add or Edit a User Group
You can add a sub group to any group below the top level. To create or edit a user group,
use the following procedure:
1 To add a group: In the hierarchy tree on the left, right-click on the group to which you
want to add a new child group and select New Group.
To edit a group, highlight the group you want to edit and either right-click and select
Edit or select Edit Group at the top right of the group member list panel.
2 Enter a Name and a Description. The URI field specifies the hierarchical location of
the group. when adding a group, if you want the new group to be the child of a
different group, abandon the operation and add to the other group.
3 In the users box, Select Add to add users to this group. This is optional; you can add
users later. If you have not yet added any users to your system, see “Add or Edit a
User” on page 13, and then come back here to add them to groups.
 Select a user in one of the boxes and use the left or right arrow keys to move the
user to the other box. The users in the Selected Users box are members of the
group.
 You can start typing in the data entry field above the Available Users box to
filter the list of available users. Click the X to the right of that field to clear it and
restore the list of available users.
 Use the double arrows (the top-most and bottom-most arrows) to send every user
in the box to the other box.
4 Click Save to save the group and return to the group page.
Click Cancel to clear any field changes you have made and restore them to the way they
were. To close the edit/add panel, click anywhere in the tree view on the left.
After you add a user group, select the resources and actions to which this group has
access. See “Edit Advanced Permissions” on page 11.
Clone a User Group
You can create a copy of a user group using the Clone Group link. Clones are created within
the same parent group as the cloned group. You cannot move a group to another group.
1 Highlight the group you want to clone and either right-click and select Edit Group or
select Edit Group at the top right of the group member list panel.
2 Click the Clone Group link in the upper right corner of the Edit box. This creates a
group with “Copy_” prefix.
3 Change the Name and add a Description. The URI field specifies the hierarchical
location of the group. When adding a group, if you want the new group to be the child
of a different group, abandon this clone operation and clone an existing child of the
other group.
4 In the users box, Select Add to add users to this group. This is optional; you can add
users later. By default a clone contains the same users as the group you are cloning.
 Select a user in the available Users box use the right arrow key to move the user
to the Selected Users box. The users in the Selected Users box are members of
the group.

2 Administration
 To filter the list of available users, start typing in the data entry field above the
Available Users box. Click the X to the right of that field to clear it and restore
the list of available users.
 Use the double arrows ( and ) to send every user in the box to the other
box.
5 Click Save to save the group and return to the group page.
Click Cancel to clear any field changes you have made and restore them to the way
they were. Cancel does not cancel the operation.
To abandon a clone operation, click the Cancel button to reset all the fields, then click
anywhere in the tree view on the left to close the Clone panel.
Cloning does not include any sub-groups that the cloned group had. It includes all users
and other field values.
You cannot clone the three main groups at the top level.
Delete a User Group
To delete a group, right-click on the group and click Delete Group.
 You cannot delete the three main groups at the top level.
 You cannot delete a group of which you are a member, or any of its parent groups.
Delete a User from a Group
There are two ways to delete a user from a group:
 Edit the user:
a Select a user.
b Scroll to the Groups box, at the bottom, and click the trash can icon to the right
of the group from which you want to remove this user.
c Click Save to save the change.
 Edit the group:
a Right-click the group and select Edit Group.
b Scroll to the Users box and click the trash can icon to the right of the user you
want to remove from this group.
A user has to be a member of at least one group. If the trash-can icon is grayed out, add
the user to another group before deleting from this group.
Edit Advanced Permissions
For any user group, you can manage what objects and actions they can access, and who
can edit that group’s permissions. Right-click the group whose permissions you want to
change and select Edit Group.

2 Administration
Click Advanced Permissions at the top right of the Group Edit panel to specify access
permissions for this group. You can select the type of data for which you want to assign
permissions from the tabs at the top.
The permission tab descriptions are as follows:
 Resources: The list in the window shows each resource group to which this user
group has Read (R) and Write (W) permission.
 Operations: The list shows each group of operations that this user group can
perform.
 User Groups: The list shows each user group that has Read (R) and Write (W)
permission on this user group. That is, groups that can see or change this group.
 Events: The list shows event filters that control what events members of this user
group can see. You can create filters from the ArcSight Console. To add more event
filters:
 Sortable Field Set: The list shows the sets of sortable fields on which members of
this user group are allowed to sort when viewing channels.
To add another resource group to any of these tabs:
1 Select the resource category from the pull-down menu at the top of the Resources tab.
2 Click Add at the top of the tab.
3 Expand the resource group hierarchy to find the resource group to which you want to
grant access.

2 Administration
4 Check the box to the left of that group.
5 Click OK.
6 Click Save.
To remove a resource or user group, uncheck both the Read and Write boxes and click
Save.
To remove an operation group, event filter, or sortable field set, click the trash can icon to
the right of it and click Save.
Add or Edit a User
You create users within a user group below the All Users level. Use the following procedure
to create a new user.
1 In the hierarchy tree on the left, click on the group to which you want to add a user.
2 In the user window, click New User, at the top of the list.
To edit a user, click anywhere on the user’s row in the list.
The user details fields appear in the lower half of the list.
3 Optionally, fill in the Users Full Name.
4 Optionally, you can change the user’s Status from Login Enabled to Login Disabled.
5 Optionally supply an Email address of the proper form (n@n.n).
6 Create a User ID and Password. These two are the only fields that are required. For
information on password restrictions see the Administrator's Guide, chapter 2.
“Configuration,” “Managing Password Configuration,” “password Character Sets.”
7 By default the External User ID is the same as the User ID. An external user ID
might be relevant if you have user accounts from other applications. If you are using
PKCS#11 and CAC, change the external ID to match the CAC Common Name.
8 Optionally, expand the Extended User Attributes box and specify the users Alias,
Role (Title and Department), and Phone numbers.
9 Choose a user Type from the drop-down menu. The user types are:
 Normal User: Has full privileges to use the Management Console, the ArcSight
Console, and ArcSight Web client, and all tools.
 Management Tool: Has only the privileges needed to run certain management
tools used in conjunction with network management products. This user cannot
log in to any console. This type it is designed for use by software applications.
 Archive Utility: Has only the privileges needed to run the archive command.
(See “ArcSight Commands” in the Administrator’s Guide.) This command refers to
archives of resources, not events. Access to resources is controlled through ACLs.
This user type is for programs, not people and cannot log in to a console.
 Forwarding Connector: Has only the privileges needed by the Forwarding
Connector.
 Connector Installer: A user who can add SmartConnectors to the system.
 Web User: Has privileges to use the Management Console and ArcSight Web, but
not the ArcSight Console.
The user types confer access permissions that supercede access permissions granted
through group membership. For example, If you add a Web User to an Administrative
group, whose members can normally log in to the ArcSight Console, The Web User

2 Administration
cannot, because a Web User can only access the Management Console and ArcSight
Web.
10 Optionally, expand the Groups box and click Add to select other groups to which this
user should belong. Alternatively, you can edit a group and select users to be
members.
11 Click Save to save this user and return to the group page.
Click Cancel to clear any field changes you have made and restore them to the way
they were. Cancel does not cancel the operation.
To Edit a user, click on the user entry in the list. The Edit operations are the same as when
adding a new user.
To abandon an add or edit operation, click the Cancel button to reset all the fields, then
click anywhere in the tree view on the left to close the add/edit panel.
Delete a User
To delete a user:
1 Select the user group at the left in which the user appears, or All Users.
2 Select a user in the list on the right.
3 Click Delete User at the top.
Also see “Delete a User from a Group” on page 11.
Copy a User
To copy a user, select a user and click Copy User, at the top.
Use the copy function to create a new user. The login name is prefixed with “Copy_” but
the user name and all other attributes except the password are the same; you must reset
the password. Edit the attributes as specified in “Add or Edit a User” on page 13.
When you click Save, the system creates the new user.
This feature is useful for creating multiple users who have the same group memberships or
other similar attributes, without having to re-enter those attributes.
Search for a User
To search for users in the selected group by their user ID,
begin to type the user ID in the search field at the top left of
the user list. As you type, the user list is filtered to only show users whose User ID starts
with the characters you have typed so far.
Click the X button to the right of the field to clear the search field and restore the user list.

