ArcSight: Upload Events to TruSTAR
Updated 2 months ago
by
TruSTAR
The TruSTAR platform supports integration with ArcSight SIEM using a Python script that is available with our SDK examples. This script supports the following actions:
- Parsing a .CSV file of events exported from ArcSight and uploading it to a TruSTAR Enclave.
- Associating a TruSTAR Intelligence Report URL with an event in ArcSight. This utilizes the CEF and can be sent back to ArcSight using syslog.
Using this script work requires in-depth knowledge of ArcSight and TruSTAR's REST API. This script was designed to provide a foundation for developing complex data workflows between ArcSight and TruSTAR.
To run this script:
- Install the TruSTAR Python SDK.
- Export the list of ArcSight cases in .CSV format.
- Identify any changes to the parser object (line #33) to align with your .CSV export.
- Review and make changes if needed to the python script.To link the TruSTAR Report back to the ArcSight case, you must make sure the accurate column name from the .CSV file is identified as the column of case IDs.
You can contact support@trustar.co if you have any questions about this script.
