SlideShare a Scribd company logo

ArcSight Management Center 2.0 Administrator's Guide

•
•
P
Protect724mouni

ArcSight Management Center 2.0 Administrator's Guide

Software
1 of 252
Download to read offline
Administrator’s Guide HP ArcSight Management Center 2.0 June 10, 2015
Copyright © 2015 Hewlett-Packard Development Company, L.P. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Follow this link to see a complete statement of copyrights and acknowledgements: http://www.hpenterprisesecurity.com/copyright Contact Info Revision History Phone A list of phone numbers is available on the HP ArcSight Technical Support page: http://www8.hp.com/us/en/software- solutions/software.html?compURI=1345981#.URitMaVwpWI Support Web Site http://support.openview.hp.com Protect 724 Community https://protect724.hp.com Date Revision 6/10/2015 Added section on remote connector management 1/21/2015 Added information about header line for host CSV import file. 7/22/2014 Revised document. 5/2/2014 2.0 GA release. 8/9/2013 1.0 GA release
Confidential HP ArcSight Management Center Administrator’s Guide 3 Contents Chapter 1: HP ArcSight Management Center Overview ..................................................... 13 New Features and Enhancements .............................................................................. 13 Chapter 2: Software Installation ....................................................................................... 15 Overview ..................................................................................................................... 15 Installing ArcSight Management Center ............................................................................ 16 Prerequisites for Installation ..................................................................................... 16 Installation Steps .................................................................................................... 16 GUI Mode Installation ........................................................................................ 16 Console Mode Installation .................................................................................. 19 Silent Mode Installation ..................................................................................... 21 Enabling/Disabling ArcSight Management Center as a System Service ............................ 23 ArcSight Management Center Operations .......................................................................... 24 Connecting to the ArcSight Management Center User Interface ..................................... 24 ArcSight Management Center Processes ..................................................................... 24 The ArcSight Management Center Daemon (arcmcd) .................................................... 24 Uninstalling Software ArcSight Management Center ..................................................... 25 Uninstalling in GUI Mode .................................................................................... 25 Uninstalling in Console Mode .............................................................................. 26 Uninstalling in Silent Mode ................................................................................. 26 Upgrading to Software ArcMC 2.0 .................................................................................... 26 Migrating from Connector Appliance ................................................................................. 26 Installing the ArcSight Management Center Agent ............................................................. 27 Manual Installation Procedure ................................................................................... 27 ArcSight Management Center Agent Operations ................................................................. 28 Uninstalling the ArcSight Management Center Agent .................................................... 28 Chapter 3: The User Interface ........................................................................................... 31 Overview ..................................................................................................................... 31 The Menu Bar ............................................................................................................... 31 Home .................................................................................................................... 32 Node Management .................................................................................................. 32 Configuration Management ....................................................................................... 33 Administration ........................................................................................................ 33
4 HP ArcSight Management Center Administrator’s Guide Confidential Help ...................................................................................................................... 33 About .................................................................................................................... 33 Logout ................................................................................................................... 34 Chapter 4: Managing Nodes .............................................................................................. 35 Overview ..................................................................................................................... 35 Node Management ........................................................................................................ 36 The Navigation Tree ...................................................................................................... 36 The Management Panel .................................................................................................. 37 Management Tabs ................................................................................................... 37 Tab Controls .................................................................................................... 38 The Locations Tab ............................................................................................. 38 The Hosts Tab .................................................................................................. 39 The Containers Tab ........................................................................................... 41 The Connectors Tab .......................................................................................... 42 The Connector Summary Tab ............................................................................. 43 The Connector Appliances Tab ............................................................................ 45 The Loggers Tab ............................................................................................... 46 The ArcMCs Tab ................................................................................................ 46 Locations ..................................................................................................................... 47 Adding a Location ................................................................................................... 47 Editing a Location ................................................................................................... 48 Viewing All Locations ............................................................................................... 48 Deleting a Location ................................................................................................. 48 Hosts .......................................................................................................................... 49 About Adding a Host ................................................................................................ 49 Prerequisites for Adding a Host ........................................................................... 49 Node Authentication Credentials ......................................................................... 51 Adding a Host ......................................................................................................... 52 Importing Hosts ...................................................................................................... 53 Prerequisites for Importing Hosts ........................................................................ 53 CSV File Format ................................................................................................ 53 Import Hosts Procedure ..................................................................................... 55 Exporting Hosts ...................................................................................................... 56 Viewing All Hosts .................................................................................................... 57 Viewing Managed Nodes on a Host ............................................................................ 57 Deleting a Host ....................................................................................................... 57 Moving a Host to a Different Location ........................................................................ 57 Upgrading or Installing the ArcMC Agent on an Appliance Host ...................................... 58 Scanning a Host ...................................................................................................... 58 The Scan Process .............................................................................................. 59 Downloading and Importing Host Certificates .............................................................. 59
Confidential HP ArcSight Management Center Administrator’s Guide 5 Chapter 5: Managing HP ArcSight Products ....................................................................... 61 Overview ..................................................................................................................... 61 Managing Connector Appliances ...................................................................................... 61 Rebooting .............................................................................................................. 62 Shutting Down ........................................................................................................ 62 Editing or Removing a Configuration .......................................................................... 62 Setting a Configuration on Connector Appliances ......................................................... 63 Managing Other ArcSight Management Centers ................................................................. 63 Rebooting .............................................................................................................. 64 Shutting Down ........................................................................................................ 64 Editing or Removing a Configuration .......................................................................... 64 Setting a Configuration on Managed ArcSight Management Centers ............................... 65 Managing Loggers ......................................................................................................... 66 Rebooting .............................................................................................................. 66 Shutting Down ........................................................................................................ 66 Editing or Removing a Configuration .......................................................................... 67 Upgrading a Logger Appliance ................................................................................... 67 Setting a Configuration on Loggers ............................................................................ 68 Managing Containers ..................................................................................................... 68 Viewing All Containers ............................................................................................. 69 Viewing Connectors in a Container ............................................................................ 69 Editing a Container .................................................................................................. 70 Deleting a Container ................................................................................................ 70 Updating Container Properties .................................................................................. 70 Changing Container Credentials ................................................................................ 71 Sending a Command to a Container ........................................................................... 71 Upgrading a Container to a Specific Connector Version ................................................. 71 Viewing Container Logs ............................................................................................ 72 Deleting a Container Log .......................................................................................... 72 Adding a Connector to a Container ............................................................................ 73 Running Logfu on a Container ................................................................................... 73 Managing Certificates on a Container ......................................................................... 73 Adding CA Certificates to a Container .................................................................. 74 Removing CA Certificates from a Container ........................................................... 74 Adding a CA Certs File to a Container .................................................................. 75 Enabling or Disabling a Demo Certificate on a Container ......................................... 76 Adding Multiple Destination Certificates to a Container ........................................... 76 Viewing Certificates on a Container ..................................................................... 77 Resolving Invalid Certificate Errors ...................................................................... 77 Running Diagnostics on a Container ........................................................................... 77 Managing Connectors ..................................................................................................... 78 Viewing All Connectors ............................................................................................. 78 Adding a Connector ................................................................................................. 79
6 HP ArcSight Management Center Administrator’s Guide Confidential Prerequisites .................................................................................................... 79 Editing Connector Parameters ................................................................................... 81 Updating Simple Parameters for a Connector ........................................................ 81 Updating Table Parameters for a Connector .......................................................... 81 Updating Simple and Table Parameters for Multiple Connectors ............................... 82 Managing Destinations ............................................................................................. 83 Adding a Primary Destination to a Connector ........................................................ 83 Adding a Failover Destination to a Connector ........................................................ 84 Adding a Primary or Failover Destination to Multiple Connectors .............................. 85 Removing Destinations ...................................................................................... 85 Re-Registering Destinations ............................................................................... 86 Editing Destination Parameters ........................................................................... 86 Editing Destination Runtime Parameters .............................................................. 87 Managing Alternate Configurations ...................................................................... 88 Sending a Command to a Destination .................................................................. 89 Deleting a Connector ............................................................................................... 89 Sending a Command to a Connector .......................................................................... 90 Running Logfu on a Connector .................................................................................. 90 Changing the Network Interface Address for Events ..................................................... 91 Developing FlexConnectors ....................................................................................... 91 Editing FlexConnectors ............................................................................................ 93 Sharing Connectors in ArcExchange ........................................................................... 93 Packaging and Uploading Connectors ................................................................... 94 Downloading Connectors .................................................................................... 96 Configuration Suggestions for Connector Types ........................................................... 97 Included FlexConnectors .......................................................................................... 98 Configuring the Check Point OPSEC NG Connector ....................................................... 98 Adding the MS SQL Server JDBC Driver .....................................................................100 Adding the MySQL JDBC Driver ................................................................................101 Chapter 6: Managing Configurations ............................................................................... 103 Overview ....................................................................................................................103 Configuration Types ...............................................................................................104 Configuration Management ............................................................................................105 The Configurations Table .........................................................................................105 The Details Tab ...............................................................................................106 The Subscribers Tab .........................................................................................108 Creating a Configuration .........................................................................................109 Editing a Configuration ...........................................................................................110 Deleting a Configuration .........................................................................................110 Importing a Configuration .......................................................................................110 Managing Subscribers ...................................................................................................112 Adding a Subscriber ...............................................................................................112
Confidential HP ArcSight Management Center Administrator’s Guide 7 Unsubscribing a Subscriber .....................................................................................112 Pushing a Configuration ................................................................................................113 Push Validation ......................................................................................................113 Common Causes for Push Failure .............................................................................113 Push Remediation ..................................................................................................114 Pushing a Configuration to a Product Managed By Another ArcMC .................................114 Checking Compliance ....................................................................................................114 Configuration Management Best Practices ........................................................................115 Configuration Types ......................................................................................................116 Connector Configuration Types ................................................................................117 BlueCoat Connector Configuration ......................................................................117 FIPS Configuration ...........................................................................................118 Map File Configuration ......................................................................................118 Parser Override Configuration ............................................................................118 Syslog Connector Configuration .........................................................................119 Windows Unified Connector (WUC) External Parameters Configuration ....................119 Limitations to WUC External Parameters Configurations ........................................119 Windows Unified Connector (WUC) Internal Parameters Configuration .....................121 Limitations to WUC Internal Parameters Configurations .........................................121 Connector Appliance/ArcMC Configuration Types ........................................................122 Connector Appliance/ArcMC Configuration Backup Configuration .............................122 Logger Configuration Types .....................................................................................124 Logger Configuration Backup Configuration .........................................................124 Logger Filter Configuration ................................................................................125 Logger SmartMessage Receiver Configuration ......................................................125 Logger Storage Group Configuration ...................................................................125 Logger Transport Receiver Configuration .............................................................126 System Admin Configuration Types ..........................................................................128 Authentication External .....................................................................................128 Authentication Local Password ...........................................................................129 Authentication Session .....................................................................................130 DNS Configuration ...........................................................................................130 Network Configuration ......................................................................................130 NTP Configuration ............................................................................................131 SMTP Configuration ..........................................................................................131 SNMP Configuration .........................................................................................131 Users Configuration ..........................................................................................131 Chapter 7: Monitoring ..................................................................................................... 133 Overview ....................................................................................................................133 ArcSight Management Center Monitoring .........................................................................133 The Monitoring Summary ........................................................................................133 Performance Summary .....................................................................................134
8 HP ArcSight Management Center Administrator’s Guide Confidential Pie Graphs ......................................................................................................134 Drilling Down ........................................................................................................135 Configuring Breach Rules ..............................................................................................137 Creating Rules .......................................................................................................139 Rule Verification ..............................................................................................140 Rules Examples .....................................................................................................140 Configuring Email Notifications .......................................................................................141 Example Email Notification ................................................................................141 Chapter 8: Managing Backups and Restores .................................................................... 143 Overview ....................................................................................................................143 Backup .......................................................................................................................143 Restore .......................................................................................................................144 Chapter 9: Creating Snapshots ........................................................................................ 147 Overview ....................................................................................................................147 Creating a Snapshot .....................................................................................................147 Chapter 10: Managing Repositories ................................................................................ 149 Overview ....................................................................................................................149 Logs Repository ...........................................................................................................150 Uploading a File to the Logs Repository .....................................................................150 CA Certs Repository ......................................................................................................150 Uploading CA Certificates to the Repository ...............................................................150 Removing CA Certificates from the Repository ............................................................151 Upgrade AUP/ENC Repository .......................................................................................151 About the AUP Upgrade Process ...............................................................................151 Uploading an AUP Upgrade File to the Repository .......................................................152 Removing a Connector Upgrade from the Repository ...................................................152 Content AUP Repository ................................................................................................152 Applying a New Content AUP ...................................................................................153 Applying an Older Content AUP ................................................................................153 User-Defined Repositories .............................................................................................154 Creating a User-Defined Repository ..........................................................................154 Retrieving Container Files ........................................................................................155 Uploading Files to a Repository ................................................................................156 Deleting a Repository .............................................................................................156 Updating Repository Settings ...................................................................................157 Managing Files in a Repository .................................................................................157 Retrieving a File from the Repository ..................................................................157 Uploading a File from the Repository ..................................................................157 Pre-Defined Repositories ...............................................................................................158 Settings for Backup Files .........................................................................................158
Confidential HP ArcSight Management Center Administrator’s Guide 9 Settings for Map Files .............................................................................................159 Settings for Parser Overrides ...................................................................................160 Settings for FlexConnector Files ...............................................................................160 Settings for Connector Properties .............................................................................161 Settings for JDBC Drivers ........................................................................................162 Cloning Container Configuration ...............................................................................162 Adding Parser Overrides ..........................................................................................163 Chapter 11: System Admin - ArcSight Management Center .......................................................................................... 165 System .......................................................................................................................165 System Reboot ......................................................................................................166 Network ................................................................................................................166 System DNS ....................................................................................................166 Hosts .............................................................................................................166 NICs ..............................................................................................................167 Static Routes ...................................................................................................168 Time/NTP .......................................................................................................169 SMTP ....................................................................................................................170 License & Update ...................................................................................................171 Updating the Appliance .....................................................................................171 Updating the License File ..................................................................................171 Process Status .......................................................................................................172 System Settings ....................................................................................................172 SNMP ...................................................................................................................172 Receiving System Health and Audit Events as SNMP Traps .....................................172 Polling System Health Information Using SNMP ....................................................173 Viewing Polled Information ................................................................................174 SNMP V3 ........................................................................................................177 SSH Access to the Appliance ....................................................................................178 Enabling or Disabling SSH Access .......................................................................178 Connecting to Your Appliance Using SSH .............................................................178 Diagnostic Tools .....................................................................................................179 Logs ...........................................................................................................................186 Audit Logs .............................................................................................................186 Configuring Audit Forwarding ...................................................................................187 For Software ArcSight Management Center ..........................................................187 For ArcSight Management Center Appliance .........................................................187 Configuring Audit Forwarding to a Specific Destination ................................................187 Storage ......................................................................................................................188 Remote File Systems ..............................................................................................188 Managing a Remote File System ........................................................................188 RAID Controller/Hard Disk SMART Data .....................................................................191 FTP ......................................................................................................................192