2 Administration
CORR Engine Management
The Correlation Optimized Retention and Retrieval Engine (CORR Engine) is a proprietary
data storage and retrieval framework that receives and processes events at high rates, and
performs high-speed searches.
To access the CORR Engine Management function from the Administration tab, click the
CORR-Engine Management bar in the accordion panel at the left.
Overview
CORR-Engine Management includes three pages:
 Event & Resource Storage — As events come in they are saved in Event Storage.
System resources are stored in System Storage. You can see a summary of storage
usage and set the retention period and notifications for usage thresholds.
 Archive Jobs — Provides a list of the daily events that are available for archiving or are
already archived. Each day’s events (archived or not) are listed on this page until the
age set by the retention period or the limit of available Event Storage space, whichever
comes first. After that, they are deleted. If you have archived them, copies are
retained and you can access them on the Archives page.
 Archives — Archives are daily events that you have saved, and which have been
removed from the Archive Jobs list for lack of Event Storage space or expiration of the
retention period. Archives are deactivated when they are moved to this list, which
means they cannot be used for any kind of analysis unless you activate them.
The following figure depicts the flow of daily event archives over time.

2 Administration
In the figure above, events come in to event storage, on the left at the top. They are kept
until the limits of the retention period or space and then deleted. As you archive daily
events, they are copied to the archive storage area, on the right. They remain listed in
Archive Jobs until their retention period expires and then they are deactivated and the
listing is moved to the Archives page.
All the daily events in event storage, plus any activated archives are available for
correlation analysis.
Storage allocations and where you can see them are shown in the following table:
For both Event Storage and System (Resource) Storage, if used space reaches the
configurable warning /error levels, and you have configured the Notification List, the
system issues an email warning that available space is getting low. For archives there is an
audit event when it is too full to archive another day’s events. Audit events are described in
the ArcSight Console User’s Guide, in the “Reference Guide” chapter, under “Audit Events.”
Event & Resource Storage
Select Event & Resource Storage in the accordion panel to see a summary of event and
system storage. The lower half of the page shows the configuration options for the
selected storage area.
Event Storage
Event Storage is for daily events that are younger than the retention period. When they
reach the retention period they are deleted, which means they are lost unless you have
copied them to an archive (see “Configure Automatic Archiving” on page 21). If Event
Storage Area Size Purpose
Event Storage 919 GB
(depends on
drive space)
Includes collected daily events that accumulate until
the end of each day’s retention period or until space
runs out. At either point the oldest day’s events are
deleted. You can see the total, used, and available
space by clicking on Event Storage on the Event &
Resource Storage page.
System Storage 200 GB Includes data objects and resources used by the
system. You can see the total space and percentage
used. By clicking on System Storage on the Event &
Resource Storage, you can see the threshold
notification settings in the lower half of the page.
Archives 200 GB Includes daily events that have been archived (copied)
from Event Storage. The space that remains available
can be seen at the top of both the Archive Jobs and
Archives pages. The archives are located in
/opt/arcsight/logger/data/archives.

2 Administration
Storage space runs out the oldest day’s events are deleted each day, even if they have yet
to reach retention age.
You can see the total, used, and available space by clicking on Event Storage on the
Event & Resource Storage page. To see a list of all the day’s events, see the Archive
Jobs page. The percentage box shows the used percentage of the total storage space
allocated to this storage area.
The colored circles to the right of the total size of event storage act as status lights: they
indicate whether the used storage is below the warning threshold (green), above the
warning threshold but below the error threshold (yellow), or above the error threshold
(red).
Click the Event Storage row in the Event & Resource Storage panel to see the
configuration panel below. It shows used and available storage space for this storage area
and the date range of included events.
 The event storage Retention Period is the number of days that your events are kept
in event storage. After that they are deleted. To save daily events, archive them.
 The usage Warning Threshold is the percentage of event storage area in use. When
used space rises above this percentage, it lights the yellow warning indicator and
sends a notification email. This percentage must be lower than the usage Error
Threshold.
 The usage Error Threshold is a higher percentage of used space. When usage rises
above this percentage, it lights the red error indicator and sends a notification email.
If the number or size of daily events is high or your retention period is sufficiently long,
you may run out of space in event storage before the oldest events reach the end of
the retention period. If that happens, the oldest events are deleted first.
If you change any configuration options, click Save at the bottom to save them.
The time stamp on events is based on the time that the event was received
by ESM, in ESM‘s time zone.

2 Administration
System Storage
System storage is for data such as system resources. The amount of storage available is
shown on the Event and Resource Storage page.
The percentage box shows the used percentage of storage allocated to this storage area.
The colored circles to the right of the total size of system storage indicate whether the used
storage is below the warning threshold (green), above the warning threshold but below the
error threshold (yellow), or above the error threshold (red).
Click the System Storage row to see the configuration panel below There is no retention
period; this data is always retained.
 The usage Warning Threshold is the percentage of system storage area in use.
When used space rises above this percentage, it lights the yellow warning indicator
and sends a notification email. This percentage setting must be lower than the usage
Error Threshold.
 The usage Error Threshold is a higher percentage of used space. When usage rises
above this percentage, it lights the red error indicator and sends a notification email.
If you change any configuration options, click Save at the bottom to save them.
Notification List
Use the Notification List button at the top right of the Event & Resource Storage
page to add, edit, or remove email addresses of users to notify when any of the data
storage thresholds are crossed and when any archive processing operation fails.
For event and system storage, you can separately configure the threshold for warning and
error notifications in terms of percentage of used space.
The notification list applies to the Archives area, too. The Archives have a fixed warning
threshold that triggers notification when ESM attempts to add an archive for which there is
insufficient storage space.
Archive Jobs
An archive is a copy of a day’s events. Archiving daily events is optional. You may allow
them to be deleted at the end of the retention period or when Event Storage runs out of

2 Administration
space. Alternatively, you can archive daily events manually or you can Configure Automatic
Archiving.
Filtering the List
You can select a status and the number of days of archives to display in the status and time
range fields at the top of the list.
What are Archive Jobs?
The Archive Jobs page shows each day’s events as an archive job. That is, they are
available to be archived, in the process of being archived, or already archived. Click on any
day’s events to see relevant details and available actions.
 Archive Jobs shows all the daily events that reside in event storage. Events that are
copied to the archive storage space have the status Archived.
 Archive Jobs shows events that are not archived as Pending, Not Archived, or In
Progress. Daily events that are Pending or Not Archived take up space in event
storage, but not in the archive storage area.
Date is the day during which the events arrived.
Job Time is the time when this day’s events most recent activity started. If the status is
Pending, the Job Time is when the collection process started at the beginning of the day.
For Archived events, it is when the archiving process began.
How this List Works
Events are deleted from event storage and removed from the Archive Jobs list when they
reach the age set as the retention period or event storage runs out of disk space,
whichever comes first. If a day’s events have been archived when this deletion occurs, the
archive listing is moved to the Archives page.
The Available Disk Space shown at the top of the page only reflects space for jobs whose
status is Archived. Days’ events with other statuses are in Event Storage. When archive
space reaches 85 percent full, there is a warning notification, and when it reaches 95
percent full, there is an error notification. When archive storage space is too full to allow
addition of another day’s events, three things happen:
 An audit event occurs that there is no longer enough space to save another archive.
 Automatic, scheduled archiving stops.
 You are unable to manually archive any jobs.

