ArcSight: Upload Events to TruSTAR
TruSTAR supports integration with ArcSight SIEM using a python script that is available with our SDK examples. This script supports the following actions:
- Parsing a .csv file of events exported from ArcSight and uploading it to a TruSTAR Enclave.
- Associating a TruSTAR Intel Report URL with event in ArcSight. This utilizes the CEF and can be sent back to ArcSight using syslog.
Using this script work requires in-depth knowledge of ArcSight and TruSTAR's REST API. This script was designed to provide a foundation for developing complex data workflows between ArcSight and TruSTAR.
To run this script:
- Install TruSTAR's Python SDK.
- Export the list of ArcSight cases in .csv format.
- Identify any changes to the parser object (line #33) to align with your .csv export.
- Review and make changes if needed to the python script.To link the TruSTAR Intel Report back to the ArcSight case, you must make sure the accurate column name from the .csv file is identified as the column of case IDs.
Please reach out to support@trustar.co if you have any questions about this script.