10 HP ArcSight Management Center Administrator’s Guide Confidential Models Supporting FTP .....................................................................................192 Enabling FTP .........................................................................................................192 Adding a Subdirectory ......................................................................................193 Processing Log Data Received via FTP .......................................................................194 Using FTPS (FTP over SSL) ......................................................................................194 Using FTPS with Blue Coat ProxySG ....................................................................194 Security ......................................................................................................................195 SSL Server Certificate .............................................................................................195 Generating a Self-Signed Certificate ...................................................................196 Generating a Certificate Signing Request (CSR) ...................................................197 Importing a Certificate .....................................................................................199 SSL Client Authentication ........................................................................................199 Uploading Trusted Certificates ...........................................................................200 Uploading a Certificate Revocation List ................................................................200 Enabling Client Certificate Authentication ............................................................200 FIPS 140-2 ............................................................................................................200 Users/Groups ..............................................................................................................201 Authentication .......................................................................................................201 Sessions .........................................................................................................201 Local Password ................................................................................................202 Users Exempted From Password Expiration .........................................................204 Forgot Password ..............................................................................................204 External Authentication ....................................................................................205 Login Banner .........................................................................................................210 User Management ..................................................................................................211 Users .............................................................................................................211 Groups ...........................................................................................................213 Change Password ...................................................................................................215 Appendix A: Audit Logs ................................................................................................... 217 Audit Event Types ........................................................................................................217 Audit Event Information ................................................................................................217 Application Events ........................................................................................................218 Platform Events ...........................................................................................................224 System Health Events ...................................................................................................227 SNMP Related Properties ...................................................................................228 Appendix B: Destination Runtime Parameters ................................................................. 231 Appendix C: Special Connector Configurations ................................................................ 239 Microsoft Windows Event Log - Unified Connectors ............................................................239 Change Parser Version by Updating Container Properties .............................................240 SSL Authentication .................................................................................................241 Database Connectors ....................................................................................................241
Confidential HP ArcSight Management Center Administrator’s Guide 11 Add a JDBC Driver ........................................................................................................242 API Connectors ............................................................................................................243 File Connectors ............................................................................................................244 Syslog Connectors ........................................................................................................244 Appendix D: Restoring Factory Settings .......................................................................... 245 Overview ....................................................................................................................245 Factory Restore Using HP System Restore .......................................................................245 Factory Restore Using Acronis True Image .......................................................................247 Index ............................................................................................................................... 251
12 HP ArcSight Management Center Administrator’s Guide Confidential
Confidential HP ArcSight Management Center Administrator’s Guide 13 Chapter 1 HP ArcSight Management Center Overview The following topic is discussed here. HP ArcSight Management Center (ArcMC) provides centralized management for Connector Appliances, Loggers, software connectors, and other ArcSight Management Centers, with a single panel view of all managed ArcSight products. New Features and Enhancements HP ArcSight Management Center 2.0 includes these new features and enhancements:  ArcSight Management Center Appliance: ArcSight Management Center is now available in a hardware form factor (ArcMC Appliance).  Management of Other ArcSight Management Centers: ArcSight Management Center can now manage other instances of ArcSight Management Center, enabling you to deploy and manage your ArcSight Management Centers hierarchically.  Configuration support for BlueCoat and WUC Connectors and Logger 5.5: Support has been added for configuration management of BlueCoat and WUC connectors as well as for Logger 5.5. “New Features and Enhancements” on page 13
1 HP ArcSight Management Center Overview 14 HP ArcSight Management Center Administrator’s Guide Confidential  Importing/Exporting Hosts: Add multiple hosts quickly and easily by importing them from a CSV file, and export hosts to a CSV file as well.  Enhanced Monitoring: Health monitoring of managed ArcSight products can be configured using a variety of criteria. You can create customized alerts for managed nodes.  Upgrade to ArcSight Management Center 2.0: Support is provided for upgrades from ArcSight Management Center 1.0 to ArcSight Management Center 2.0. The upgrade process is detailed in the ArcSight Management Center Release Notes.  Migration of Connector Appliance: Current installations of Connector Appliance can be migrated to ArcSight Management Center 2.0. For more information on supported versions of Connector Appliance, and for migration procedures, see the ArcSight Management Center 2.0 Migration Guide.  SNMP V3 and FIPS Support: Support has been added for SNMP version 3 as well as FIPS.  Simplified SSH Access: By default, you are not prompted for a challenge/response when remotely logging in to an ArcSight Management Center 2.0 appliance using SSH. (This represents a change from the configuration of Connector Appliance.)  As a result, it is imperative that you change the default password for the “root” account on an ArcSight Management Center appliance to a new, strong password.  For added security, it is strongly recommended that you enable SSH access only when necessary, such as for troubleshooting purposes.
Confidential HP ArcSight Management Center Administrator’s Guide 15 Chapter 2 Software Installation This chapter describes how to install Software ArcSight Management Center and the ArcSight Management Center Agent. The following topics are discussed here. Overview The complete process of installing Software ArcSight Management Center includes these steps:  Select installation mode: Select a mode in which to install Software ArcSight Management Center on your selected machine. You can install Software ArcSight Management Center in these modes:  GUI: In GUI mode, a wizard steps you through the installation and configuration process. For detailed information, see “GUI Mode Installation” on page 17.  Console: In Console mode, a command-line process steps you through the installation and configuration process. See “Console Mode Installation” on page 20 for detailed instructions.  Silent: In Silent mode, the installation process is scripted. There is no need to interact with the installer, as you provide the installation and configuration input through a file. See “Silent Mode Installation” on page 21 for detailed instructions.  Install License: A valid license is required for Software ArcSight Management Center. A license file is uniquely generated for each download; therefore, you cannot use the same license file to install multiple instances of the product. To obtain the license, follow the instructions in the Electronic Delivery Receipt email received from HP after placing your order. “Overview” on page 15 “Installing ArcSight Management Center” on page 16 “ArcSight Management Center Operations” on page 24 “Installing the ArcSight Management Center Agent” on page 28 “ArcSight Management Center Agent Operations” on page 29 If you are using a Windows system to connect to the machine where Software ArcSight Management Center is to be installed, and prefer to install in GUI mode, you must connect using an X Window client, such as Xming for Windows.
2 Software Installation 16 HP ArcSight Management Center Administrator’s Guide Confidential  Start as a Service? If installation was performed as a root user, Software ArcSight Management Center can be configured to start as a system service. For more information, see “Enabling/Disabling ArcSight Management Center as a System Service” on page 24  Make Host Resolvable: For the Apache web process to start, the Software ArcSight Management Center hostname must be resolvable. Add the hostname to either /etc/hosts or DNS.  Secure Credentials: After initial setup is complete, connect to the application and change the default password to a secure password. To change the default password, follow the instructions in Chapter 11‚ Change Password‚ on page 214. Optionally, for additional security, rename the default admin username to a secure name. To change a username, follow the instructions in Chapter 11‚ User Management‚ on page 210. Additionally, if you plan to manage one or more Software ArcMCs, Software Connector Appliances or Software Loggers, you will need to install the ArcSight Management Center Agent on each. For more information on manual ArcSight Management Center Agent installation, see “Installing the ArcSight Management Center Agent” on page 28 Installing ArcSight Management Center The following section provides instructions to install Software ArcSight Management Center. Prerequisites for Installation Please note the following prerequisites before beginning the installation process.  File Descriptors 10240 or More: The host must support at least 10240 file descriptors. Perform ulimit -n on the host to determine the current level. If it does not equal at least 10240, open limits.conf and set these two parameters: * hard nolimit 10240 * soft nolimit 10240 Save the file and restart your session.  Unzip Package: An RPM capable of unzipping files needs to be installed on the CentOS or RedHat Linux system, and the unzip command path need to be set before installing Software ArcSight Management Center.  Non-Root Account: You can install ArcSight Management Center as a root or non- root user. However, when installing as a root user, a non-root user account is required in order to run some required processes.  When installing ArcSight Management Center as a root user, you can select the port on which it listens for secure web connections (HTTPS). When installing as a non-root user, the port must be configured to 9000. This value cannot be changed and must be externally accessible.  Technical Requirements: Refer to the ArcSight Management Center Release Notes, available from the HP ArcSight community, Protect724, for current information on supported platforms, supported browsers, and other technical requirements. Installation Steps This section describes Software ArcSight Management Center steps for each mode.
2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 17 GUI Mode Installation In GUI Mode installation, you use the installer wizard to install the application. To install Software ArcSight Management Center using the GUI mode: 1 Run these 2 commands from the directory where you copied the Software ArcSight Management Center installer:  chmod +x ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin  ./ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin where <installer_build_number>is the build number of the latest installer. The installation wizard starts. Review the dialog box, and then click Next. 2 Review the License Agreement details, and then scroll down to the end of the License Agreement details. Select I accept the terms of the License Agreement. Then, click Next [ 3 Specify or browse to a folder where you want to install ArcSight Management Center, as shown below. The default installation directory is /opt. However, you should specify a new installation directory in /opt that will easily identify ArcSight Management Center files, such as /opt/arcmc, to distinguish them from files associated with other HP ArcSight products.
2 Software Installation 18 HP ArcSight Management Center Administrator’s Guide Confidential 4 Review the summary of installation information on the Pre-Installation Summary dialog, and then click Install. The ArcSight Management Center installer begins the installation process. 5 When installation is complete, click Next to begin the configuration wizard.
2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 19 6 If you run the ArcSight Management Center software installer as a root user, the next dialog enables you to specify an existing non-root user and to configure a port through which ArcSight Management Center users will connect through the UI. For example, you can enter 443, the standard HTTPS port, or any other that suits your needs. If any port other than 443 is specified, users will need to enter the port number in the URL they use to access the ArcSight Management Center UI. Enter the user name of the non-root user and the HTTPS port number, and then click Next. (These values may not be changed later in the process.) 7 After the software is installed, click Next to begin ArcSight Management Center initialization. 8 After initialization is complete, click Done to launch the ArcSight Management Center Configuration wizard. 9 If you have run the ArcSight Management Center software installer as a root user, the next dialog enables you to configure ArcSight Management Center to run as a system service. By default, ArcSight Management Center runs as a standalone application, requiring a manual launch. When you install ArcSight Management Center as a root user, a service called arcsight_arcmc can be configured, created, and enabled at runlevel 3 and 5. Additionally, a few libraries are added using ldconfig. For a complete list of those libraries, see /etc/ld.so.conf.d/arcsight_arcmc.conf and <install_dir>/current/arcsight/install/ldconfig.out. 10 You have installed ArcSight Management Center. Click Start ArcSight Management Center Now, or click Start ArcSight Management Center later, and then click Finish. If you have selected to start ArcSight Management Center later, read the information in “The ArcSight Management Center Daemon (arcmcd)” on page 25 to understand how to start ArcSight Management Center at a later time. The Configuration wizard should launch automatically. If it does not, use this command to launch the wizard: <install_dir>/current/arcsight/arcmc/bin/arcsight arcmcsetup
2 Software Installation 20 HP ArcSight Management Center Administrator’s Guide Confidential 11 If you selected Start ArcSight Management Center Now, click Finish to exit the wizard. Alternatively, wait for the next dialog which provides the URL to access the ArcSight Management Center interface. ArcSight Management Center continues to start services and processes in the background. If you have selected to continue within the wizard, follow the instructions on the dialog or use the instructions in “Connecting to the ArcSight Management Center User Interface” on page 24 to connect to the ArcSight Management Center. Console Mode Installation In Console Mode installation, you use a command-line interface to install the application. To install Software ArcSight Management Center using the Console mode: 1 Run these commands from the directory where you copied the ArcSight Management Center software: chmod +x ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin ./ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin -i console where <installer_build_number>is the build number of the latest installer. The installation wizard starts in command-line mode, as shown below. Press Enter to continue. Introduction ------------ InstallAnywhere will guide you through the installation of ArcSight Management Center. It is strongly recommended that you quit all programs before continuing with this installation. Respond to each prompt to proceed to the next step in the installation. If you want to change something on a previous step, type 'back'. You may cancel this installation at any time by typing 'quit'. PRESS <ENTER> TO CONTINUE: 2 After the license information displays, press Enter until you see the following information: Select "I accept the terms of the License Agreement" below if you recognize that you have read the terms of this Agreement and attachments and agree to be bound by each of these terms. DO YOU ACCEPT THE TERMS OF THIS LICENSE AGREEMENT? (Y/N):Y 3 Go through the following prompts, from Choose Install Folder to Intervention Required, pressing Enter to continue through until the following confirmation appears: =============================================================== ================ Important Information
2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 21 --------------------- The installation of ArcSight Management Center software was successful. Configuration will begin after pressing [Enter]. PRESS <ENTER> TO CONTINUE: =============================================================== ================ Intervention Required --------------------- Values entered below may not be changed later in the process. Enter a non-root user account (DEFAULT: ): <non-root user> Enter an HTTPS port (default is 443) (DEFAULT: 443): =============================================================== ================ Important Information --------------------- The configuration of ArcSight Management Center software was successful. Initialization will begin after pressing [Enter]. This may take several minutes. PRESS <ENTER> TO CONTINUE: =============================================================== ================ Important Information --------------------- The initialization of ArcSight Management Center software was successful. The prompts that follow are the same as the ones described for the GUI mode install in “GUI Mode Installation” on page 17. Follow the instructions provided for the GUI mode install to complete the installation. Silent Mode Installation Silent mode enables scripting of the installation process. Before you install ArcSight Management Center in silent mode, create two properties files required for the silent mode installation: If ArcSight Management Center is installed in Console mode, it will be uninstalled in Console mode as well. See “Uninstalling in Console Mode” on page 26 for more information.
2 Software Installation 22 HP ArcSight Management Center Administrator’s Guide Confidential  A file to capture the installation properties  A file to capture the configuration properties After you have generated the two files, you need to merge them into one file and use the resulting file for silent mode installations. About Licenses for Silent Mode Installations As for any Software ArcSight Management Center installation, each silent mode installation requires a unique license file. Obtain licenses from HP Customer Support and install them on the machines on which you will be installing in silent mode, or ensure that the location where the license is placed is accessible from those machines. Generating the Silent Install Properties File This procedure generates the two properties files and then instructs you to combine them into one file. The resulting file is used for future silent installations. 1 Log in to the machine on which you wish to generate the installation properties file. If you want the silent mode installations to be done as root user, log in as root in this step. Otherwise, log in as a non-root user. 2 Run this command: ./ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin -r <directory_location> where <installer_build_number> is the build number of the installer file, and <directory_location> is the location of the directory where the generated properties file will be placed. This cannot be the same location where ArcSight Management Center is being installed. The properties file must be called installer.properties. 3 Install ArcSight Management Center in GUI mode, as described in “GUI Mode Installation” on page 17 until you arrive at step 10. At Step 10 of the installation procedure, do the following: a Click Previous instead of clicking Done to proceed further. b Then, click Cancel to stop the installation. 4 When the confirmation message appears, click Cancel. Click Quit to clear this message. 5 Navigate to the directory location you specified for the installer.properties file earlier. The following is an example of the generated installer.properties file. # Replay feature output # --------------------- # This file was built by the Replay feature of InstallAnywhere. # It contains variables that were set by Panels, Consoles or Custom Code. #Choose Install Folder
2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 23 #--------------------- USER_INSTALL_DIR=/opt/<arcmc_installation_folder>/<build number>/installdir #Install #------- -fileOverwrite_/opt/<arcmc_installation_folder>/<build number>/installdir/UninstallerData/Uninstall_ArcSight_Managemen t_Center_2.0.lax=Yes #Intervention Required #--------------------- USER_AND_PORT_1=username USER_AND_PORT_2=443 6 Start the configuration wizard with the option to record configuration properties: <install_dir>/current/arcsight/arcmc/bin/arcsight arcmcsetup -i recorderui When prompted to enter a file name to capture the configuration properties, enter a meaningful name; for example, config.properties, and then browse to choose the same directory as the installer.properties file. 7 Step through the configuration wizard, as described starting at Step 10 of “GUI Mode Installation” on page 17. 8 After the configuration properties file is generated, append the contents of this file to the installer.properties file generated in the previous procedure, Generating the Silent Install Properties File, to create a combined file. For example, you can use the cat command to concatenate both files: cat installer.properties config.properties > <combinedproperties.properties> 9 Include the following property in the combined file: ARCSIGHT_CONAPP_SETUP_PROPERTIES=<directory_location>/ <combined_properties_file> where <directory_location> is the path of the directory where the combined file is located, and <combined_properties_file> is the file name of the combined file you created earlier. Use the combined file for future ArcSight Management Center silent mode installations, as described in Installing Using the Generated Properties File below. Installing Using the Generated Properties File To install ArcSight Management Center using Silent mode, do the following. 1 Uninstall the previously installed version of ArcSight Management Center, as explained in “Uninstalling Software ArcSight Management Center” on page 26
2 Software Installation 24 HP ArcSight Management Center Administrator’s Guide Confidential 2 Make sure the machine on which you install ArcSight Management Center complies with the requirements listed in the HP ArcSight Management Center Release Notes, and the prerequisites listed in “Prerequisites for Installation” on page 16. 3 Copy the combined properties file you generated previously to the location where you have copied the ArcSight Management Center software. 4 Do one of the following:  Edit the licensePanel.path property in the silent mode properties file to include the location of the license file for this instance of the installation. (A unique license file is required for each instance of installation.), OR  Set the licensePanel.path property to point to a file, such as arcmc_license.zip. Then, for each instance of the silent mode installation, copy the relevant license file to the location and rename it to arcmc_license.zip. Doing so will avoid the need to update the combined properties file for each installation. 5 Run these 2 commands from the directory where you copied the ArcSight Management Center software:  chmod +x ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin  ./ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin -i silent -f <combined_properties_file> where <installer_build_number> is the build number of the installer file. The rest of the installation and configuration proceeds silently without requiring further input. Enabling/Disabling ArcSight Management Center as a System Service To enable or disable ArcSight Management Center as a system service: 1 On the menu bar, click Adminstration > System Admin. 2 In the navigation bar, click System Settings. 3 In the management panel, select Start as a Service to enable starting as a system service, or select Do not start as a service to disable. 4 Click Save. ArcSight Management Center Operations This section details the operation of ArcSight Management Center: how to connect, which processes run while ArcSight Management Center is active, and commands for using the ArcSight Management Center command-line utility (arcmcd). Connecting to the ArcSight Management Center User Interface Use this URL to connect to ArcSight Management Center: https://<hostname or IP address>:<configured_port>
2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 25 where hostname or IP address is the system on which you installed ArcSight Management Center. If ArcSight Management Center was installed as root and the default port was used, then <configured_port> is optional. To login for the first time, use the following default credentials: Username: admin Password: password For security, change the default credentials immediately after first logging in. For more information on changing credentials, see Chapter 11‚ Change Password‚ on page 214. ArcSight Management Center Processes After installation, the following processes run as part of ArcSight Management Center:  apache  aps  postgresql  web The ArcSight Management Center Daemon (arcmcd) The arcmcd utility enables a number of management and control tasks for the ArcSight Management Center software process, including starting, stopping and restarting. The syntax to run arcmcd is as follows: <install_dir>/current/arcsight/arcmc/bin/arcmcd <command> Where <install_dir> is the installation directory of ArcSight Management Center, and <command> is a command listed in Table 2-1. If ArcSight Management Center is installed to run as a system service, you can use arcmcd to manage a specific process. Process-specific commands are marked with an asterisk(*). Table 2-1 arcmcd Commands Command Description start Starts aps, apache, postgresql, and web processes. stop Stops aps, apache, postgresql, and web processes. restart Restarts aps, apache, postgresql, and web processes. status Displays the current status of all processes. quit Stops aps, apache, postgresql, and web processes, as well as the ArcSight Management Center application. start <process_name>* Starts the named process. For example, start apache.
2 Software Installation 26 HP ArcSight Management Center Administrator’s Guide Confidential Uninstalling Software ArcSight Management Center Uninstall ArcSight Management Center in the same user mode in which the installation was performed. For example, if you performed the installation as root, then you must perform the uninstallation as root Uninstalling in GUI Mode To uninstall Software ArcSight Management Center in GUI mode: 1 In the directory where you installed ArcSight Management Center, enter: <install_dir>/UninstallerData/Uninstall_ArcSight_Management_Center _2.0 2 The uninstall wizard starts. Click Uninstall to start uninstalling ArcSight Management Center and follow the prompts in the wizard. 3 After uninstalling, manually delete the /userdata directory. Uninstalling in Console Mode If you installed ArcSight Management Center in Console mode, then, by default, uninstallation occurs in Console mode. To uninstall in Console mode: 1 At the command line, enter: <install_dir>/UninstallerData/Uninstall_ArcSight_Management_Cen ter_2.0 2 After uninstalling, manually delete the /userdata directory. At the prompt, press Enter again to confirm uninstallation. The application will be uninstalled. Uninstalling in Silent Mode If you installed ArcSight Management Center in Silent mode, then, by default, uninstallation occurs in Silent mode. stop <process_name>* Stops the named process. For example, stop apache. restart <process_name>* Restarts the named process. For example, restart apache. If using GUI mode and uninstalling ArcSight Management Center software over an SSH connection, make sure that you have enabled X window forwarding using the -X option, so that you can view the screens of the uninstall wizard. If using PuTTY, you also need an X11 client on the machine from which you are connecting to the Linux machine. Table 2-1 arcmcd Commands Command Description