2 Administration
Statuses and Actions
When you click on an Archive Job, a small box appears showing status details:
The event count and disk space show zero for daily events that are Pending or Not
Archived because they are not in Archive storage until they are archived.
The following table describes archive-job statuses and available actions:
Actions are available at the top of the list, when you right-click on a day’s events, and in a
pop-up that appears when you select a day’s events.
Status Description
Available
Actions
Archived This day’s events have been copied to the archive
area as a directory (a folder). As long as the day’s
events from which it was copied remain in event
storage, this archive is available for analysis.
There are about 193 GB of storage set aside for
archives.
None
Not Archived This day’s events have either had an archiving
problem, or you cancelled the archiving operation,
or you have turned off scheduled archiving. Events
that are Not Archived are deleted when they reach
the retention period age, so make sure to archive
any days’ events that you want to keep.
If you click Archive > Archive Now, the status
changes to In progress.
If you click Archive > Archive at next
scheduled time, the status changes to Pending.
Archive:
• Archive now
• Archive at
next
scheduled
time
Pending This day’s events have not reached the specified
time when they are to be archived. This includes
today’s events, which are still being collected.
Cancel Operation is available if scheduled
archiving is enabled. Cancelling means that
collection continues and when it is done at
midnight the status changes to Not Archived.
If scheduled archiving is not enabled, no action is
available.
Cancel Operation
In Progress This day’s events are in the process of being
archived, which means being copied to archive
storage.
If you click Cancel Operation, the status changes
to Not Archived.
Cancel Operation
Pending
Archived

2 Administration
Configure Automatic Archiving
Click Configure at the right, above the archive list to control archiving.
If you do not turn archiving on, events are deleted when they reach the retention period
specified for the “Event Storage” on page 16, or when you run out of event storage space,
whichever comes first.
When the disk space for archives is full, archiving stops. Events that the system deletes
from event storage are lost. If you need to save older events, consider these three tasks:
 Turn archiving on so that daily events are copied to an archive file you can back up.
 Regularly back up the Archives Stored at folder to another storage device.
 Delete older, deactivated archives as they are backed up, so that the archive area does
not fill up.
Parameter Description
Turn Archiving On Select this to enable the copying of each day’s events to an
archive at the specified daily archive time the day following
the day the events are received.
Archive Daily at Select an archive time. Every day at this time the events
collected yesterday are copied to an archive.
Archives Stored at This is the path to the folder where archives are stored.
The CORR Engine provides 200 GB of space for archives in
/opt/arcsight/logger/data/archives.

2 Administration
Archives
When events that have been archived are removed from event storage (by retention period
or lack of disk space), they are removed from the Archive Jobs list and moved to the
Archives list.
Filtering the List
To filter which archives appear on the list, select a status and the number of days of
archives to display in the status and time range fields at the top of the list.
What are Archives?
Archives are files that contain a copy of one day’s events. As ESM creates an archive copy,
it places it in Archive Storage, which is separate from Event Storage. The archives are
located in /opt/arcsight/logger/data/archives. The term “Archives” includes
some archives that are listed on the Archive Jobs list because they have not yet reached
the retention limit age. However, this list only includes the archives that are older than the
retention period. There is no copy in Event Storage.
How this List Works
Daily event archives appear on this list at the end of the last day of their retention period.
Their status is Deactivated. You can activate an archive for analysis, if necessary.
Keep in mind that daily events whose status is Not Archived are deleted when their
retention period expires and there is no copy. Be sure to archive any events you need to
keep beyond the retention period. Archives remain on this list until you delete them.
Archive Storage Space
When archive storage space is too full to allow addition of another day’s events, three
things happen:
 An email to the notification list warns that there is no longer enough archive space.
 Automatic, scheduled archiving stops.
 You are unable to manually archive any jobs.
Since archives are file folders for each day (yyyymmdd) that you can manage using
ordinary file operations, you can keep space available by deleting older archives. Make sure
they are deactivated, first. You may want to make a copy elsewhere (or redundant copies)
before deleting them.
Deleting an archive folder does not remove it from the list, but if you try to activate a
deleted archive, you get an error message. Copy the folder back and try again.

2 Administration
Moving Event Archives to a New System
Since daily archives are ordinary file folders, use basic operating system file commands to
populate the /opt/arcsight/logger/data/archives folder with all the archives you
are likely to ever want to activate. You can copy from the /archives folder on the old
system and also copy in files you may have backed up elsewhere and deleted from
/archives.
Run the restorearchives command to build the new archives list on the new machine.
After that, you free up archive storage by moving any archives you do not need at the
moment to an external storage device.
For information on the restorearchives command, see the “Administrative
Commands” chapter in the Administrator’s Guide.
Statuses and Actions
When you click on an Archive, a small box appears showing status
details. These include the date, event count and the disk space used in
Archive Storage.
The archive statuses are described as follows:
Actions are available at the top of the list, when you right-click on a day’s events, and in a
pop-up that appears when you select a day’s events.
Click an archive to see the following:
 The date of the events collected in this archive
 When the archive was last activated or deactivated
 Event count
 Disk space
 A button to activate or deactivate it
The Configure link at the top right is the same as the one on the Archive Jobs page; use
it to Configure Automatic Archiving.
Registered Connectors
Registered Connectors enables you to see a list of connectors on the left with their
status. By default it shows a summary chart of how many connectors are up and down.
Refresh the Connector Display
Use the Auto-Refresh button in the upper right corner of the page to set how often you
want ESM to refresh the Connector Status page. You can also refresh now. The Connector
Status Description
Available
Actions
Activated This archive is available for analysis, as are any
other events listed in the Archives Jobs list.
Deactivate
Activating This archive was deactivated, but is now in the
process of being activated.
Cancel Operation
Deactivated These events are not available for analysis. They
are preserved until you delete them.
Activate

2 Administration
status page shows how many connectors are up or down. For information about each
connector, click on it in the tree at the left and look at the Connector Editor.
For more information on connectors, refer to the documentation for the individual
connector.
Connector Editor
Click a connector to see the connector editor. You can use the editor to view connector
details, some of which you can change. You can also send connector commands.
The connector editor shows connector details described in the following table. If you
change any values you can Save or Cancel your changes using the buttons at the bottom.
Field Description
Connector
Name The name of this connector is automatically populated with the
name assigned during connector Installation.
Status Possible statuses are Down, Running, Stopped, and Unknown.
Connector Location The location of this connector in the connector tree in the left
panel.
Device Location Specify where the connected device is located.
Version The software version of the connector.
Comment Enter any text as required.
Model Import User Select a user from the pull-down menu.
Common (Fields common to all resources)
Resource ID The ID code for this connector resource.
Alias Enter an optional alternate identification string used for
referencing resources within ESM. If given, this alias appears in
place of the resource's name everywhere it may be seen.
Description Enter a text description of the configuration or other related
information.
External ID Enter an identification string suitable for, and which can be
referenced by, systems outside ESM. Common applications of
External IDs include appropriate naming for Case and Asset
resources that are tracked in common with defect reporting or
vulnerability-management systems. If your system interfaces
with a third-party incident tracking system, such as Remedy,
enter an ID that corresponds to that system.
Version ID You can enter a unique version ID for resources.For example, it
is useful when exporting or importing a package, if you don’t
want a newer resource to be overridden by a older version.
Deprecated Check this box if you want to flag this connector resource as
obsolete.
Create/Update Information
Created By The user who created this connector (logged-in user during
connector installation).

