ArcSight: Upload Events to TruSTAR
The TruSTAR platform supports integration with ArcSight SIEM using a Python script that is available with our SDK examples. This script supports the following actions:
- Parsing a .CSV file of events exported from ArcSight and uploading it to a TruSTAR Enclave.
- Associating a TruSTAR Intelligence Report URL with an event in ArcSight. This utilizes the CEF and can be sent back to ArcSight using syslog.
To run this script:
- Install the TruSTAR Python SDK.
- Export the list of ArcSight cases in .CSV format.
- Identify any changes to the parser object (line #33) to align with your .CSV export.
- Review and make changes if needed to the python script.To link the TruSTAR Report back to the ArcSight case, you must make sure the accurate column name from the .CSV file is identified as the column of case IDs.
You can contact email@example.com if you have any questions about this script.