2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 27 To uninstall in Silent mode: 1 At the command line, enter: <install_dir>/UninstallerData/Uninstall_ArcSight_Management_Cen ter_2.0. The application will be uninstalled without further interaction. 2 After uninstalling, manually delete the /userdata directory. Upgrading to Software ArcMC 2.0 For instructions on upgrading ArcSight Management Center 1.0 to ArcSight Management Center 2.0, see the ArcSight Management Center 2.0 Release Notes. Migrating from Connector Appliance You can migrate the following to ArcSight Management Center 2.0:  Software Connector Appliance 6.4 Patch 3/6.4 Patch 3 Hotfix  Connector Appliance (hardware) 6.4 Patch 3 For instructions and details, see the ArcSight Management Center Migration Guide.
2 Software Installation 28 HP ArcSight Management Center Administrator’s Guide Confidential Installing the ArcSight Management Center Agent The ArcSight Management Center Agent runs on managed hosts and enables their management by ArcSight Management Center. Whether you need to install the ArcSight Management Center on a managed host depends on the host’s form factor. For Software Form Factors Before adding a managed software form factor (Software ArcSight Management Center, Software Connector Appliance, or Software Logger) as a host, you must first manually transfer the ArcSight Management Center Agent installer to the application host, and then run the installer. Completion of the installation will automatically start the Agent. You can then add the host to ArcSight Management Center. For more information, see “Manual Installation Procedure” on page 28. If a software ArcMC will be For Hardware Appliances When adding a hardware appliance (ArcSight Management Center Appliance, Connector Appliance or Logger Appliance) as a host, ArcSight Management Center automatically pushes the ArcSight Management Center Agent installer to the appliance, installs it, and then starts the service.The appliance is then ready to manage in ArcSight Management Center. You will not need to take any manual installation steps.. For Software Connectors Software connectors do not require the installation of the ArcSight Management Center Agent. Manual Installation Procedure You need to transfer, copy, or download the ArcSight Management Center Agent installer file to any Software ArcMC, Software Logger, or Software Connector Appliance you intend to add for management. (You can use any file transfer utility, such as FTP.) You must then manually run the Agent installer on the host and complete the installation. The ArcSight Management Center Agent and the managed application must both be installed using the same user mode. For example, if the Software Logger to be managed is installed as a root user, then the ArcSight Management Center Agent must also be installed as a root user. To manually install the ArcSight Management Center Agent: 1 In the directory to where you transferred the installer, run these 2 commands: An ArcMC used to manage products must have an Agent installed with the same version number as the ArcMC. For example, if your ArcMC 2.1 will be used to manage products, then the ArcMC Agent running on that ArcMC must also be version 2.1. An ArcMC used to manage products must have an Agent installed with the same version number as the ArcMC. For example, if your ArcMC 2.1 will be used to manage products, then the ArcMC Agent running on that ArcMC must also be version 2.1.
2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 29  chmod +x ArcSight-ArcMCAgent- 2.0.0.<agent_installer_build_number>.0.bin  ./ArcSight-ArcMCAgent- 2.0.0.<agent_installer_build_number>.0.bin LAX_VM <install_dir>/current/local/jre/bin/java where <agent_installer_build_number>is the build number of the latest installer and <install_dir> is the installation directory of the software product. The installation wizard starts. Review the dialog box, and then click Next.The required installation path is the install directory (that is, the same directory where Software Connector Appliance or Software Logger is installed). 2 Follow the prompts to complete the installation. The Agent is automatically started upon completion of the installation process. ArcSight Management Center Agent Operations After installation, the arcmcagent process runs on the managed host. This process automatically starts after either automatic or manual installation. However, if the Agent stops for any reason, it can be manually started. To manually start, stop, or restart the Agent: 1 On the managed host’s GUI, click Setup > System Admin > Process status. 2 Select arcmcagent from the list of processes. 3 Click Start|Stop|Restart, as necessary. On Software ArcMC, Software Connector Appliance, or Software Logger To manually start or stop the Agent on Software ArcMC, Software Connector Appliance, or Software Logger: 1 Run <install_dir>/current/arcsight/<conapp|logger| arcmc>/bin/<conappd|loggerd|arcmcd> <start|stop> arcmcagent Agent Verification To verify that the Agent is running on a host, use one of the following procedures:  In the managed host’s GUI, click Setup > System Admin > Process Status. The ArcSight Management Center Agent (arcmcagent) will be shown as a process in the running state.  (For Software ArcMC, Software Connector Appliance, or Software Logger Only) After you install the Agent, run this command at the command line: <install_dir>/current/arcsight/<conapp|logger>/bin/<conappd|log gerd> status The Agent is shown as a service in the running state. Uninstalling the ArcSight Management Center Agent To uninstall the ArcSight Management Center Agent, run the following command:
2 Software Installation 30 HP ArcSight Management Center Administrator’s Guide Confidential <install_dir>/arcmcagent/UninstallerData/Uninstall_ArcSight_Manage ment_Center_Agent_2.0 The Uninstall Wizard will launch. Click Uninstall to begin the wizard. When the uninstallation completes, click Done. • Always stop and then uninstall any previous version of the ArcSight Management Center Agent before installing a new version. • If uninstalling either Software ArcMC, Software Logger or Software Connector Appliance, make sure that the ArcSight Management Center Agent is uninstalled from the node before beginning the uninstall of the managed product.
Confidential HP ArcSight Management Center Administrator’s Guide 31 Chapter 3 The User Interface The following topics are discussed here. Overview This chapter provides a general overview of the ArcSight Management Center interface. ArcSight Management Center uses a browser-based user interface. Refer to the ArcSight Management Center Release Notes for the latest information on supported browsers. The Menu Bar The menu bar provides access to the main functional components of ArcSight Management Center. The menu bar includes the Home, Node Management, Configuration Management and Administration menus. “Overview” on page 31 “The Menu Bar” on page 31 “Logout” on page 34
3 The User Interface 32 HP ArcSight Management Center Administrator’s Guide Confidential Home The Home page displays information on all monitored products.  The management panel displays the Monitoring Summary table, showing all products which are currently reporting issues.  In addition, the aggregated health status for products of each type is displayed in pie graph format, showing total number of nodes, as well as the number corresponding to each status. A summary table shows the same data in percentage format.  The navigation panel enables you to display a monitoring summary for individual product types in the management panel. Click the product type to display the product’s monitoring summary. For more information on viewing and configuring monitoring, see Chapter 7‚ Monitoring‚ on page 133. Node Management Use Node Management to manage any of the following node types:  Software Connectors  Hardware or Software Connector Appliances  Hardware or Software Loggers  Hardware or Software ArcSight Management Centers
3 The User Interface Confidential HP ArcSight Management Center Administrator’s Guide 33 For more information on adding and managing nodes, see Chapter 4‚ Managing Nodes‚ on page 35. From the same menu, you can also perform selected management tasks on managed ArcSight products. See Chapter 5‚ Managing HP ArcSight Products‚ on page 61. Configuration Management Use Configuration Management to create and manage node configurations, and synchronization (pushing) of configurations across multiple nodes. You can manage any of these configuration types:  Logger configurations  System Admin configurations  Connector configurations  Connector Appliance  ArcSight Management Center configurations For more information on configuration management, see Chapter 6‚ Managing Configurations‚ on page 103. Administration The Administration menu contains these items:  Backup enables you to back up your current ArcSight Management Center configuration. Restore enables you to restore your configuration from a saved backup. For more information, see Chapter 8‚ Managing Backups and Restores‚ on page 143.  Snapshot enables you to take a snapshot image of HP ArcSight Management Center, to produce logs that are useful in troubleshooting. For more information, see Chapter 9‚ Creating Snapshots‚ on page 147.  Repositories enables you to manage repositories that store files, such as logs, certificates, and drivers. For more information, see Chapter 10‚ Managing Repositories‚ on page 149.  System Admin describes the system administration tools that enable you to create and manage users and user groups, and to configure security settings for your system. For more information, see Chapter 11‚ System Admin - ArcSight Management Center‚ on page 163. Help Click the Help link to display the online help, which explains the functionality and features of ArcSight Management Center. From the help landing page, you can navigate to or search for specific topics. About The Help > About screen displays the currently running version number of ArcSight Management Center. When done viewing, click OK.
3 The User Interface 34 HP ArcSight Management Center Administrator’s Guide Confidential Logout Click Logout to end your ArcSight Management Center session. By default, ArcSight Management Center automatically ends your session after 15 minutes of inactivity.
Confidential HP ArcSight Management Center Administrator’s Guide 35 Chapter 4 Managing Nodes The following topics are discussed here. Overview A node is a networked HP ArcSight product that can be centrally managed using ArcSight Management Center. Each node is associated with a single networked host which has been assigned either a hostname, an IP address, or both. Node types can include any of the following HP ArcSight products:  Connector Appliances or Software Connector Appliances  Logger Appliances or Software Loggers  Containers or software connectors  Other ArcSight Management Centers A single host can include multiple nodes. For example, a single Connector Appliance (with a single IP address or hostname) could have multiple containers, each of which could be a separate node. In addition, a node can be in a parent or child relationship with other nodes. You can perform any of the following node management tasks:  View managed nodes by location, by host, or by node type.  Add, view, edit, and delete locations for hosts.  Add nodes from a host, import hosts from a CSV file, view and delete hosts, view all hosts in a location, move hosts to different locations, and scan hosts for new connectors or containers. “Overview” on page 35 “Node Management” on page 36 “The Navigation Tree” on page 36 “The Management Panel” on page 37 “Locations” on page 47 “Hosts” on page 49
4 Managing Nodes 36 HP ArcSight Management Center Administrator’s Guide Confidential Node Management To manage nodes, on the menu bar, click Node Management. The Node Management UI displays. The Node Management UI comprises two panels:  The left side displays the navigation tree.  The right side displays the management panel, enabling you to perform management operations on items selected in the navigation tree. The Navigation Tree The navigation tree organizes managed nodes into a hierarchy, and comprises the following: System: System displays the entire set of nodes managed by ArcSight Management Center. Location: Individual locations are displayed under System, listed in the order in which they were added. Locations are logical groupings you can use to organize a list of hosts. For more information, see “Locations” on page 47. Host: Each location branch shows all hosts assigned to that location, listed by hostname, in the order in which they were added. For more information, see “Hosts” on page 49.
4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 37 Nodes: Each host branch shows all managed nodes associated with that host. A node can be any of the following types: Connector Appliance or Software Connector Appliance: Each Connector Appliance or Software Connector Appliance is shown as a separate node. Logger Appliance or Software Logger: Each Logger Appliance or Software Logger is shown as a separate node. ArcSight Management Center: Each Software ArcSight Management Center or ArcSight Management Center Appliance is shown as a separate node. Container: If the host includes any containers, each is shown as a node. Connector: If a container node contains a connector, the connector is shown under the container node in which it is contained. Since items in the tree are organized hierarchically, each item in the tree includes all branches displayed below it. For example, a Location branch includes all hosts assigned to that location. Click + to expand any branch and view any items included in the branch. The Management Panel Select an item in the navigation tree to display its details on one of the tabs in the management panel. For example, to display the details of a host shown in the navigation tree, select the host in the tree. The management panel will display details and controls pertaining to that host. Management Tabs The tabs displayed in the management panel depend on the type of item selected in the navigation tree. The management tabs displayed will show detailed information associated with the selected item. To view the number of nodes associated with a host, hover over the host entry in the tree. The count shown includes the host itself. Selected Item Type Management Tabs Shown System Locations, Hosts, Containers, Connectors, Connector Appliances, Loggers, ArcMCs Location Hosts, Containers, Connectors, Connector Appliances, Loggers, ArcMCs Host Containers, Connectors, Connector Appliances, Loggers, ArcMCs
4 Managing Nodes 38 HP ArcSight Management Center Administrator’s Guide Confidential For example, if you selected a location item from the navigation tree, the Hosts, Containers, Connectors, Connector Appliances, Loggers and ArcMCs tabs would be shown. Each tab would display the items of the named type associated with the selected location, including details on those items. For example, the Hosts tab would show any hosts in the location, while the Connector Appliances tab would show any Connector Appliances in the same location. Tab Controls These controls are commonly displayed on all tabs in the management panel:  Toolbar Buttons: Toolbar buttons enable operations related to the items on the tab.  Items Table: Items corresponding to the tab header are displayed in a table. For example, locations are listed in tabular format on the Locations tab.  Table Header Check Box: Click the check box in the table header to toggle selection of all check boxes in a single column.  Bulk Operations Buttons: On most tabs, buttons beneath the items list enable you to perform operations on one or more items. Choose one or multiple items in the list by selecting the checkbox next to each, and then click the button to perform the indicated operation. For example, to delete multiple items such as hosts, select one or more hosts on the Hosts tab, and then click Delete. The selected hosts would be deleted. In addition, each tab may have controls individual to that item type. For example, the Connectors tab includes controls related to the management of connectors (see Chapter 5‚ Managing Connectors‚ on page 78). The Locations Tab The Locations tab displays all locations defined in ArcSight Management Center. The Locations tab includes these buttons: Node Connectors, Connector Appliances, Loggers, ArcMCs Add Location Adds a new location. Import Imports host information from a CSV file. For more information, see “Importing Hosts” on page 53 Export Exports host information to a CSV file. For more information, see “Exporting Hosts” on page 56 Selected Item Type Management Tabs Shown
4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 39 The Locations tab includes the following columns:  Name: Location name.  Number of Hosts: Number of hosts assigned to the location.  Action: Shows a control for editing a location. For more information on editing a location, see “Editing a Location” on page 48. This button enables operations on one or more selected locations:  Delete: Deletes the selected locations from ArcSight Management Center. For more information on managing locations, see “Locations” on page 47. The Hosts Tab The Hosts tab displays all hosts associated with the location selected in the navigation tree. The Hosts tab includes these buttons: The Hosts tab includes the following columns: Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column. Add Host Adds a host. Edit Edits a host. Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
4 Managing Nodes 40 HP ArcSight Management Center Administrator’s Guide Confidential  Hostname: Fully qualified domain name (FQDN) of the host. The hostname must match the hostname in the host’s SSL certificate.  Issues: Status of certificate or Arc MC Agent associated with the host. Possible indicators include:  None: No issues are associated with the host.  Host Certificate Mismatch: The hostname does not match the hostname in the SSL certificate. For instructions on downloading and importing certificates for the host, see “Downloading and Importing Host Certificates” on page 59.  Agent Out of Date: Indicates either that the host’s Agent version is not the same as the ArcSight Management Center, or that ArcSight Management Center 2.0 cannot communicate with ArcSight Management Center Agent 1.0. For instructions on remotly upgrading the Agent version on an appliance host, see “Upgrading or Installing the ArcMC Agent on an Appliance Host” on page 58.  Agent Stopped: The Agent process on the host has been stopped.  Agent Uninstalled: The Agent on the host has been uninstalled.  Path: Path to the host.  Type: Type of host. (On an ArcMC Appliance, the localhost is shown as Software.)  Model: If an appliance, shows the HP ArcSight model number of the appliance. If the host is not an appliance, the label Software is shown.  Version: Version number of the software on the host.  Agent Version: Version number of the ArcSight Management Center Agent running on the host.  Comment: Any comments on the host.  Action: Shows a control for scanning a host for new connectors. For more information on scanning a host, see Chapter 5‚ Managing Connectors‚ on page 78. These buttons enable operations on one or more selected hosts:  Delete: Deletes the selected hosts from ArcSight Management Center.  Move: Moves the selected hosts to a new location.  Update Agent: Updates the ArcSight Management Center Agent on an appliance host to the latest version. (If the Agent is not currently installed, this button will install the Agent.) For more information on managing hosts, see “Hosts” on page 49.
4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 41 The Containers Tab The Containers tab displays all containers associated with the item selected in the navigation tree. For example, if you selected a location in the tree, since locations include hosts, the Containers tab would display all containers associated with all hosts in the selected location. The Containers tab includes these buttons: The Containers tab includes the following columns:  Name: Name of the container.  Path: Path to the container.  Port: Port number through which the container is communicating.  Version: Software version of the container.  Status: Status of the container. Possible values for container status are:  Improper configuration: Initial default state.  Initializing connection: The connector has a resolvable URL, but ArcSight Management Center has not logged in to the connector yet.  Down: There was an exception trying execute the login command.  Unauthorized: The login command was executed, but login has failed.  Connecting: The login is in progress.  Connected: The login was successful.  Empty: Login successful, but the container doesn't have connectors.  Initialized: Login successful and the container has connectors.  Last Check: Date and time of last status check.  Action: Shows controls for executing container management tasks. These enable editing of containers, sending commands to containers, adding a new connector to a Scan Host Scans a host. (Shown when a host is selected in the navigation tree.) Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
4 Managing Nodes 42 HP ArcSight Management Center Administrator’s Guide Confidential container, running Logfu diagnostics, displaying a list of container certificates, deploying a container, starting the FlexConnector wizard, and starting the Diagnostics wizard. These controls are explained in detail in Chapter 5‚ Managing Containers‚ on page 68. These buttons enable operations on one or more selected containers:  Delete: Deletes the selected containers from ArcSight Management Center.  Properties: Set properties on selected containers.  Certificates: Manage certificates on selected containers.  FIPS: Enable or disable FIPS on selected containers.  Upgrade: Upgrades selected containers.  Credentials: Manage credentials on selected containers.  Logs: Manage logs on selected containers. For more information on managing containers, see Chapter 5‚ Managing Connectors‚ on page 78. The Connectors Tab The Connectors tab displays all software connectors associated with the item selected in the navigation tree. For example, if you selected a container in the navigation tree, the Connectors tab would show all connectors in the selected container. If the selected item in the navigation tree is a container, a toolbar enables connector and container management tasks, including adding a new connector, editing the container, sending container commands, running Logfu diagnostics, refreshing the list of connectors, displaying a list of container certificates, deploying a container, starting the FlexConnector wizard, and starting the Diagnostics wizard. For details of each of these tasks, see Chapter 5‚ Managing Connectors‚ on page 78. The Connectors tab includes these buttons: The Connectors tab includes the following columns:  Name: Name of the connector. Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 43  Path: Path to the connector.  Type: Type of connector.  EPS In: Events per second received by the connector.  EPS Out: Events per second sent by the connector to its destination.  Cache: Connector cache size.  Last Check: Date and time of the last status check.  Action: Shows a variety of controls for executing software connector management tasks. These enable sending a connector command, sharing a connector, and starting the FlexConnector edit wizard. These buttons enable operations on one or more selected connectors.  Delete: Deletes connectors from ArcSight Management Center.  Runtime Parameters: Change the runtime parameters on selected connectors.  Destinations: Sets the destinations of selected connectors.  Parameters: Sets the parameters of selected connectors. For more information on managing connectors, see Chapter 5‚ Managing Connectors‚ on page 78. The Connector Summary Tab To view a single connector in detail, click the connector in the navigation tree. The toolbar on the summary tab includes the following buttons: Tables below the toolbar show connector specifics, including basic connector data, parameters, and connector destinations. These tables include the following columns: Send Command Sends a command to the connector. Remove Connector Removes the connector. Logfu Run Logfu diagnostics on the connector. Share Shares the connector through ArcExchange.
4 Managing Nodes 44 HP ArcSight Management Center Administrator’s Guide Confidential Connector Data  Type: Type of connector.  Status: Connector status.  Input Events (SLC): Total number of events received by the connector since it was last checked (generally once per minute).  Input EPS (SLC): Events per second received by the connector since it was last checked (generally once per minute). Connector Parameters Click Connector Parameters to toggle display of this table. Connector Parameters includes:  Click to edit parameters.  Parameters: Parameters can include connector network port, IP address, and protocol, and other information.  Value: Parameter value. Table Parameters (WUC Connectors Only)  Domain Name: Connector domain name.  Host Name: Connector host name.  User Name: Connector user name.  Security Logs: Indicates whether security events are collected.  System Logs: Indicates whether system events are collected.  Application: Indicates whether application events are collected from the Common Application Event Log.  Custom Log Names: List of custom application log names, if any.  Microsoft OS Version: Microsoft operating system for the connector.  Locale: Connector locale. Destinations Click Destinations to toggle display of this table. The Destinations table includes:  Click to add additional destinations.  Name: Destination name.  Output Events (SLC): Total number of events output by the connector to the destination since it was last checked (generally once per minute).  Output EPS (SLC): Events per second output by the connector to the destination since it was last checked (generally once per minute).  Cached: Total number of events cached to be transmitted to the destination.  Type: Destination type.  Location: Location of the destination.  Device Location: Location of the device on which the destination is located.  Comment: Comments on the destination.  Parameters: Destination-specific parameters, such as IP address, port, and protocol.
4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 45  Action Buttons: Action buttons enable destination management tasks, such as editing the destination, removing the destination, editing the runtime parameters, adding a new failover destination, and sending destination commands. For more information on managing connectors, see Chapter 5‚ Managing Connectors‚ on page 78. The Connector Appliances Tab The Connector Appliances tab displays all hardware and Software Connector Appliances associated with the item selected in the navigation tree. For example, if you selected System in the navigation tree, the Connector Appliances tab would display all Connector Appliances in ArcSight Management Center; if you selected a Location, the tab would display all Connector Appliances in the selected location. The Connector Appliances tab includes the following buttons: The Connector Appliances tab includes the following columns:  Name: Name of the Connector Appliance.  Path: Path to the Connector Appliance.  Port: Port number through which the Connector Appliance is communicating.  Version: Software version of the Connector Appliance.  Status: Status of the Connector Appliance.  Last Check: Date and time of last status check.  Action: Shows a variety of controls for executing Connector Appliance management tasks, including rebooting, shutting down, and editing a configuration. This button enable operations on one or more selected Connector Appliances.  Set Configuration: Set the configuration of selected Connector Appliances. For more information on managing Connector Appliances in ArcSight Management Center, see Chapter 5‚ Managing Connector Appliances‚ on page 61. Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
4 Managing Nodes 46 HP ArcSight Management Center Administrator’s Guide Confidential The Loggers Tab The Loggers tab displays all hardware and Software Loggers associated with the item selected in the navigation tree. For example, if you selected System in the navigation tree, the Loggers tab would display all Loggers in ArcSight Management Center; while if you selected a Location, you would see all Loggers in that location. The Loggers tab includes the following buttons: The Loggers tab includes the following columns:  Name: Name of the Logger.  Path: Path to the Logger.  Port: Port number through which the Logger is communicating.  Version: Software version of the Logger.  Status: Status of the Logger.  Last Check: Date and time of last status check.  Action: Shows controls for executing Logger management tasks, including rebooting, shutting down, editing a configuration, and upgrading. This button enable operations on one or more selected Loggers.  Set Configuration: Set the configuration of selected Loggers. For more information on managing Logger Appliances in ArcSight Management Center, see Chapter 5‚ Managing Loggers‚ on page 64. The ArcMCs Tab The ArcMCs tab displays all Software ArcSight Management Centers and ArcSight Management Center Appliances associated with the item selected in the navigation tree. For example, if you selected System in the navigation tree, the ArcMCs tab would display Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 47 all managed ArcSight Management Centers; while if you selected a Location, you would see all Loggers in that location. The ArcMCs tab includes the following buttons: The ArcMCs tab includes the following columns:  Name: Name of the ArcSight Management Center.  Path: Path to the ArcSight Management Center.  Port: Port number through which the ArcSight Management Center is communicating.  Version: Software version of the ArcSight Management Center.  Status: Status of the ArcSight Management Center.  Last Check: Date and time of last status check.  Action: Shows controls for executing ArcMC management tasks, including rebooting, shutting down, and editing a configuration. This button enable operations on one or more selected ArcMCs.  Set Configuration: Set the configuration of the selected ArcMC. For more information on managing other ArcSight Management Centers in ArcSight Management Center, see Chapter 5‚ Managing Other ArcSight Management Centers‚ on page 63. Locations A location is a logical grouping of hosts. The grouping can be based on any criteria you choose, such as geographical placement or organizational ownership. Locations are a useful way to organize a set of hosts. For example, you could group all hosts in New York separately from hosts in San Francisco and assign them to locations named “New York” and “San Francisco”. Similarly, you could group hosts in a location named “Sales” and others in the location “Marketing”. A location can contain any number of hosts. For information on adding hosts to locations, see “About Adding a Host” on page 49. Adding a Location You can add any number of locations. To add a location: 1 Click Node Management. Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column. ArcSight Management Center includes one location by default (called Default) but you may add any number of others. The name of the Default location may be edited, if desired.
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide
ArcSight Management Center 2.0 Administrator's Guide