2 Administration
Connector Commands
For some connectors you can issue basic event-flow-control commands, get their
operational status, or issue control commands to network devices through the connector.
Click the Send Commands button at
the bottom of the connector Editor to
select commands to send. The button is
grayed out if sending commands is not
allowed or if the connector is down.
Commands available on this menu vary
depending on which connector you are
using.
The standard commands are described below.
Created on The date and time of connector installation.
Last Updated by The user who last updated this connector.
Last Updated on The date and time this connector was last updated.
Modification Count The number of times this connector has been changed since it
was created or installed.
Command Description
Status Category
Get Status Provides a full report on the selected connector's current
operational state.
Get Device Status Provides the status of the device that reports to the
connector. (Currently only available for the CiscoIDS/IPS
SmartConnector.)
Agent Process Category
Restart Restarts a running connector.
Caution: Once a connector is terminated, connector
commands cannot access it. Therefore, a "restart" works
only on a connector that is currently running. Sending a
restart command to a running connector terminates and
restarts the connector.
Terminate Shuts down the connector and all processes the
SmartConnector started.
Caution: Once a connector is terminated, connector
commands (including connector Process > Restart)
cannot access it. The connector must be restarted
manually from the machine on which it is installed.
Event Flow Category
Pause Stops the connector from sending events to the ArcSight
Manager.
Note: Events received from the target device are saved in
the connector cache (even though the connector is in the
Pause state).
Field Description

2 Administration
Stop Stops the connector from sending events to the Manager.
Caution: A Stop command causes the connector to drop
all events, including events stored in the connector cache.
Start Prompts the connector (previously in Stop or Pause
state) to start sending events to the Manager.
Network Category
Flush Name Resolver
Cache
Clears cache for Network name resolver.
Upgrade Category
Upgrade Launches a Command Parameters dialog for remote
upgrade to newer versions of connectors for managed
assets.
Provide the version number of the connector to which you
want to upgrade and a wait time to verify that the
upgrade completed successfully. (If the upgrade is not
successful, the system performs an automatic rollback to
the previous version of the connector.)
Click OK to start the upgrade.
See the “Managing SmartConnectors” chapter of the
ArcSight Console User’s Guide for prerequisites for the
upgrade process and detailed information on how to
upgrade connectors.
Rollback Upgrade Launches a Command Parameters dialog for remote
rollback of connector version to a specified previous
version. See the “Managing SmartConnectors” chapter of
the ArcSight Console User’s Guide for complete
information.
Adjust Category
Rename Mismatched
Override Files
Enables you to remotely rename an connector parser
override file whose version stamp no longer matches the
parser that it was intended to override. Renaming it
appends “.1” (or 2, or 3, if earlier numbers are in use),
which stops the file from being used.
The first parameter is a regular expression you can
specify to match specific override files (or blank, the
default, for all). The second parameter is a boolean where
true, the default, means restart the connecter if any files
are renamed.
Tech Support commands are provided for use primarily by Customer Support.
Brief descriptions of these Tech Support commands are provided for
informational purposes, but these commands are not intended for use by
customers except as instructed by support.
Command Description
Tech Support Category
Command Description

2 Administration
Get Support Info Gets logs and other feedback on connectors.
Get ‘agent.properties’ Shows the list of properties for the selected connector.
Get Upgrade Logs Get upgrade logs on connectors.
Get ‘agent.wrapper.conf’ Shows the wrapper configuration for the selected
connector.
Get Configuration XML File Shows the XML configuration file for the selected
connector.
Get Thread Dump Gets one thread dump for the selected connector.
Get Two Thread Dumps... Gets two thread dumps for the selected connector
spaced by the time interval specified. By comparing both
thread dumps, Customer Support can troubleshoot
connectors with threads that are hanging for unknown
reasons.
Get Heap Dump This generates a heap dump, if possible, which in some
situations can be useful to ArcSight to analyze problems.
The destination ID is used as part of the file name, the
file is placed in the same directory as the connector's
logs, and normally only 10 such files are kept.
Get last N lines of
'agent.log'...
Shows an excerpt from the connector log file based on
the number of lines you specify. The default is 500 lines.
Get System Properties Shows system properties for the selected connector,
including details on variables such as Java runtime
name, Java virtual machine (VM) version, operating
system name, paths for various Java components, paths
for ArcSight Home, user directories, user home, and so
forth.
Enable Event Flow
Tracing...
Allows you to specify a component and fields to log for
initiating an event flow trace. The component should be
chosen from the components listed in the Get Status
results.
Disable Event Flow
Tracing...
Disables event flow tracing on the selected component.
Get Event Flow Tracing
Log
When tracing is enabled on the selected connector, the
connector logs data about events it receives.
DNS Test This command takes one parameter, which is either a
host name to resolve or an IP address to reverse
resolve. This is useful to see what results would
normally be expected for the name resolver component
of the connector, since it uses the same mechanism to
do the lookup as the name resolver uses.
Enable Map File Logging Directs the AgentNATProcessor component, which
processes map files for each event, to log what it is
doing for each event. By default the last 100 events are
logged.
Disable Map File Logging Directs the AgentNATProcessor to stop logging.
Get Collected Map File
Logging
Gets the collected log messages for the most recent
events (100, by default), which may help debug
problems with why a map file is not operating as
expected.
Command Description

2 Administration
The following commands provide access to connector component mapping and event
categorization for advanced users.
Command Description
Mapping Category
Get Additional Data
Names
Returns a list of data names seen for each device
vendor/product combination since the connector started.
For example:
Additional Data Names Seen:
Generic (no vendor/product):
test1 [3 times]
test11
test13 [2 times]
Vendor/product [vend/prod]:
test1
test10 [6 times]
By default, the command limits the list to show only the
most recent 100 device vendor/product combinations and
the most recent 100 names for each.
Tip: You can change this limit by editing the connector
property
agent.additionaldata.mapper.track.max.names in
the file
$ARCSIGHT_HOME/ArcSightSmartAgents/current/user/
agent/agent.properties on the machine where the
connector is installed. However, in most cases we
recommend keeping the defaults. If you do change a
property setting such as this, restart the connector.
If a data name is not a string, its data type is displayed in
the list. If the connector saw an additional data name
more than once, the command output indicates the
number of times the name was seen.
Map Additional Data
Name...
Brings up a dialog where you can map an additional data
name for the selected connector.
For a generic mapping, you can leave the Device vendor
and Device product fields blank. For a specific mapping,
fill in these fields with the appropriate vendor and product
names.
Typically, the Additional data name is one of the names
shown in the Get Additional Data Names output (but can
be another name not on that list).
The ArcSight field must be a valid ArcSight event field.
Click OK to create the mapping.
Here is an example of the command output for a
successful generic mapping:
Successfully mapped additional data name
[test11] to event field [message] for
vendor/product []
A successful device vendor/product-specific mapping
returns output similar to this:
Successfully mapped additional data name
[test10] to event field [message] for
vendor/product [vend/prod]

2 Administration
If the additional data name has not been seen, the name
is still mapped, but with a warning like this:
Successfully mapped additional data name [foo] to
event field [deviceCustomString1] for
vendor/product [vend/prod] (note that additional
data name [foo] has not been seen for
vendor/product [vend/prod])
If the ArcSight field is not valid, the error returned is
similar to this:
Failed to map additional data name [bar] to event
field [messages] for vendor/product [vend/prod]
(event field [messages] is unknown)
Unmap Additional Data
Name...
Brings up a dialog where you can unmap an additional
data name for the selected connector.
To remove a generic mapping, you can leave the Device
vendor and Device product fields blank. To remove a
specific mapping, fill in these fields with the appropriate
vendor and product names. The additional data name
should be one that was previously mapped for the
specified device vendor and product combination.
Click OK to unmap the data name.
Here is an example of the command output for a
successful generic unmapping:
Successfully unmapped additional data name
[test11] for vendor/product []
A successful device vendor/product-specific unmapping
returns output similar to this:
Successfully unmapped additional data name [foo]
for vendor/product [vend/prod]
If the specified additional data name was not previously
mapped, the output looks like this:
Failed to unmap additional data name [foo] for
vendor/product [vend/prod] (not previously
mapped)
Notes:
• One additional data name can be mapped to more
than one ArcSight field for the same device
vendor/product combination, and in this case
unmapping it unmaps it from all ArcSight fields for
that device vendor/product. This is an unlikely
scenario, however.
• The converse case, where multiple additional data
names are mapped to the same ArcSight field for the
same device vendor/product combination, results in
the last mapping taking precedence over any previous
mappings to that ArcSight field for that device
vendor/product. No warning is generated in this case.
Command Description

2 Administration
When results are to be returned, the command dialog expands to show progress, and then
the results.
Categorizer/mapper Category
Reload custom
categorizations
There are several ways to set event category information
for events. The least common of these is to store custom
categorization files (organized by vendor and product) on
the connector machine in the
user/agent/aup/acp/categorizer/current directory
(or the user/agent/acp/categorizer/current
directory).
If such categorization files exist and have been changed,
this command reloads them without restarting the
connector.
Reload custom map files Rescans and reloads map files in user/agent/map
directory on the machine where the connector is
installed.
The map files are named in the form map.n.properties,
where n is a number starting with 0. Use this command to
immediately apply the latest changes. Not all connector
setups include custom map files.
Caution: Map files are created on some connector
machines to fulfill specific needs. If you are not familiar
with the categorizer/mapping setup of an environment,
we recommend that you do not use Reload commands.
Reload external map files Re-scans and reloads external map files in the
user/agent/extmap directory on the machine where the
connector is installed.
The map files are named in the form
extmap.n.properties, where n is a number starting with
0. Use this command to immediately apply the latest
changes. Not all connector setups include custom
external map files.
Caution: External map files are created on some
connector machines to fulfill specific needs. If you are not
familiar with them, we recommend that you do not use
Reload commands.
Command Description

2 Administration
Configuration Management
Configuration Management enables you to:
 View license information
 Set manager heap size
 Enable notifications and set your mail server
 Change the Manager authentication method and settings.
License Information
Your current license information appears in the upper part of the page.
To install a new license:
1 In the License File field specify or browse to the lic or zip file containing the
license you want to upload.
2 Click Upload to upload a new license.
3 After uploading, the Management Console asks you if you want to Restart, which
restarts certain ArcSight server processes.
You can choose to restart later. If so, when you are ready, select Server
Management in the accordion panel under Configuration Management, and click
Restart, at the bottom. You will have to log in again.
Server Management
Manager Heap Size
In the Manager Heap Size field, select one of the possible heap sizes from the pull-down
list.
The Manager heap is a special area of memory, although the Manager uses some
additional system memory as well. The recommended heap size for production
deployments is at least 8 GB. Smaller amounts affect performance. It is important that the
amount of physical memory available on the system be significantly larger than the amount
of heap allocated for the Manager, so that there is additional space available for the
operating system and for cache use.
After changing the heap, the Management Console asks you if you want to Restart, which
restarts certain ArcSight server processes.
You can choose to restart later. If so, when you are ready, select Server Management in
the left panel and click Restart, at the bottom. You will have to log in again.
Enable Notifications
Set up notification and specify notification recipients to receive system warnings. The
importance of this step is sometimes overlooked, leading to preventable system failures.

2 Administration
The following table describes parameters you can enter to set up mail server notification.
Choose whether your Preferred Mail Server is Internal or External. The internal mail
server is built in.
External Mail Server Information
If your preferred mail server is external, you must supply this information.
Enter the name of your Outgoing Mail Server.
If you check Use Internal Server as a Backup, it uses the mail server that is built in, if
the external mail server is not available.
Enable Acknowledgements
Enabling acknowledgements mean that notification recipients can reply to the email, and
the reply (an acknowledgement) goes to an email account that the Manager can access.
If you check Enable Acknowledgements, fill out the following parameter fields:
Acknowledgements work in conjunction with acknowledgement settings set in the ArcSight
Console for wait-time settings and escalation. Depending on the severity of the notification,
if the Manager does not receive acknowledgement within the configured wait time, the
notification is escalated. That is, a notification is sent to someone else. Refer to “Changing
Notification and Acknowledgement Settings” in the “Managing Users and Permissions”
chapter of the ArcSight Console User’s Guide.
From Address The e-mail address from where notification messages
originate and are sent, appears in the From field of
notification messages
Error Notification
Recipients
A comma-delimited list of e-mail addresses to notify of
Manager errors and storage warnings.
Preferred Mail Server Select whether the mail server is internal or external.
Using the internal SMTP server requires DNS to be set up
correctly on the ArcSight Manager System. Using an
external SMTP server requires that the ArcSight Manager
system be able to connect to the host via port 25.
Incoming Mail Server The server host name that the Manager uses to receive
notification confirmations.
Mail Protocol Either the Internet Message Access Protocol (IMAP) or Post
Office Protocol V3 (POP3), which is used by the Manager to
communicate with the Incoming Mail Server.
Account The user name that the Manager uses to login to the
Incoming Mail Server.
Password The password that the Manager uses to login to the
Incoming Mail Server.