Recommended

ArcSight Management Center 2.2 Administrator's Guide.pdf
ArcSight Management Center 2.2 Administrator's Guide.pdfArcSight Management Center 2.2 Administrator's Guide.pdf
ArcSight Management Center 2.2 Administrator's Guide.pdfProtect724mouni
 
ArcSight Management Center 2.5 Administrator's Guide
ArcSight Management Center 2.5 Administrator's Guide ArcSight Management Center 2.5 Administrator's Guide
ArcSight Management Center 2.5 Administrator's Guide Protect724mouni
 
ArcSight Management Center 1.0 Administrator's Guide
ArcSight Management Center 1.0 Administrator's GuideArcSight Management Center 1.0 Administrator's Guide
ArcSight Management Center 1.0 Administrator's GuideProtect724mouni
 
ArcMC 2.6 Release Notes
ArcMC 2.6 Release NotesArcMC 2.6 Release Notes
ArcMC 2.6 Release NotesProtect724mouni
 
ArcSight Management Center 2.5 Release Notes
ArcSight Management Center 2.5 Release NotesArcSight Management Center 2.5 Release Notes
ArcSight Management Center 2.5 Release NotesProtect724mouni
 
ArcSight Management Center 2.0 Patch 2 Release Notes
ArcSight Management Center 2.0 Patch 2 Release NotesArcSight Management Center 2.0 Patch 2 Release Notes
ArcSight Management Center 2.0 Patch 2 Release NotesProtect724mouni
 
ArcSight Management Center 2.0 Release Notes
ArcSight Management Center 2.0 Release NotesArcSight Management Center 2.0 Release Notes
ArcSight Management Center 2.0 Release NotesProtect724mouni
 
ArcSight Management Center 2.2 P1 Release Notes.pdf
ArcSight Management Center 2.2 P1 Release Notes.pdfArcSight Management Center 2.2 P1 Release Notes.pdf
ArcSight Management Center 2.2 P1 Release Notes.pdfProtect724mouni
 

Recommended

ArcSight Management Center 2.2 Administrator's Guide.pdf
ArcSight Management Center 2.2 Administrator's Guide.pdfArcSight Management Center 2.2 Administrator's Guide.pdf
ArcSight Management Center 2.2 Administrator's Guide.pdfProtect724mouni
 
ArcSight Management Center 2.5 Administrator's Guide
ArcSight Management Center 2.5 Administrator's Guide ArcSight Management Center 2.5 Administrator's Guide
ArcSight Management Center 2.5 Administrator's Guide Protect724mouni
 
ArcSight Management Center 1.0 Administrator's Guide
ArcSight Management Center 1.0 Administrator's GuideArcSight Management Center 1.0 Administrator's Guide
ArcSight Management Center 1.0 Administrator's GuideProtect724mouni
 
ArcMC 2.6 Release Notes
ArcMC 2.6 Release NotesArcMC 2.6 Release Notes
ArcMC 2.6 Release NotesProtect724mouni
 
ArcSight Management Center 2.5 Release Notes
ArcSight Management Center 2.5 Release NotesArcSight Management Center 2.5 Release Notes
ArcSight Management Center 2.5 Release NotesProtect724mouni
 
ArcSight Management Center 2.0 Patch 2 Release Notes
ArcSight Management Center 2.0 Patch 2 Release NotesArcSight Management Center 2.0 Patch 2 Release Notes
ArcSight Management Center 2.0 Patch 2 Release NotesProtect724mouni
 
ArcSight Management Center 2.0 Release Notes
ArcSight Management Center 2.0 Release NotesArcSight Management Center 2.0 Release Notes
ArcSight Management Center 2.0 Release NotesProtect724mouni
 
ArcSight Management Center 2.2 P1 Release Notes.pdf
ArcSight Management Center 2.2 P1 Release Notes.pdfArcSight Management Center 2.2 P1 Release Notes.pdf
ArcSight Management Center 2.2 P1 Release Notes.pdfProtect724mouni
 
ArcSight Management Center 1.0 Release Notes
ArcSight Management Center 1.0 Release NotesArcSight Management Center 1.0 Release Notes
ArcSight Management Center 1.0 Release NotesProtect724mouni
 
ArcSight Management Center 2.2 Release Notes.pdf
ArcSight Management Center 2.2 Release Notes.pdfArcSight Management Center 2.2 Release Notes.pdf
ArcSight Management Center 2.2 Release Notes.pdfProtect724mouni
 
ArcSight Connector Appliance 6.4 Release Notes
ArcSight Connector Appliance 6.4 Release NotesArcSight Connector Appliance 6.4 Release Notes
ArcSight Connector Appliance 6.4 Release NotesProtect724tk
 
ArcSight Connector Appliance v6.2 Patch 1 Release Notes
ArcSight Connector Appliance v6.2 Patch 1 Release NotesArcSight Connector Appliance v6.2 Patch 1 Release Notes
ArcSight Connector Appliance v6.2 Patch 1 Release NotesProtect724tk
 
ArcSight Connector Appliance 6.4 Patch 1 Release Notes
ArcSight Connector Appliance 6.4 Patch 1 Release NotesArcSight Connector Appliance 6.4 Patch 1 Release Notes
ArcSight Connector Appliance 6.4 Patch 1 Release NotesProtect724tk
 
Upgrading50 sp1or50sp2tov5.2
Upgrading50 sp1or50sp2tov5.2Upgrading50 sp1or50sp2tov5.2
Upgrading50 sp1or50sp2tov5.2Protect724
 
Esm rel notes_6.0cp3
Esm rel notes_6.0cp3Esm rel notes_6.0cp3
Esm rel notes_6.0cp3Protect724v3
 
Upgrade Guide for ESM 6.8c
Upgrade Guide for ESM 6.8cUpgrade Guide for ESM 6.8c
Upgrade Guide for ESM 6.8cProtect724migration
 
ArcSight Management Center Migration Guide
ArcSight Management Center Migration GuideArcSight Management Center Migration Guide
ArcSight Management Center Migration GuideProtect724mouni
 
ArcSight Express Release Notes Version 3.0 featuring ESM + CORR-Engine
ArcSight Express Release Notes Version 3.0 featuring ESM + CORR-EngineArcSight Express Release Notes Version 3.0 featuring ESM + CORR-Engine
ArcSight Express Release Notes Version 3.0 featuring ESM + CORR-EngineProtect724
 
Installation Guide for ESM 6.8c
Installation Guide for ESM 6.8cInstallation Guide for ESM 6.8c
Installation Guide for ESM 6.8cProtect724migration
 
SYMC BE 15 Boot Camp Presentation
SYMC BE 15 Boot Camp PresentationSYMC BE 15 Boot Camp Presentation
SYMC BE 15 Boot Camp PresentationMohamed El Fishawy
 
Aruba VIA 2.0 User Guide
Aruba VIA 2.0 User GuideAruba VIA 2.0 User Guide
Aruba VIA 2.0 User GuideAruba, a Hewlett Packard Enterprise company
 
Esm rel notes_6.0cp2
Esm rel notes_6.0cp2Esm rel notes_6.0cp2
Esm rel notes_6.0cp2Protect724v3
 
Esm rel notes_6.0cp1
Esm rel notes_6.0cp1Esm rel notes_6.0cp1
Esm rel notes_6.0cp1Protect724v3
 
ESM 5.2 Patch 2 Release Notes
ESM 5.2 Patch 2 Release NotesESM 5.2 Patch 2 Release Notes
ESM 5.2 Patch 2 Release NotesProtect724
 
UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...
UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...
UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...Leighton Nelson
 
Intrusion Monitoring Standard Content Guide
Intrusion Monitoring Standard Content GuideIntrusion Monitoring Standard Content Guide
Intrusion Monitoring Standard Content GuideProtect724
 
Best Way to Prepare for Citrix CCA-V (1Y0-204) Certification Exam
Best Way to Prepare for Citrix CCA-V (1Y0-204) Certification ExamBest Way to Prepare for Citrix CCA-V (1Y0-204) Certification Exam
Best Way to Prepare for Citrix CCA-V (1Y0-204) Certification ExamAmaaira Johns
 
Esm rel notes_v5.2
Esm rel notes_v5.2Esm rel notes_v5.2
Esm rel notes_v5.2Protect724
 
Ivm new
Ivm newIvm new
Ivm newMohamed Kajamoideen
 
990-1805K-EN.pdf
990-1805K-EN.pdf990-1805K-EN.pdf
990-1805K-EN.pdfYogi27338
 

More Related Content

What's hot

ArcSight Management Center 1.0 Release Notes
ArcSight Management Center 1.0 Release NotesArcSight Management Center 1.0 Release Notes
ArcSight Management Center 1.0 Release NotesProtect724mouni
 
ArcSight Management Center 2.2 Release Notes.pdf
ArcSight Management Center 2.2 Release Notes.pdfArcSight Management Center 2.2 Release Notes.pdf
ArcSight Management Center 2.2 Release Notes.pdfProtect724mouni
 
ArcSight Connector Appliance 6.4 Release Notes
ArcSight Connector Appliance 6.4 Release NotesArcSight Connector Appliance 6.4 Release Notes
ArcSight Connector Appliance 6.4 Release NotesProtect724tk
 
ArcSight Connector Appliance v6.2 Patch 1 Release Notes
ArcSight Connector Appliance v6.2 Patch 1 Release NotesArcSight Connector Appliance v6.2 Patch 1 Release Notes
ArcSight Connector Appliance v6.2 Patch 1 Release NotesProtect724tk
 
ArcSight Connector Appliance 6.4 Patch 1 Release Notes
ArcSight Connector Appliance 6.4 Patch 1 Release NotesArcSight Connector Appliance 6.4 Patch 1 Release Notes
ArcSight Connector Appliance 6.4 Patch 1 Release NotesProtect724tk
 
Upgrading50 sp1or50sp2tov5.2
Upgrading50 sp1or50sp2tov5.2Upgrading50 sp1or50sp2tov5.2
Upgrading50 sp1or50sp2tov5.2Protect724
 
Esm rel notes_6.0cp3
Esm rel notes_6.0cp3Esm rel notes_6.0cp3
Esm rel notes_6.0cp3Protect724v3
 
ArcSight Management Center Migration Guide
ArcSight Management Center Migration GuideArcSight Management Center Migration Guide
ArcSight Management Center Migration GuideProtect724mouni
 
ArcSight Express Release Notes Version 3.0 featuring ESM + CORR-Engine
ArcSight Express Release Notes Version 3.0 featuring ESM + CORR-EngineArcSight Express Release Notes Version 3.0 featuring ESM + CORR-Engine
ArcSight Express Release Notes Version 3.0 featuring ESM + CORR-EngineProtect724
 
SYMC BE 15 Boot Camp Presentation
SYMC BE 15 Boot Camp PresentationSYMC BE 15 Boot Camp Presentation
SYMC BE 15 Boot Camp PresentationMohamed El Fishawy
 
Esm rel notes_6.0cp2
Esm rel notes_6.0cp2Esm rel notes_6.0cp2
Esm rel notes_6.0cp2Protect724v3
 
Esm rel notes_6.0cp1
Esm rel notes_6.0cp1Esm rel notes_6.0cp1
Esm rel notes_6.0cp1Protect724v3
 
ESM 5.2 Patch 2 Release Notes
ESM 5.2 Patch 2 Release NotesESM 5.2 Patch 2 Release Notes
ESM 5.2 Patch 2 Release NotesProtect724
 
UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...
UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...
UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...Leighton Nelson
 
Intrusion Monitoring Standard Content Guide
Intrusion Monitoring Standard Content GuideIntrusion Monitoring Standard Content Guide
Intrusion Monitoring Standard Content GuideProtect724
 
Best Way to Prepare for Citrix CCA-V (1Y0-204) Certification Exam
Best Way to Prepare for Citrix CCA-V (1Y0-204) Certification ExamBest Way to Prepare for Citrix CCA-V (1Y0-204) Certification Exam
Best Way to Prepare for Citrix CCA-V (1Y0-204) Certification ExamAmaaira Johns
 
Esm rel notes_v5.2
Esm rel notes_v5.2Esm rel notes_v5.2
Esm rel notes_v5.2Protect724
 

What's hot (20)

ArcSight Management Center 1.0 Release Notes
ArcSight Management Center 1.0 Release NotesArcSight Management Center 1.0 Release Notes
ArcSight Management Center 1.0 Release Notes
 
ArcSight Management Center 2.2 Release Notes.pdf
ArcSight Management Center 2.2 Release Notes.pdfArcSight Management Center 2.2 Release Notes.pdf
ArcSight Management Center 2.2 Release Notes.pdf
 
ArcSight Connector Appliance 6.4 Release Notes
ArcSight Connector Appliance 6.4 Release NotesArcSight Connector Appliance 6.4 Release Notes
ArcSight Connector Appliance 6.4 Release Notes
 
ArcSight Connector Appliance v6.2 Patch 1 Release Notes
ArcSight Connector Appliance v6.2 Patch 1 Release NotesArcSight Connector Appliance v6.2 Patch 1 Release Notes
ArcSight Connector Appliance v6.2 Patch 1 Release Notes
 
ArcSight Connector Appliance 6.4 Patch 1 Release Notes
ArcSight Connector Appliance 6.4 Patch 1 Release NotesArcSight Connector Appliance 6.4 Patch 1 Release Notes
ArcSight Connector Appliance 6.4 Patch 1 Release Notes
 
Upgrading50 sp1or50sp2tov5.2
Upgrading50 sp1or50sp2tov5.2Upgrading50 sp1or50sp2tov5.2
Upgrading50 sp1or50sp2tov5.2
 
Esm rel notes_6.0cp3
Esm rel notes_6.0cp3Esm rel notes_6.0cp3
Esm rel notes_6.0cp3
 
Upgrade Guide for ESM 6.8c
Upgrade Guide for ESM 6.8cUpgrade Guide for ESM 6.8c
Upgrade Guide for ESM 6.8c
 
ArcSight Management Center Migration Guide
ArcSight Management Center Migration GuideArcSight Management Center Migration Guide
ArcSight Management Center Migration Guide
 
ArcSight Express Release Notes Version 3.0 featuring ESM + CORR-Engine
ArcSight Express Release Notes Version 3.0 featuring ESM + CORR-EngineArcSight Express Release Notes Version 3.0 featuring ESM + CORR-Engine
ArcSight Express Release Notes Version 3.0 featuring ESM + CORR-Engine
 
Installation Guide for ESM 6.8c
Installation Guide for ESM 6.8cInstallation Guide for ESM 6.8c
Installation Guide for ESM 6.8c
 
SYMC BE 15 Boot Camp Presentation
SYMC BE 15 Boot Camp PresentationSYMC BE 15 Boot Camp Presentation
SYMC BE 15 Boot Camp Presentation
 
Aruba VIA 2.0 User Guide
Aruba VIA 2.0 User GuideAruba VIA 2.0 User Guide
Aruba VIA 2.0 User Guide
 
Esm rel notes_6.0cp2
Esm rel notes_6.0cp2Esm rel notes_6.0cp2
Esm rel notes_6.0cp2
 
Esm rel notes_6.0cp1
Esm rel notes_6.0cp1Esm rel notes_6.0cp1
Esm rel notes_6.0cp1
 
ESM 5.2 Patch 2 Release Notes
ESM 5.2 Patch 2 Release NotesESM 5.2 Patch 2 Release Notes
ESM 5.2 Patch 2 Release Notes
 
UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...
UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...
UPGRADING FROM ORACLE ENTERPRISE MANAGER 10G TO CLOUD CONTROL 12C WITH ZERO D...
 
Intrusion Monitoring Standard Content Guide
Intrusion Monitoring Standard Content GuideIntrusion Monitoring Standard Content Guide
Intrusion Monitoring Standard Content Guide
 
Best Way to Prepare for Citrix CCA-V (1Y0-204) Certification Exam
Best Way to Prepare for Citrix CCA-V (1Y0-204) Certification ExamBest Way to Prepare for Citrix CCA-V (1Y0-204) Certification Exam
Best Way to Prepare for Citrix CCA-V (1Y0-204) Certification Exam
 
Esm rel notes_v5.2
Esm rel notes_v5.2Esm rel notes_v5.2
Esm rel notes_v5.2
 

Similar to ArcSight Management Center 2.0 Administrator's Guide

990-1805K-EN.pdf
990-1805K-EN.pdf990-1805K-EN.pdf
990-1805K-EN.pdfYogi27338
 
ArcSight Command Center User's Guide for ESM 6.8c
ArcSight Command Center User's Guide for ESM 6.8cArcSight Command Center User's Guide for ESM 6.8c
ArcSight Command Center User's Guide for ESM 6.8cProtect724v3
 
Service desk release_enu
Service desk release_enuService desk release_enu
Service desk release_enugauravneo_007
 
Forwarding Connector Configuration Guide 7.0.7.7286
Forwarding Connector Configuration Guide 7.0.7.7286Forwarding Connector Configuration Guide 7.0.7.7286
Forwarding Connector Configuration Guide 7.0.7.7286Protect724gopi
 
ESM 6.5c SP1 Installation and Configuration Guide
ESM 6.5c SP1 Installation and Configuration GuideESM 6.5c SP1 Installation and Configuration Guide
ESM 6.5c SP1 Installation and Configuration GuideProtect724mouni
 
ESM 101 for ESM 6.0c
ESM 101 for ESM 6.0cESM 101 for ESM 6.0c
ESM 101 for ESM 6.0cProtect724
 
ESM 101 for ESM 6.0c
ESM 101 for ESM 6.0cESM 101 for ESM 6.0c
ESM 101 for ESM 6.0cProtect724
 
Reputation Security Monitor (RepSM) v1.01 Solution Guide for ArcSight Express...
Reputation Security Monitor (RepSM) v1.01 Solution Guide for ArcSight Express...Reputation Security Monitor (RepSM) v1.01 Solution Guide for ArcSight Express...
Reputation Security Monitor (RepSM) v1.01 Solution Guide for ArcSight Express...Protect724v2
 
Installation Guide for ESM 6.5c
Installation Guide for ESM 6.5c Installation Guide for ESM 6.5c
Installation Guide for ESM 6.5c Protect724manoj
 