2 Administration
Restart
When you make changes that require a restart, a dialog appears that enables you restart
immediately. If you choose to wait, you can restart later. Restart does not reboot the
computer, it restarts selected ArcSight server processes.
Click Restart at the bottom of the Server Management panel if you have made changes
that require a system restart.
When you click Restart, it asks if you are sure you wish to restart. If you click Yes, It
issues the restart command and your session loses its connection to the Manager. You can
reconnect and log in again after the restart has completed.
Authentication Configuration
In the Authentication Method field select the desired authentication method.
The authentication options enable you to select the type of authentication to use when
logging into the Manager.
By default, the system uses its own, built-in authentication, but you can specify third party,
external authentication mechanisms, such as RADIUS Authentication, Microsoft Active
Directory, LDAP, or a custom JAAS plug-in configuration.
How external authentication works
The Manager uses the external authentication mechanism for authentication only, and not
for authorization or access control. That is, the external authenticator only validates the
information that users enter when they connect to the Manager by doing these checks:
 The password entered for a user name is valid.
 If groups are applicable to the mechanism in use, the user name is present in the
groups that are allowed to access ArcSight Manager.
Users who pass these checks are authenticated.
Once you select an external authentication mechanism, all user accounts, including the
admin account, are authenticated through it.
Guidelines for setting up external authentication
Follow these guidelines when setting up an external authentication mechanism:
 Users connecting to the Manager must exist on the Manager.
 User accounts, including admin, must map to accounts on the external authenticator.
If the accounts do not map literally, you must configure internal to external ID
mappings in the Manager.
• In order to use PKCS#11 authentication, you must select one of the SSL
based authentication methods.
• If you plan to use PKCS #11 token with ArcSight Web, make sure to select
Password Based or SSL Client Based Authentication.
• PKCS#11 authentication is not supported with Radius, LDAP and Active
Directory authentication methods.
See the appendix “Using the PKCS#11 Token‚” in the ESM Installation and
Configuration Guide, for details on using a PKCS #11 token such as the
Common Access Card (CAC).

2 Administration
 Users do not need to be configured in groups on the Manager even if they are
configured in groups on the external authenticator.
 If user groups are configured on the Manager, they do not need to map to the group
structure configured on the external authenticator.
 Information entered to set up external authentication is not case sensitive.
 To restrict information users can access, set up Access Control Lists (ACLs) on the
Manager.
Password Based Authentication
Password-based authentication requires users to enter their User ID and Password when
logging in. You can select the built-in authentication or external authentication.
Built-In Authentication
This is the default authentication when you do not specify a third party external
authentication method.
If you selected this option, you are done.
Setting up RADIUS Authentication
To configure ArcSight Manager for RADIUS Authentication, choose RADIUS
Authentication and supply the following parameter values:
If you configure the Manager using Password Based and SSL Client Based
Authentication or SSL Client Only Authentication, be aware that ArcSight
Web does not support these modes. So:
• If you plan to use ArcSight Web, you will need to configure your Manager to
use Password Based Authentication or Password Based or SSL
Client Based Authentication as your authentication method.
• If you plan to use PKCS#11 authentication with ArcSight Web, be sure to
select Password Based or SSL Client Based Authentication only.
Authentication Protocol Which authentication protocol is configured on your
RADIUS server: PAP, CHAP, MSCHAP, or MSCHAP2.
RADIUS Server Host Host name of the RADIUS server.
To specify multiple RADIUS servers for failover, enter
comma-separated names of those servers in this field.
For example, server1, server2, server3. If server1 is
unavailable, server2 is contacted, and if server2 is also
unavailable, server3 is contacted.
RADIUS Server Type Type of RADIUS server:
• RSA Authentication Manager
• Generic RADIUS Server
• Safeword PremierAccess
RADIUS Server Port Specify the port on which the RADIUS server is running.
The default is 1812.
RADIUS Shared Secret Specify the RADIUS shared secret string used to verify the
authenticity and integrity of the messages exchanged
between the Manager and the RADIUS server.

2 Administration
Setting up Active Directory User Authentication
To authenticate users using a Microsoft Active Directory authentication server, choose
Microsoft Active Directory. Communication with the Active Directory server uses LDAP
and optionally SSL.
The next panel prompts you for this information.
Specify any user who exists in AD to test the server connection.
Specify the user name used to log in to the Manager and the External ID name to which it
is mapped on the AD server.
Configuring AD SSL
If you are using SSL between the Manager and your authentication server, you must ensure
that the server’s certificate is trusted in the Manager’s trust store
<ARCSIGHT_HOME>/jre/lib/security/cacerts, whether the authentication server
is using self-signed or CA certificates. For CA certificates, if the Certificate Authority (CA)
that signed your server’s certificate is already listed in cacerts, you do not need to do
anything. Otherwise, obtain a root certificate from the CA and import it in your Manager’s
cacerts using the keytoolgui utility. For more information on importing certificates, see
Understanding SSL Authentication in the Administrator’s Guide.
Active Directory Server Host name of the Active Directory Server.
Enable SSL Whether the Active Directory Server is using SSL. The
default is True (SSL enabled on the AD server).
No further SSL configuration is required for the AD
server.
Whether you selected SSL earlier for communications
with the Console is irrelevant. Certificate type is set on
the AD server side, not the manager.
Active Directory Port Specify the port to use for the Active Directory Server.
If the AD server is using SSL (Enable SSL=true), use
port 636. If SSL is not enabled on the AD server, use
port 389.
Search Base Search base of the Active Directory domain; for
example, DC=company, DC=com.
User DN Distinguished Name (DN) of an existing, valid user with
read access to the Active Directory. For example,
CN=John Doe, CN=Users, DC=company, DC=com.
The CN of the user is the "Full Name," not the user
name.
Password Domain password of the user specified earlier.
Allowed User Groups Comma-separated list of Active Directory group
names. Only users belonging to the groups listed here
will be allowed to log in.
You can enter group names with spaces.

2 Administration
Setting up LDAP Authentication
The ArcSight Manager binds with an LDAP server using a simple bind. To authenticate
users using an LDAP authentication server, choose Simple LDAP Bind and click Next.
The next panel prompts you for this information.
Specify any user who exists in LDAP to test the server connection.
Enter a valid Distinguished Name (DN) of a user (and that user’s password) that exists on
the LDAP server; for example, CN=John Doe, OU= Engineering, O=YourCompany. This
information is used to establish a connection to the LDAP server to test the validity of the
information you entered in the previous panel.
Specify the user name used to log in to the Manager and the External ID name to which it
is mapped on the LDAP server.
Configuring LDAP SSL
If you are using SSL between the Manager and your authentication server, you must ensure
that the server’s certificate is trusted in the Manager’s trust store
<ARCSIGHT_HOME>/jre/lib/security/cacerts, whether the authentication server
is using self-signed or CA certificates. For CA certificates, if the Certificate Authority (CA)
that signed your server’s certificate is already listed in cacerts, you do not need to do
anything. Otherwise, obtain a root certificate from the CA and import it in your Manager’s
cacerts using the keytoolgui utility. For more information on importing certificates, see
Understanding SSL Authentication in the Administrator’s Guide.
Using a Custom Authentication Scheme
From the Manager Setup Wizard, you can choose the Custom JAAS Plug-in
Configuration option if you want to use an authentication scheme that you have built.
(Custom Authentication is not supported from the ArcSight Management Console.) You
must specify the authentication configuration in a jaas.config file stored in the ArcSight
Manager config directory.
LDAP Server Host Specify the host name of the LDAP Server.
Enable SSL Whether the LDAP Server is using SSL. The default is True (SSL
enabled on the LDAP server).
No further SSL configuration is required for the LDAP server.
Whether you selected SSL earlier for communications with the
Console is irrelevant. Certificate type is set on the LDAP server
side, not the manager.
LDAP Server Port Specify the port to use for the LDAP Server. If the LDAP server is
using SSL (Enable SSL=true), use port 636. If SSL is not enabled
on the LDAP server, use port 389.
LDAP groups are not supported. Therefore, you cannot allow or restrict
logging into the Manager based on LDAP groups.
If you configure your Manager to use LDAP authentication, ensure that you
create users on the Manager with their Distinguished Name (DN) information
in the external ID field. For example, CN=John Doe, OU= Engineering,
O=YourCompany.

2 Administration
Password Based and SSL Client Based Authentication
Your authentication will be based both upon the username and password combination as
well as the authentication of the client certificate by the Manager.
Password Based or SSL Client Based Authentication
You can either use the username/password combination or the authentication of the client
certificate by the Manager (for example PKCS#11 token) to login if you select this option.
SSL Client Only Authentication
You will have to manually set up the authentication of the client certificate by the Manager.
See the Administrator’s Guide for details on how to do this.
You can either use a PKCS#11 Token or a client keystore to authenticate.
Using PKCS#11 provider as your SSL Client Based authentication method
within this option is not currently supported.

2 Administration

Chapter 3
Management Console Dashboards
Dashboards are a graphical display of data gathered from one or more Data Monitors or
query viewers. Dashboards can display data in a number of graphical formats, including pie
charts, bar charts, line charts, and tables, and you can rearrange the dashboard elements
in the window and save the arrangement. The dashboards that appear in the Management
Console are those that exist in the ArcSight Console, where dashboards can be created and
customized.
For information on creating and managing dashboards and Data Monitors see chapter 7,
“Monitoring Events,” in the ArcSight Console User’s Guide.
For information on query viewers, see chapter 13, “Query Viewers,” in the ArcSight Console
User’s Guide.
Dashboard Overview
Dashboards in the Management Console appear as layouts of dashboard data using a
browser-based runtime environment. You can see all the dashboards that appear in the
ArcSight Console and you can rearrange the layouts and save them.
For details about supported browsers and operating systems and the configurations
required to display features in a browser, see “Web Browsers,” in the “Reference Guide”
chapter of the ArcSight Console User’s Guide.
Dashboards in the Management Console can display data monitors and query viewers as a
table or different types of charts. In this chapter, each of these tables or charts for a data
monitor or a query viewer is called a dashboard element.
Dashboards support drilldowns to other dashboards. Configure drilldowns using the
ArcSight Console.
“Dashboard Overview” on page 39
“Viewing Dashboards” on page 40
“Edit Menu” on page 40
“View Menu” on page 41
“Tools Menu” on page 41
“Reload Button” on page 42
“Save Button” on page 42
“Dashboard Element Right-Click Options” on page 42

3 Management Console Dashboards
Viewing Dashboards
Click the Dashboard icon on the home page ( ), or the Dashboard tab at the top, if you
are not on the Home page, to view the Dashboard module.
You can select dashboards from the Dashboard Navigator on the left, which shows an
expandable, hierarchical view of all available dashboards.
A dashboard can show data monitors and query viewers. In general, these are called
dashboard elements. The screen image above shows six dashboard elements.
Edit Menu
You can edit dashboards using the options available from the Edit menu on the Dashboard
tab.
Arrange
Select Arrange from the Edit menu to rearrange the dashboard elements.
You can customize the dashboard layout by moving (dragging) and
resizing dashboard elements. You can resize a dashboard element by
clicking and dragging a corner or side.
Use the Save button to save your changes.
When you are done, select Done Arranging from the top menu bar.
Auto Arrange
Select Auto Arrange from the Edit menu to automatically align and space all
the dashboard elements and arrange them alphabetically (left-to-right and
top-to-bottom) in equally-sized tiles.

You can also invoke Auto Arrange by right-clicking on any dashboard element and selecting
Auto Arrange.
Background Options
The following options on the Edit menu enable you to
make changes to the current dashboard background.
 Upload New Background Image enables you to
browse to the location of a any JPG, GIF, PNG, or
BMP file and select it as a background image. It also
copies the file into the users folder. The background
image cannot be seen behind tables unless you
select Transparent table, under Choose Colors, in
the next section.
 Choose an Existing Background Image allows you to select any JPG, GIF, PNG, or
BMP file that is already in the system. For example, images in the user’s folder. Click in
the data entry field to see the ArcSight Resources folders
The background image scales to fill the available space in the dashboard panel. That
means the image may appear stretched horizontally or vertically if the aspect ration of
the dashboard is not the same as the image. Change the size of the window until the
image looks correct, then save the dashboard.
 Choose a Background Color provides a selection of colors from which to choose.
 Clear Background removes any images and restores the background color to white.
View Menu
The View menu in the dashboard button bar enables you
to select which of the dashboard elements for this
dashboard that you want to view or hide. These dashboard
elements were defined when the dashboard was created in
the ArcSight Console.
Unchecking a dashboard element does not delete it; it
removes it from the current view; it is only hidden. you can
check the box again later to include it once again in the
view.
Tools Menu
The tools menu enables you to set some dashboard preferences.
Select Tools > Preferences to enable animation for charts, turn on
automatic refresh, and set the refresh interval.

Animation
Select View > Preferences to enable and disable
animation. When animation is on, every time the
dashboard refreshes, pie and bar charts appear to quickly
grow from zero to the current values.
Refresh
Select View > Preferences to enable refresh and set
the refresh interval.
Use the Apply button to save your changes.
The dashboard refresh rate is how often the dashboard reloads the underlying resources.
Resources may have their own rate at which they refresh their data cache, but the
Management Console does not trigger each resource to refresh itself, it just reloads the
dashboard resources, picking up the resources’ current data caches. If a resource has not
refreshed its data when the dashboard asks for more, the dashboard gets the same data it
got for the last refresh.
Reload Button
The Reload button on the top menu bar reloads the last saved version of this
dashboard.
Save Button
The Save button in the top menu bar is enabled when you change the
dashboard, including simply resizing the window. For example, when you first
open a dashboard, if the window size is different than it was when it was last
saved, the Save button is enabled.
You can also save the dashboard by right-clicking on any dashboard element and selecting
Save.
Dashboard Element Right-Click Options
These are menu options that are available when you right-click on an individual dashboard
element.
Auto Arrange
Right-click on any dashboard element and select Auto Arrange to
automatically align and space all the dashboard elements and arrange them
alphabetically (left-to-right and top-to-bottom) in equally-sized tiles.
You can also select Auto Arrange from the Edit menu.
With a high number of events per second and depending on system
performance and the number of data monitors/query viewers on the current
dashboard, the refresh rate can be slower than the set refresh rate.