Agm application virtualization_(app-v)_5.0
Agm application virtualization_(app-v)_5.0Agm application virtualization_(app-v)_5.0
Agm application virtualization_(app-v)_5.0Steve Xu
 
ArcSight Connector Appliance 6.4 Administrator's Guide
ArcSight Connector Appliance 6.4 Administrator's GuideArcSight Connector Appliance 6.4 Administrator's Guide
ArcSight Connector Appliance 6.4 Administrator's GuideProtect724tk
 
20him um001 -en-p
20him um001 -en-p20him um001 -en-p
20him um001 -en-pDuc Minh
 
Command Center User's Guide for ESM 6.5c
Command Center User's Guide for ESM 6.5c Command Center User's Guide for ESM 6.5c
Command Center User's Guide for ESM 6.5c Protect724manoj
 
Juniper netscreen 25
Juniper netscreen 25Juniper netscreen 25
Juniper netscreen 25rikvar
 
Microsoft Dynamics CRM - Plug in User Guide
Microsoft Dynamics CRM - Plug in User GuideMicrosoft Dynamics CRM - Plug in User Guide
Microsoft Dynamics CRM - Plug in User GuideMicrosoft Private Cloud
 

Similar to ArcSight Management Center 2.0 Administrator's Guide (20)

Ivm new
Ivm newIvm new
Ivm new
 
990-1805K-EN.pdf
990-1805K-EN.pdf990-1805K-EN.pdf
990-1805K-EN.pdf
 
ArcSight Command Center User's Guide for ESM 6.8c
ArcSight Command Center User's Guide for ESM 6.8cArcSight Command Center User's Guide for ESM 6.8c
ArcSight Command Center User's Guide for ESM 6.8c
 
Service desk release_enu
Service desk release_enuService desk release_enu
Service desk release_enu
 
Forwarding Connector Configuration Guide 7.0.7.7286
Forwarding Connector Configuration Guide 7.0.7.7286Forwarding Connector Configuration Guide 7.0.7.7286
Forwarding Connector Configuration Guide 7.0.7.7286
 
ESM 6.5c SP1 Installation and Configuration Guide
ESM 6.5c SP1 Installation and Configuration GuideESM 6.5c SP1 Installation and Configuration Guide
ESM 6.5c SP1 Installation and Configuration Guide
 
456
456456
456
 
ESM 101 for ESM 6.0c
ESM 101 for ESM 6.0cESM 101 for ESM 6.0c
ESM 101 for ESM 6.0c
 
ESM 101 for ESM 6.0c
ESM 101 for ESM 6.0cESM 101 for ESM 6.0c
ESM 101 for ESM 6.0c
 
Reputation Security Monitor (RepSM) v1.01 Solution Guide for ArcSight Express...
Reputation Security Monitor (RepSM) v1.01 Solution Guide for ArcSight Express...Reputation Security Monitor (RepSM) v1.01 Solution Guide for ArcSight Express...
Reputation Security Monitor (RepSM) v1.01 Solution Guide for ArcSight Express...
 
Installation Guide for ESM 6.5c
Installation Guide for ESM 6.5c Installation Guide for ESM 6.5c
Installation Guide for ESM 6.5c
 
Hfm install
Hfm installHfm install
Hfm install
 
Agm application virtualization_(app-v)_5.0
Agm application virtualization_(app-v)_5.0Agm application virtualization_(app-v)_5.0
Agm application virtualization_(app-v)_5.0
 
ESM 101 for ESM 6.5c
ESM 101 for ESM 6.5c ESM 101 for ESM 6.5c
ESM 101 for ESM 6.5c
 
ArcSight Connector Appliance 6.4 Administrator's Guide
ArcSight Connector Appliance 6.4 Administrator's GuideArcSight Connector Appliance 6.4 Administrator's Guide
ArcSight Connector Appliance 6.4 Administrator's Guide
 
ESM_AdminGuide_5.6.pdf
ESM_AdminGuide_5.6.pdfESM_AdminGuide_5.6.pdf
ESM_AdminGuide_5.6.pdf
 
20him um001 -en-p
20him um001 -en-p20him um001 -en-p
20him um001 -en-p
 
Command Center User's Guide for ESM 6.5c
Command Center User's Guide for ESM 6.5c Command Center User's Guide for ESM 6.5c
Command Center User's Guide for ESM 6.5c
 
Juniper netscreen 25
Juniper netscreen 25Juniper netscreen 25
Juniper netscreen 25
 
Microsoft Dynamics CRM - Plug in User Guide
Microsoft Dynamics CRM - Plug in User GuideMicrosoft Dynamics CRM - Plug in User Guide
Microsoft Dynamics CRM - Plug in User Guide
 

More from Protect724mouni

ArcSight Management Center 2.1 Release Notes
ArcSight Management Center 2.1 Release NotesArcSight Management Center 2.1 Release Notes
ArcSight Management Center 2.1 Release NotesProtect724mouni
 
ArcSight Management Center Support Matrix
ArcSight Management Center Support MatrixArcSight Management Center Support Matrix
ArcSight Management Center Support MatrixProtect724mouni
 
ArcSight Management Center 2.2 P1 Administrator's Guide.pdf
ArcSight Management Center 2.2 P1 Administrator's Guide.pdfArcSight Management Center 2.2 P1 Administrator's Guide.pdf
ArcSight Management Center 2.2 P1 Administrator's Guide.pdfProtect724mouni
 
Getting Started with ArcSight Appliances
Getting Started with ArcSight AppliancesGetting Started with ArcSight Appliances
Getting Started with ArcSight AppliancesProtect724mouni
 
ArcMC 2.5.1 Release Notes
ArcMC 2.5.1 Release Notes ArcMC 2.5.1 Release Notes
ArcMC 2.5.1 Release Notes Protect724mouni
 
ArcMC for AWS 2.2 P1 Setup Guide
ArcMC for AWS 2.2 P1 Setup GuideArcMC for AWS 2.2 P1 Setup Guide
ArcMC for AWS 2.2 P1 Setup GuideProtect724mouni
 
ArcMC for Azure 2.2 Setup Guide
ArcMC for Azure 2.2 Setup GuideArcMC for Azure 2.2 Setup Guide
ArcMC for Azure 2.2 Setup GuideProtect724mouni
 
Getting Started with HPE Appliances
Getting Started with HPE AppliancesGetting Started with HPE Appliances
Getting Started with HPE AppliancesProtect724mouni
 
ESM 101 for ESM 6.5c SP1
ESM 101 for ESM 6.5c SP1ESM 101 for ESM 6.5c SP1
ESM 101 for ESM 6.5c SP1Protect724mouni
 
ESM 6.5c SP1 Administrator's Guide
ESM 6.5c SP1 Administrator's GuideESM 6.5c SP1 Administrator's Guide
ESM 6.5c SP1 Administrator's GuideProtect724mouni
 
ESM 6.5c SP1 ArcSight Web User's Guide
ESM 6.5c SP1 ArcSight Web User's GuideESM 6.5c SP1 ArcSight Web User's Guide
ESM 6.5c SP1 ArcSight Web User's GuideProtect724mouni
 
ESM 6.5c SP1 Command Center User's Guide
ESM 6.5c SP1 Command Center User's GuideESM 6.5c SP1 Command Center User's Guide
ESM 6.5c SP1 Command Center User's GuideProtect724mouni
 
Migrating ESM Resources From Oracle to CORR-Engine for ESM 6.5c SP1
Migrating ESM Resources From Oracle to CORR-Engine for ESM 6.5c SP1Migrating ESM Resources From Oracle to CORR-Engine for ESM 6.5c SP1
Migrating ESM Resources From Oracle to CORR-Engine for ESM 6.5c SP1Protect724mouni
 
ESM 6.5c SP1 Release Notes
ESM 6.5c SP1 Release NotesESM 6.5c SP1 Release Notes
ESM 6.5c SP1 Release NotesProtect724mouni
 
ESM 6.5c SP1 Upgrade Guide
ESM 6.5c SP1 Upgrade GuideESM 6.5c SP1 Upgrade Guide
ESM 6.5c SP1 Upgrade GuideProtect724mouni
 
Forwarding Connector 7.0.1.6992.0 User Guide for ESM 6.5c SP1
Forwarding Connector 7.0.1.6992.0 User Guide for ESM 6.5c SP1Forwarding Connector 7.0.1.6992.0 User Guide for ESM 6.5c SP1
Forwarding Connector 7.0.1.6992.0 User Guide for ESM 6.5c SP1Protect724mouni
 

More from Protect724mouni (16)

ArcSight Management Center 2.1 Release Notes
ArcSight Management Center 2.1 Release NotesArcSight Management Center 2.1 Release Notes
ArcSight Management Center 2.1 Release Notes
 
ArcSight Management Center Support Matrix
ArcSight Management Center Support MatrixArcSight Management Center Support Matrix
ArcSight Management Center Support Matrix
 
ArcSight Management Center 2.2 P1 Administrator's Guide.pdf
ArcSight Management Center 2.2 P1 Administrator's Guide.pdfArcSight Management Center 2.2 P1 Administrator's Guide.pdf
ArcSight Management Center 2.2 P1 Administrator's Guide.pdf
 
Getting Started with ArcSight Appliances
Getting Started with ArcSight AppliancesGetting Started with ArcSight Appliances
Getting Started with ArcSight Appliances
 
ArcMC 2.5.1 Release Notes
ArcMC 2.5.1 Release Notes ArcMC 2.5.1 Release Notes
ArcMC 2.5.1 Release Notes
 
ArcMC for AWS 2.2 P1 Setup Guide
ArcMC for AWS 2.2 P1 Setup GuideArcMC for AWS 2.2 P1 Setup Guide
ArcMC for AWS 2.2 P1 Setup Guide
 
ArcMC for Azure 2.2 Setup Guide
ArcMC for Azure 2.2 Setup GuideArcMC for Azure 2.2 Setup Guide
ArcMC for Azure 2.2 Setup Guide
 
Getting Started with HPE Appliances
Getting Started with HPE AppliancesGetting Started with HPE Appliances
Getting Started with HPE Appliances
 
ESM 101 for ESM 6.5c SP1
ESM 101 for ESM 6.5c SP1ESM 101 for ESM 6.5c SP1
ESM 101 for ESM 6.5c SP1
 
ESM 6.5c SP1 Administrator's Guide
ESM 6.5c SP1 Administrator's GuideESM 6.5c SP1 Administrator's Guide
ESM 6.5c SP1 Administrator's Guide
 
ESM 6.5c SP1 ArcSight Web User's Guide
ESM 6.5c SP1 ArcSight Web User's GuideESM 6.5c SP1 ArcSight Web User's Guide
ESM 6.5c SP1 ArcSight Web User's Guide
 
ESM 6.5c SP1 Command Center User's Guide
ESM 6.5c SP1 Command Center User's GuideESM 6.5c SP1 Command Center User's Guide
ESM 6.5c SP1 Command Center User's Guide
 
Migrating ESM Resources From Oracle to CORR-Engine for ESM 6.5c SP1
Migrating ESM Resources From Oracle to CORR-Engine for ESM 6.5c SP1Migrating ESM Resources From Oracle to CORR-Engine for ESM 6.5c SP1
Migrating ESM Resources From Oracle to CORR-Engine for ESM 6.5c SP1
 
ESM 6.5c SP1 Release Notes
ESM 6.5c SP1 Release NotesESM 6.5c SP1 Release Notes
ESM 6.5c SP1 Release Notes
 
ESM 6.5c SP1 Upgrade Guide
ESM 6.5c SP1 Upgrade GuideESM 6.5c SP1 Upgrade Guide
ESM 6.5c SP1 Upgrade Guide
 
Forwarding Connector 7.0.1.6992.0 User Guide for ESM 6.5c SP1
Forwarding Connector 7.0.1.6992.0 User Guide for ESM 6.5c SP1Forwarding Connector 7.0.1.6992.0 User Guide for ESM 6.5c SP1
Forwarding Connector 7.0.1.6992.0 User Guide for ESM 6.5c SP1
 

Recently uploaded

Building Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
Building Real-Time Data Pipelines: Stream & Batch Processing workshop SlideBuilding Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
Building Real-Time Data Pipelines: Stream & Batch Processing workshop SlideChristina Lin
 
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...MyIntelliSource, Inc.
 
Cloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStackCloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStackVICTOR MAESTRE RAMIREZ
 
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...Christina Lin
 
EY_Graph Database Powered Sustainability
EY_Graph Database Powered SustainabilityEY_Graph Database Powered Sustainability
EY_Graph Database Powered SustainabilityNeo4j
 
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdfThe Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdfkalichargn70th171
 
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...soniya singh
 
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...kellynguyen01
 
Optimizing AI for immediate response in Smart CCTV
Optimizing AI for immediate response in Smart CCTVOptimizing AI for immediate response in Smart CCTV
Optimizing AI for immediate response in Smart CCTVshikhaohhpro
 
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed DataAlluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed DataAlluxio, Inc.
 
Building a General PDE Solving Framework with Symbolic-Numeric Scientific Mac...
Building a General PDE Solving Framework with Symbolic-Numeric Scientific Mac...Building a General PDE Solving Framework with Symbolic-Numeric Scientific Mac...
Building a General PDE Solving Framework with Symbolic-Numeric Scientific Mac...stazi3110
 
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer DataAdobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer DataBradBedford3
 
why an Opensea Clone Script might be your perfect match.pdf
why an Opensea Clone Script might be your perfect match.pdfwhy an Opensea Clone Script might be your perfect match.pdf
why an Opensea Clone Script might be your perfect match.pdfjoe51371421
 
Hand gesture recognition PROJECT PPT.pptx
Hand gesture recognition PROJECT PPT.pptxHand gesture recognition PROJECT PPT.pptx
Hand gesture recognition PROJECT PPT.pptxbodapatigopi8531
 
A Secure and Reliable Document Management System is Essential.docx
A Secure and Reliable Document Management System is Essential.docxA Secure and Reliable Document Management System is Essential.docx
A Secure and Reliable Document Management System is Essential.docxComplianceQuest1
 
Steps To Getting Up And Running Quickly With MyTimeClock Employee Scheduling ...
Steps To Getting Up And Running Quickly With MyTimeClock Employee Scheduling ...Steps To Getting Up And Running Quickly With MyTimeClock Employee Scheduling ...
Steps To Getting Up And Running Quickly With MyTimeClock Employee Scheduling ...MyIntelliSource, Inc.
 
Engage Usergroup 2024 - The Good The Bad_The Ugly
Engage Usergroup 2024 - The Good The Bad_The UglyEngage Usergroup 2024 - The Good The Bad_The Ugly
Engage Usergroup 2024 - The Good The Bad_The UglyFrank van der Linden
 
Unveiling the Tech Salsa of LAMs with Janus in Real-Time Applications
Unveiling the Tech Salsa of LAMs with Janus in Real-Time ApplicationsUnveiling the Tech Salsa of LAMs with Janus in Real-Time Applications
Unveiling the Tech Salsa of LAMs with Janus in Real-Time ApplicationsAlberto González Trastoy
 
5 Signs You Need a Fashion PLM Software.pdf
5 Signs You Need a Fashion PLM Software.pdf5 Signs You Need a Fashion PLM Software.pdf
5 Signs You Need a Fashion PLM Software.pdfWave PLM
 

Recently uploaded (20)

Building Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
Building Real-Time Data Pipelines: Stream & Batch Processing workshop SlideBuilding Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
Building Real-Time Data Pipelines: Stream & Batch Processing workshop Slide
 
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
 
Cloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStackCloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStack
 
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
ODSC - Batch to Stream workshop - integration of Apache Spark, Cassandra, Pos...
 
EY_Graph Database Powered Sustainability
EY_Graph Database Powered SustainabilityEY_Graph Database Powered Sustainability
EY_Graph Database Powered Sustainability
 
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdfThe Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
 
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
Russian Call Girls in Karol Bagh Aasnvi ➡️ 8264348440 💋📞 Independent Escort S...
 