Save
Select Save from the Edit menu in the top menu bar is enabled when you change
the dashboard, including simply resizing the window. For example, when you first
open a dashboard, if the window size is different than it was when it was last
saved, the Save button is enabled.
You can also save the dashboard by right-clicking on any dashboard element and selecting
Save.
Drilldown
On the Management Console, you can only drill down to other dashboards. If a dashboard
element has drilldown links to channels, reports, or query viewers, they do not appear in
the Management Console. For information on creating drilldowns refer to the ArcSight
Console User’s Guide.
Right-click on a dashboard element for which one or more drill downs have been
configured and select Drilldown to select a linked dashboard from the list.
If a dashboard element has a drilldown configured, you can also double-click anywhere on
that dashboard element. If there is more than one drilldown destination configured,
double-clicking takes you to the default. If the default was not a dashboard and is not on
the list, double-clicking takes you to the first dashboard on the list. (If you are on a
geographical event graph, double-clicking zooms you in, so use the right-click option and
select Drilldown.
A Previous button appears on the menu bar to return you to where you were.
Data Monitor Disable/Enable
To disable a data monitor, right-click on a dashboard element that is a data monitor, and
select Data Monitor > Disable Data Monitor. The dashboard element remains, but
there is no data or chart in the view.
To enable it again, right-click on the data monitor, and select Data Monitor > Enable.
You cannot disable Query Viewers.

View As
The view options that are available vary according to the type
of element, which depends on selections made when it was
created it in the ArcSight Console. They might show different
kinds of charts, if the data monitor can be displayed in those
formats.
If you right-click on a geographical event graph, the View As
options include Geographical Event Map and Event
Graph.
 A Geographical Event Map shows you a map of the
world with lines connecting the origin and destination of
each event. You can zoom in and hover over individual
events for details.
 An Event Graph displays the event endpoints like nodes
on a spider web. You can hover over individual events
endpoints for details.
Click Save, in the upper right, to save your changes.
Choose Colors
Right-click dashboard
elements that are
tables to see the
Choose Colors
option.
 Foreground
Color: Select a
color from the
palette to change the color of all the text in the table unconditionally.
 Transparent table: Check this box if you have a background image selected for this
dashboard and you want it to show through this table. This unconditionally affects the
entire table’s background.
 Conditional background color controls:
 Conditions for: Clear the field and select the pull-down menu. You can set the
part of the table for which the background color is set when the conditions are
met. Table means any cell in the table.
 Color entire row: If the conditions are met, set the background color to the row
on which you right-clicked to get the Choose Colors dialog.
 Value: Clear the field and select the pull-down menu. Select the logical operator
to use for comparing the part of the table specified in Conditions For to the Value
field to the right of the operator. Then fill in the text to match.
 Background: Select a color from the pull-down menu to change the background
color of the matching part of the table. For the parts of the table that match the
conditions, a background color supersedes making the table background
transparent.
 + Add another condition: Click this to add another set of conditions for which
you can select a different background color.

Chapter 4
Preferences
The Preferences module enables you to control additional links, appearance, logging and
your own user account settings.
Custom Modules
A module is one of the icons that appear on the home page. Modules appear as tabs when
you go to one of the module pages.
Create additional web modules for the Management Console home page. You can simply
add links to other web sites or you can link to web applications.
To add a new module:
1 Click Add in the action bar at the top of the list.
2 Type in a Name for this module. This name appears in the icon for this module and in
the box above it when you hover the mouse over the icon.
3 Enter the URL for this module.
4 Optionally, enter a Description to appear above the module icon and in the box
above it when you hover the mouse over the icon.
5 Click Save to save this module or Cancel to clear the entries and exit the Add mode.
To delete a module highlight the module in the list and click Delete in the action bar at the
top of the list.
Skins & Effects
Change the color combinations used in the Management Console display.
1 Select a Skin Name from the list.
2 Turn on Navigation Transition Effects to introduce a fade effect for page
transitions.
Custom Modules
Skins & Effects
Logging
Account Settings

4 Preferences
3 Click Save in the lower left corner of the panel.
Logging
This Logging control is for log entries generated by the Management Console user
interface.
Turn Logging on to enable the Logging User Interface selections:
 The Logging Panel is an area at the bottom of the window that shows the most
recent events.
 The Logging Pop-up is a small pop-up window that you can move around and resize.
 The Logging Debug Support option shows an increased level of detail in the logged
messages. Debug support is On in both the screen images, above.
Click Save, at the bottom, if you change any Logging options.
Logging and Skins preferences are both saved in the system for your user ID.
However, if you are sharing a computer with another user, clear the browser
cookies before logging in, otherwise you will see the preferences of the last
user on this computer.
Blue Theme Gray Theme Slickness

4 Preferences
Account Settings
Change your own account settings, except your User ID. You can change your password,
name, role, department, and contact information.
Click Change Password to enter your existing password and specify a new one. The
change takes effect immediately and you do not have to click Save.
Click Save, at the bottom, if you change any other account settings.

4 Preferences

A
access control list (ACL) 34
access permissions 12
account
create/edit user 13
your settings 46
Activated archive 23
Active Directory, setting up authentication for 35
Advanced link, for group 12
alias, user 13
animation 42
Archive at next scheduled time action 20
Archive Daily at 21
archive jobs 18
Archive now action 20
Archive Utility user type 13
Archived status 20
archives
activated 23
deactivated 23
space 18
stored at 21
ArcSight Console 5
Arrange 40
authentication 6, 33
Active Directory 35
built-in 34
custom JAAS plug-in configuration 36
external 33
LDAP 36
password-based 34
PKCS#11 33
RADIUS 34
SSL client-only 37
Auto Arrange 40, 42
B
background color 44
background image or color 41
built-in authentication 34
C
Cancel Operation action 20
client keystore 37
color 44, 45
commands, send to connector 25
configuration management 31
configuring
SSL 35
connector
commands 25
component mapping 28
editor 24
management 23
Connector Installer user type 13
console 5
CORR engine 15
custom authentication scheme 36
D
dashboard
save 42, 43
dashboards 39
Deactivated archive 23
DNS 32
documentation 7
E
editor, connector 24
effects 45
email address, user 13
error threshold 17
ESM Console, see ArcSight Console 5
event storage 16
external authentication 33
guidelines 33
external user ID 13
F
folder, archive 21
Forwarding Connector user type 13
G
geographical event map 44
global settings 42
graph
event graph 44
geological event map 44
group, user 10
H
heap, manager 31
I
ID, user 13
In Progress status 20
Index

Index
incoming mail server 32
IP address 6
J
JAAS plug-in authentication 36
job time 19
L
LDAP
setting up authentication for 36
license information 31
logging 46
logout
Management Console 6
M
mail protocol
protocol, email server 32
mail server 32
parameters 32
Management Tool user type 13
Manager heap size 31
map view 44
module 45
N
navigation
Administration tab 9
general 7
Normal User user type 13
Not Archived status 20
notification
of disk space thresholds 18
of manager errors 31
O
Operations permissions 13
overview 5
P
password authentication 6
password-based authentication 34
Pending status 20
period, retention 17
permissions, group 12
PKCS#11 authentication 33
preferences 42, 45
R
RADIUS
setting up authentication for 34
refresh 7, 41, 42
registered connectors 23
reload 42
Resources permissions 12
retention period 17
S
save dashboard 42, 43
server, email 32
skins 45
SMTP server 32
SSL
client-only authentication 37
configuring 35, 36
SSL authentication 6
storage
management 15
system 18
T
threshold, storage usage 17
transition effect 45
Turn Archiving On 21
U
user
copy 14
search 14
types 13
user group 10
User Groups permissions 13
User ID, create user 13
user management 9
W
warning threshold
threshold 17
web module 45
Web User user type 13

Esm management console_userguide_6.0c

More Related Content

What's hot (20)

Similar to Esm management console_userguide_6.0c (20)

More from Protect724 (20)

Recently uploaded (20)

Esm management console_userguide_6.0c