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
 
Optimizing AI for immediate response in Smart CCTV
Optimizing AI for immediate response in Smart CCTVOptimizing AI for immediate response in Smart CCTV
Optimizing AI for immediate response in Smart CCTV
 
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed DataAlluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data
 
Building a General PDE Solving Framework with Symbolic-Numeric Scientific Mac...
Building a General PDE Solving Framework with Symbolic-Numeric Scientific Mac...Building a General PDE Solving Framework with Symbolic-Numeric Scientific Mac...
Building a General PDE Solving Framework with Symbolic-Numeric Scientific Mac...
 
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer DataAdobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
Adobe Marketo Engage Deep Dives: Using Webhooks to Transfer Data
 
why an Opensea Clone Script might be your perfect match.pdf
why an Opensea Clone Script might be your perfect match.pdfwhy an Opensea Clone Script might be your perfect match.pdf
why an Opensea Clone Script might be your perfect match.pdf
 
Hand gesture recognition PROJECT PPT.pptx
Hand gesture recognition PROJECT PPT.pptxHand gesture recognition PROJECT PPT.pptx
Hand gesture recognition PROJECT PPT.pptx
 
A Secure and Reliable Document Management System is Essential.docx
A Secure and Reliable Document Management System is Essential.docxA Secure and Reliable Document Management System is Essential.docx
A Secure and Reliable Document Management System is Essential.docx
 
Steps To Getting Up And Running Quickly With MyTimeClock Employee Scheduling ...
Steps To Getting Up And Running Quickly With MyTimeClock Employee Scheduling ...Steps To Getting Up And Running Quickly With MyTimeClock Employee Scheduling ...
Steps To Getting Up And Running Quickly With MyTimeClock Employee Scheduling ...
 
Engage Usergroup 2024 - The Good The Bad_The Ugly
Engage Usergroup 2024 - The Good The Bad_The UglyEngage Usergroup 2024 - The Good The Bad_The Ugly
Engage Usergroup 2024 - The Good The Bad_The Ugly
 
Unveiling the Tech Salsa of LAMs with Janus in Real-Time Applications
Unveiling the Tech Salsa of LAMs with Janus in Real-Time ApplicationsUnveiling the Tech Salsa of LAMs with Janus in Real-Time Applications
Unveiling the Tech Salsa of LAMs with Janus in Real-Time Applications
 
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
 
5 Signs You Need a Fashion PLM Software.pdf
5 Signs You Need a Fashion PLM Software.pdf5 Signs You Need a Fashion PLM Software.pdf
5 Signs You Need a Fashion PLM Software.pdf
 

ArcSight Management Center 2.0 Administrator's Guide

  • 1. Administrator’s Guide HP ArcSight Management Center 2.0 June 10, 2015
  • 2. Copyright © 2015 Hewlett-Packard Development Company, L.P. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Follow this link to see a complete statement of copyrights and acknowledgements: http://www.hpenterprisesecurity.com/copyright Contact Info Revision History Phone A list of phone numbers is available on the HP ArcSight Technical Support page: http://www8.hp.com/us/en/software- solutions/software.html?compURI=1345981#.URitMaVwpWI Support Web Site http://support.openview.hp.com Protect 724 Community https://protect724.hp.com Date Revision 6/10/2015 Added section on remote connector management 1/21/2015 Added information about header line for host CSV import file. 7/22/2014 Revised document. 5/2/2014 2.0 GA release. 8/9/2013 1.0 GA release
  • 3. Confidential HP ArcSight Management Center Administrator’s Guide 3 Contents Chapter 1: HP ArcSight Management Center Overview ..................................................... 13 New Features and Enhancements .............................................................................. 13 Chapter 2: Software Installation ....................................................................................... 15 Overview ..................................................................................................................... 15 Installing ArcSight Management Center ............................................................................ 16 Prerequisites for Installation ..................................................................................... 16 Installation Steps .................................................................................................... 16 GUI Mode Installation ........................................................................................ 16 Console Mode Installation .................................................................................. 19 Silent Mode Installation ..................................................................................... 21 Enabling/Disabling ArcSight Management Center as a System Service ............................ 23 ArcSight Management Center Operations .......................................................................... 24 Connecting to the ArcSight Management Center User Interface ..................................... 24 ArcSight Management Center Processes ..................................................................... 24 The ArcSight Management Center Daemon (arcmcd) .................................................... 24 Uninstalling Software ArcSight Management Center ..................................................... 25 Uninstalling in GUI Mode .................................................................................... 25 Uninstalling in Console Mode .............................................................................. 26 Uninstalling in Silent Mode ................................................................................. 26 Upgrading to Software ArcMC 2.0 .................................................................................... 26 Migrating from Connector Appliance ................................................................................. 26 Installing the ArcSight Management Center Agent ............................................................. 27 Manual Installation Procedure ................................................................................... 27 ArcSight Management Center Agent Operations ................................................................. 28 Uninstalling the ArcSight Management Center Agent .................................................... 28 Chapter 3: The User Interface ........................................................................................... 31 Overview ..................................................................................................................... 31 The Menu Bar ............................................................................................................... 31 Home .................................................................................................................... 32 Node Management .................................................................................................. 32 Configuration Management ....................................................................................... 33 Administration ........................................................................................................ 33
  • 4. 4 HP ArcSight Management Center Administrator’s Guide Confidential Help ...................................................................................................................... 33 About .................................................................................................................... 33 Logout ................................................................................................................... 34 Chapter 4: Managing Nodes .............................................................................................. 35 Overview ..................................................................................................................... 35 Node Management ........................................................................................................ 36 The Navigation Tree ...................................................................................................... 36 The Management Panel .................................................................................................. 37 Management Tabs ................................................................................................... 37 Tab Controls .................................................................................................... 38 The Locations Tab ............................................................................................. 38 The Hosts Tab .................................................................................................. 39 The Containers Tab ........................................................................................... 41 The Connectors Tab .......................................................................................... 42 The Connector Summary Tab ............................................................................. 43 The Connector Appliances Tab ............................................................................ 45 The Loggers Tab ............................................................................................... 46 The ArcMCs Tab ................................................................................................ 46 Locations ..................................................................................................................... 47 Adding a Location ................................................................................................... 47 Editing a Location ................................................................................................... 48 Viewing All Locations ............................................................................................... 48 Deleting a Location ................................................................................................. 48 Hosts .......................................................................................................................... 49 About Adding a Host ................................................................................................ 49 Prerequisites for Adding a Host ........................................................................... 49 Node Authentication Credentials ......................................................................... 51 Adding a Host ......................................................................................................... 52 Importing Hosts ...................................................................................................... 53 Prerequisites for Importing Hosts ........................................................................ 53 CSV File Format ................................................................................................ 53 Import Hosts Procedure ..................................................................................... 55 Exporting Hosts ...................................................................................................... 56 Viewing All Hosts .................................................................................................... 57 Viewing Managed Nodes on a Host ............................................................................ 57 Deleting a Host ....................................................................................................... 57 Moving a Host to a Different Location ........................................................................ 57 Upgrading or Installing the ArcMC Agent on an Appliance Host ...................................... 58 Scanning a Host ...................................................................................................... 58 The Scan Process .............................................................................................. 59 Downloading and Importing Host Certificates .............................................................. 59
  • 5. Confidential HP ArcSight Management Center Administrator’s Guide 5 Chapter 5: Managing HP ArcSight Products ....................................................................... 61 Overview ..................................................................................................................... 61 Managing Connector Appliances ...................................................................................... 61 Rebooting .............................................................................................................. 62 Shutting Down ........................................................................................................ 62 Editing or Removing a Configuration .......................................................................... 62 Setting a Configuration on Connector Appliances ......................................................... 63 Managing Other ArcSight Management Centers ................................................................. 63 Rebooting .............................................................................................................. 64 Shutting Down ........................................................................................................ 64 Editing or Removing a Configuration .......................................................................... 64 Setting a Configuration on Managed ArcSight Management Centers ............................... 65 Managing Loggers ......................................................................................................... 66 Rebooting .............................................................................................................. 66 Shutting Down ........................................................................................................ 66 Editing or Removing a Configuration .......................................................................... 67 Upgrading a Logger Appliance ................................................................................... 67 Setting a Configuration on Loggers ............................................................................ 68 Managing Containers ..................................................................................................... 68 Viewing All Containers ............................................................................................. 69 Viewing Connectors in a Container ............................................................................ 69 Editing a Container .................................................................................................. 70 Deleting a Container ................................................................................................ 70 Updating Container Properties .................................................................................. 70 Changing Container Credentials ................................................................................ 71 Sending a Command to a Container ........................................................................... 71 Upgrading a Container to a Specific Connector Version ................................................. 71 Viewing Container Logs ............................................................................................ 72 Deleting a Container Log .......................................................................................... 72 Adding a Connector to a Container ............................................................................ 73 Running Logfu on a Container ................................................................................... 73 Managing Certificates on a Container ......................................................................... 73 Adding CA Certificates to a Container .................................................................. 74 Removing CA Certificates from a Container ........................................................... 74 Adding a CA Certs File to a Container .................................................................. 75 Enabling or Disabling a Demo Certificate on a Container ......................................... 76 Adding Multiple Destination Certificates to a Container ........................................... 76 Viewing Certificates on a Container ..................................................................... 77 Resolving Invalid Certificate Errors ...................................................................... 77 Running Diagnostics on a Container ........................................................................... 77 Managing Connectors ..................................................................................................... 78 Viewing All Connectors ............................................................................................. 78 Adding a Connector ................................................................................................. 79
  • 6. 6 HP ArcSight Management Center Administrator’s Guide Confidential Prerequisites .................................................................................................... 79 Editing Connector Parameters ................................................................................... 81 Updating Simple Parameters for a Connector ........................................................ 81 Updating Table Parameters for a Connector .......................................................... 81 Updating Simple and Table Parameters for Multiple Connectors ............................... 82 Managing Destinations ............................................................................................. 83 Adding a Primary Destination to a Connector ........................................................ 83 Adding a Failover Destination to a Connector ........................................................ 84 Adding a Primary or Failover Destination to Multiple Connectors .............................. 85 Removing Destinations ...................................................................................... 85 Re-Registering Destinations ............................................................................... 86 Editing Destination Parameters ........................................................................... 86 Editing Destination Runtime Parameters .............................................................. 87 Managing Alternate Configurations ...................................................................... 88 Sending a Command to a Destination .................................................................. 89 Deleting a Connector ............................................................................................... 89 Sending a Command to a Connector .......................................................................... 90 Running Logfu on a Connector .................................................................................. 90 Changing the Network Interface Address for Events ..................................................... 91 Developing FlexConnectors ....................................................................................... 91 Editing FlexConnectors ............................................................................................ 93 Sharing Connectors in ArcExchange ........................................................................... 93 Packaging and Uploading Connectors ................................................................... 94 Downloading Connectors .................................................................................... 96 Configuration Suggestions for Connector Types ........................................................... 97 Included FlexConnectors .......................................................................................... 98 Configuring the Check Point OPSEC NG Connector ....................................................... 98 Adding the MS SQL Server JDBC Driver .....................................................................100 Adding the MySQL JDBC Driver ................................................................................101 Chapter 6: Managing Configurations ............................................................................... 103 Overview ....................................................................................................................103 Configuration Types ...............................................................................................104 Configuration Management ............................................................................................105 The Configurations Table .........................................................................................105 The Details Tab ...............................................................................................106 The Subscribers Tab .........................................................................................108 Creating a Configuration .........................................................................................109 Editing a Configuration ...........................................................................................110 Deleting a Configuration .........................................................................................110 Importing a Configuration .......................................................................................110 Managing Subscribers ...................................................................................................112 Adding a Subscriber ...............................................................................................112
  • 7. Confidential HP ArcSight Management Center Administrator’s Guide 7 Unsubscribing a Subscriber .....................................................................................112 Pushing a Configuration ................................................................................................113 Push Validation ......................................................................................................113 Common Causes for Push Failure .............................................................................113 Push Remediation ..................................................................................................114 Pushing a Configuration to a Product Managed By Another ArcMC .................................114 Checking Compliance ....................................................................................................114 Configuration Management Best Practices ........................................................................115 Configuration Types ......................................................................................................116 Connector Configuration Types ................................................................................117 BlueCoat Connector Configuration ......................................................................117 FIPS Configuration ...........................................................................................118 Map File Configuration ......................................................................................118 Parser Override Configuration ............................................................................118 Syslog Connector Configuration .........................................................................119 Windows Unified Connector (WUC) External Parameters Configuration ....................119 Limitations to WUC External Parameters Configurations ........................................119 Windows Unified Connector (WUC) Internal Parameters Configuration .....................121 Limitations to WUC Internal Parameters Configurations .........................................121 Connector Appliance/ArcMC Configuration Types ........................................................122 Connector Appliance/ArcMC Configuration Backup Configuration .............................122 Logger Configuration Types .....................................................................................124 Logger Configuration Backup Configuration .........................................................124 Logger Filter Configuration ................................................................................125 Logger SmartMessage Receiver Configuration ......................................................125 Logger Storage Group Configuration ...................................................................125 Logger Transport Receiver Configuration .............................................................126 System Admin Configuration Types ..........................................................................128 Authentication External .....................................................................................128 Authentication Local Password ...........................................................................129 Authentication Session .....................................................................................130 DNS Configuration ...........................................................................................130 Network Configuration ......................................................................................130 NTP Configuration ............................................................................................131 SMTP Configuration ..........................................................................................131 SNMP Configuration .........................................................................................131 Users Configuration ..........................................................................................131 Chapter 7: Monitoring ..................................................................................................... 133 Overview ....................................................................................................................133 ArcSight Management Center Monitoring .........................................................................133 The Monitoring Summary ........................................................................................133 Performance Summary .....................................................................................134
  • 8. 8 HP ArcSight Management Center Administrator’s Guide Confidential Pie Graphs ......................................................................................................134 Drilling Down ........................................................................................................135 Configuring Breach Rules ..............................................................................................137 Creating Rules .......................................................................................................139 Rule Verification ..............................................................................................140 Rules Examples .....................................................................................................140 Configuring Email Notifications .......................................................................................141 Example Email Notification ................................................................................141 Chapter 8: Managing Backups and Restores .................................................................... 143 Overview ....................................................................................................................143 Backup .......................................................................................................................143 Restore .......................................................................................................................144 Chapter 9: Creating Snapshots ........................................................................................ 147 Overview ....................................................................................................................147 Creating a Snapshot .....................................................................................................147 Chapter 10: Managing Repositories ................................................................................ 149 Overview ....................................................................................................................149 Logs Repository ...........................................................................................................150 Uploading a File to the Logs Repository .....................................................................150 CA Certs Repository ......................................................................................................150 Uploading CA Certificates to the Repository ...............................................................150 Removing CA Certificates from the Repository ............................................................151 Upgrade AUP/ENC Repository .......................................................................................151 About the AUP Upgrade Process ...............................................................................151 Uploading an AUP Upgrade File to the Repository .......................................................152 Removing a Connector Upgrade from the Repository ...................................................152 Content AUP Repository ................................................................................................152 Applying a New Content AUP ...................................................................................153 Applying an Older Content AUP ................................................................................153 User-Defined Repositories .............................................................................................154 Creating a User-Defined Repository ..........................................................................154 Retrieving Container Files ........................................................................................155 Uploading Files to a Repository ................................................................................156 Deleting a Repository .............................................................................................156 Updating Repository Settings ...................................................................................157 Managing Files in a Repository .................................................................................157 Retrieving a File from the Repository ..................................................................157 Uploading a File from the Repository ..................................................................157 Pre-Defined Repositories ...............................................................................................158 Settings for Backup Files .........................................................................................158
  • 9. Confidential HP ArcSight Management Center Administrator’s Guide 9 Settings for Map Files .............................................................................................159 Settings for Parser Overrides ...................................................................................160 Settings for FlexConnector Files ...............................................................................160 Settings for Connector Properties .............................................................................161 Settings for JDBC Drivers ........................................................................................162 Cloning Container Configuration ...............................................................................162 Adding Parser Overrides ..........................................................................................163 Chapter 11: System Admin - ArcSight Management Center .......................................................................................... 165 System .......................................................................................................................165 System Reboot ......................................................................................................166 Network ................................................................................................................166 System DNS ....................................................................................................166 Hosts .............................................................................................................166 NICs ..............................................................................................................167 Static Routes ...................................................................................................168 Time/NTP .......................................................................................................169 SMTP ....................................................................................................................170 License & Update ...................................................................................................171 Updating the Appliance .....................................................................................171 Updating the License File ..................................................................................171 Process Status .......................................................................................................172 System Settings ....................................................................................................172 SNMP ...................................................................................................................172 Receiving System Health and Audit Events as SNMP Traps .....................................172 Polling System Health Information Using SNMP ....................................................173 Viewing Polled Information ................................................................................174 SNMP V3 ........................................................................................................177 SSH Access to the Appliance ....................................................................................178 Enabling or Disabling SSH Access .......................................................................178 Connecting to Your Appliance Using SSH .............................................................178 Diagnostic Tools .....................................................................................................179 Logs ...........................................................................................................................186 Audit Logs .............................................................................................................186 Configuring Audit Forwarding ...................................................................................187 For Software ArcSight Management Center ..........................................................187 For ArcSight Management Center Appliance .........................................................187 Configuring Audit Forwarding to a Specific Destination ................................................187 Storage ......................................................................................................................188 Remote File Systems ..............................................................................................188 Managing a Remote File System ........................................................................188 RAID Controller/Hard Disk SMART Data .....................................................................191 FTP ......................................................................................................................192
  • 10. 10 HP ArcSight Management Center Administrator’s Guide Confidential Models Supporting FTP .....................................................................................192 Enabling FTP .........................................................................................................192 Adding a Subdirectory ......................................................................................193 Processing Log Data Received via FTP .......................................................................194 Using FTPS (FTP over SSL) ......................................................................................194 Using FTPS with Blue Coat ProxySG ....................................................................194 Security ......................................................................................................................195 SSL Server Certificate .............................................................................................195 Generating a Self-Signed Certificate ...................................................................196 Generating a Certificate Signing Request (CSR) ...................................................197 Importing a Certificate .....................................................................................199 SSL Client Authentication ........................................................................................199 Uploading Trusted Certificates ...........................................................................200 Uploading a Certificate Revocation List ................................................................200 Enabling Client Certificate Authentication ............................................................200 FIPS 140-2 ............................................................................................................200 Users/Groups ..............................................................................................................201 Authentication .......................................................................................................201 Sessions .........................................................................................................201 Local Password ................................................................................................202 Users Exempted From Password Expiration .........................................................204 Forgot Password ..............................................................................................204 External Authentication ....................................................................................205 Login Banner .........................................................................................................210 User Management ..................................................................................................211 Users .............................................................................................................211 Groups ...........................................................................................................213 Change Password ...................................................................................................215 Appendix A: Audit Logs ................................................................................................... 217 Audit Event Types ........................................................................................................217 Audit Event Information ................................................................................................217 Application Events ........................................................................................................218 Platform Events ...........................................................................................................224 System Health Events ...................................................................................................227 SNMP Related Properties ...................................................................................228 Appendix B: Destination Runtime Parameters ................................................................. 231 Appendix C: Special Connector Configurations ................................................................ 239 Microsoft Windows Event Log - Unified Connectors ............................................................239 Change Parser Version by Updating Container Properties .............................................240 SSL Authentication .................................................................................................241 Database Connectors ....................................................................................................241
  • 11. Confidential HP ArcSight Management Center Administrator’s Guide 11 Add a JDBC Driver ........................................................................................................242 API Connectors ............................................................................................................243 File Connectors ............................................................................................................244 Syslog Connectors ........................................................................................................244 Appendix D: Restoring Factory Settings .......................................................................... 245 Overview ....................................................................................................................245 Factory Restore Using HP System Restore .......................................................................245 Factory Restore Using Acronis True Image .......................................................................247 Index ............................................................................................................................... 251
  • 12. 12 HP ArcSight Management Center Administrator’s Guide Confidential
  • 13. Confidential HP ArcSight Management Center Administrator’s Guide 13 Chapter 1 HP ArcSight Management Center Overview The following topic is discussed here. HP ArcSight Management Center (ArcMC) provides centralized management for Connector Appliances, Loggers, software connectors, and other ArcSight Management Centers, with a single panel view of all managed ArcSight products. New Features and Enhancements HP ArcSight Management Center 2.0 includes these new features and enhancements:  ArcSight Management Center Appliance: ArcSight Management Center is now available in a hardware form factor (ArcMC Appliance).  Management of Other ArcSight Management Centers: ArcSight Management Center can now manage other instances of ArcSight Management Center, enabling you to deploy and manage your ArcSight Management Centers hierarchically.  Configuration support for BlueCoat and WUC Connectors and Logger 5.5: Support has been added for configuration management of BlueCoat and WUC connectors as well as for Logger 5.5. “New Features and Enhancements” on page 13
  • 14. 1 HP ArcSight Management Center Overview 14 HP ArcSight Management Center Administrator’s Guide Confidential  Importing/Exporting Hosts: Add multiple hosts quickly and easily by importing them from a CSV file, and export hosts to a CSV file as well.  Enhanced Monitoring: Health monitoring of managed ArcSight products can be configured using a variety of criteria. You can create customized alerts for managed nodes.  Upgrade to ArcSight Management Center 2.0: Support is provided for upgrades from ArcSight Management Center 1.0 to ArcSight Management Center 2.0. The upgrade process is detailed in the ArcSight Management Center Release Notes.  Migration of Connector Appliance: Current installations of Connector Appliance can be migrated to ArcSight Management Center 2.0. For more information on supported versions of Connector Appliance, and for migration procedures, see the ArcSight Management Center 2.0 Migration Guide.  SNMP V3 and FIPS Support: Support has been added for SNMP version 3 as well as FIPS.  Simplified SSH Access: By default, you are not prompted for a challenge/response when remotely logging in to an ArcSight Management Center 2.0 appliance using SSH. (This represents a change from the configuration of Connector Appliance.)  As a result, it is imperative that you change the default password for the “root” account on an ArcSight Management Center appliance to a new, strong password.  For added security, it is strongly recommended that you enable SSH access only when necessary, such as for troubleshooting purposes.
  • 15. Confidential HP ArcSight Management Center Administrator’s Guide 15 Chapter 2 Software Installation This chapter describes how to install Software ArcSight Management Center and the ArcSight Management Center Agent. The following topics are discussed here. Overview The complete process of installing Software ArcSight Management Center includes these steps:  Select installation mode: Select a mode in which to install Software ArcSight Management Center on your selected machine. You can install Software ArcSight Management Center in these modes:  GUI: In GUI mode, a wizard steps you through the installation and configuration process. For detailed information, see “GUI Mode Installation” on page 17.  Console: In Console mode, a command-line process steps you through the installation and configuration process. See “Console Mode Installation” on page 20 for detailed instructions.  Silent: In Silent mode, the installation process is scripted. There is no need to interact with the installer, as you provide the installation and configuration input through a file. See “Silent Mode Installation” on page 21 for detailed instructions.  Install License: A valid license is required for Software ArcSight Management Center. A license file is uniquely generated for each download; therefore, you cannot use the same license file to install multiple instances of the product. To obtain the license, follow the instructions in the Electronic Delivery Receipt email received from HP after placing your order. “Overview” on page 15 “Installing ArcSight Management Center” on page 16 “ArcSight Management Center Operations” on page 24 “Installing the ArcSight Management Center Agent” on page 28 “ArcSight Management Center Agent Operations” on page 29 If you are using a Windows system to connect to the machine where Software ArcSight Management Center is to be installed, and prefer to install in GUI mode, you must connect using an X Window client, such as Xming for Windows.
  • 16. 2 Software Installation 16 HP ArcSight Management Center Administrator’s Guide Confidential  Start as a Service? If installation was performed as a root user, Software ArcSight Management Center can be configured to start as a system service. For more information, see “Enabling/Disabling ArcSight Management Center as a System Service” on page 24  Make Host Resolvable: For the Apache web process to start, the Software ArcSight Management Center hostname must be resolvable. Add the hostname to either /etc/hosts or DNS.  Secure Credentials: After initial setup is complete, connect to the application and change the default password to a secure password. To change the default password, follow the instructions in Chapter 11‚ Change Password‚ on page 214. Optionally, for additional security, rename the default admin username to a secure name. To change a username, follow the instructions in Chapter 11‚ User Management‚ on page 210. Additionally, if you plan to manage one or more Software ArcMCs, Software Connector Appliances or Software Loggers, you will need to install the ArcSight Management Center Agent on each. For more information on manual ArcSight Management Center Agent installation, see “Installing the ArcSight Management Center Agent” on page 28 Installing ArcSight Management Center The following section provides instructions to install Software ArcSight Management Center. Prerequisites for Installation Please note the following prerequisites before beginning the installation process.  File Descriptors 10240 or More: The host must support at least 10240 file descriptors. Perform ulimit -n on the host to determine the current level. If it does not equal at least 10240, open limits.conf and set these two parameters: * hard nolimit 10240 * soft nolimit 10240 Save the file and restart your session.  Unzip Package: An RPM capable of unzipping files needs to be installed on the CentOS or RedHat Linux system, and the unzip command path need to be set before installing Software ArcSight Management Center.  Non-Root Account: You can install ArcSight Management Center as a root or non- root user. However, when installing as a root user, a non-root user account is required in order to run some required processes.  When installing ArcSight Management Center as a root user, you can select the port on which it listens for secure web connections (HTTPS). When installing as a non-root user, the port must be configured to 9000. This value cannot be changed and must be externally accessible.  Technical Requirements: Refer to the ArcSight Management Center Release Notes, available from the HP ArcSight community, Protect724, for current information on supported platforms, supported browsers, and other technical requirements. Installation Steps This section describes Software ArcSight Management Center steps for each mode.
  • 17. 2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 17 GUI Mode Installation In GUI Mode installation, you use the installer wizard to install the application. To install Software ArcSight Management Center using the GUI mode: 1 Run these 2 commands from the directory where you copied the Software ArcSight Management Center installer:  chmod +x ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin  ./ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin where <installer_build_number>is the build number of the latest installer. The installation wizard starts. Review the dialog box, and then click Next. 2 Review the License Agreement details, and then scroll down to the end of the License Agreement details. Select I accept the terms of the License Agreement. Then, click Next [ 3 Specify or browse to a folder where you want to install ArcSight Management Center, as shown below. The default installation directory is /opt. However, you should specify a new installation directory in /opt that will easily identify ArcSight Management Center files, such as /opt/arcmc, to distinguish them from files associated with other HP ArcSight products.
  • 18. 2 Software Installation 18 HP ArcSight Management Center Administrator’s Guide Confidential 4 Review the summary of installation information on the Pre-Installation Summary dialog, and then click Install. The ArcSight Management Center installer begins the installation process. 5 When installation is complete, click Next to begin the configuration wizard.
  • 19. 2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 19 6 If you run the ArcSight Management Center software installer as a root user, the next dialog enables you to specify an existing non-root user and to configure a port through which ArcSight Management Center users will connect through the UI. For example, you can enter 443, the standard HTTPS port, or any other that suits your needs. If any port other than 443 is specified, users will need to enter the port number in the URL they use to access the ArcSight Management Center UI. Enter the user name of the non-root user and the HTTPS port number, and then click Next. (These values may not be changed later in the process.) 7 After the software is installed, click Next to begin ArcSight Management Center initialization. 8 After initialization is complete, click Done to launch the ArcSight Management Center Configuration wizard. 9 If you have run the ArcSight Management Center software installer as a root user, the next dialog enables you to configure ArcSight Management Center to run as a system service. By default, ArcSight Management Center runs as a standalone application, requiring a manual launch. When you install ArcSight Management Center as a root user, a service called arcsight_arcmc can be configured, created, and enabled at runlevel 3 and 5. Additionally, a few libraries are added using ldconfig. For a complete list of those libraries, see /etc/ld.so.conf.d/arcsight_arcmc.conf and <install_dir>/current/arcsight/install/ldconfig.out. 10 You have installed ArcSight Management Center. Click Start ArcSight Management Center Now, or click Start ArcSight Management Center later, and then click Finish. If you have selected to start ArcSight Management Center later, read the information in “The ArcSight Management Center Daemon (arcmcd)” on page 25 to understand how to start ArcSight Management Center at a later time. The Configuration wizard should launch automatically. If it does not, use this command to launch the wizard: <install_dir>/current/arcsight/arcmc/bin/arcsight arcmcsetup
  • 20. 2 Software Installation 20 HP ArcSight Management Center Administrator’s Guide Confidential 11 If you selected Start ArcSight Management Center Now, click Finish to exit the wizard. Alternatively, wait for the next dialog which provides the URL to access the ArcSight Management Center interface. ArcSight Management Center continues to start services and processes in the background. If you have selected to continue within the wizard, follow the instructions on the dialog or use the instructions in “Connecting to the ArcSight Management Center User Interface” on page 24 to connect to the ArcSight Management Center. Console Mode Installation In Console Mode installation, you use a command-line interface to install the application. To install Software ArcSight Management Center using the Console mode: 1 Run these commands from the directory where you copied the ArcSight Management Center software: chmod +x ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin ./ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin -i console where <installer_build_number>is the build number of the latest installer. The installation wizard starts in command-line mode, as shown below. Press Enter to continue. Introduction ------------ InstallAnywhere will guide you through the installation of ArcSight Management Center. It is strongly recommended that you quit all programs before continuing with this installation. Respond to each prompt to proceed to the next step in the installation. If you want to change something on a previous step, type 'back'. You may cancel this installation at any time by typing 'quit'. PRESS <ENTER> TO CONTINUE: 2 After the license information displays, press Enter until you see the following information: Select "I accept the terms of the License Agreement" below if you recognize that you have read the terms of this Agreement and attachments and agree to be bound by each of these terms. DO YOU ACCEPT THE TERMS OF THIS LICENSE AGREEMENT? (Y/N):Y 3 Go through the following prompts, from Choose Install Folder to Intervention Required, pressing Enter to continue through until the following confirmation appears: =============================================================== ================ Important Information
  • 21. 2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 21 --------------------- The installation of ArcSight Management Center software was successful. Configuration will begin after pressing [Enter]. PRESS <ENTER> TO CONTINUE: =============================================================== ================ Intervention Required --------------------- Values entered below may not be changed later in the process. Enter a non-root user account (DEFAULT: ): <non-root user> Enter an HTTPS port (default is 443) (DEFAULT: 443): =============================================================== ================ Important Information --------------------- The configuration of ArcSight Management Center software was successful. Initialization will begin after pressing [Enter]. This may take several minutes. PRESS <ENTER> TO CONTINUE: =============================================================== ================ Important Information --------------------- The initialization of ArcSight Management Center software was successful. The prompts that follow are the same as the ones described for the GUI mode install in “GUI Mode Installation” on page 17. Follow the instructions provided for the GUI mode install to complete the installation. Silent Mode Installation Silent mode enables scripting of the installation process. Before you install ArcSight Management Center in silent mode, create two properties files required for the silent mode installation: If ArcSight Management Center is installed in Console mode, it will be uninstalled in Console mode as well. See “Uninstalling in Console Mode” on page 26 for more information.
  • 22. 2 Software Installation 22 HP ArcSight Management Center Administrator’s Guide Confidential  A file to capture the installation properties  A file to capture the configuration properties After you have generated the two files, you need to merge them into one file and use the resulting file for silent mode installations. About Licenses for Silent Mode Installations As for any Software ArcSight Management Center installation, each silent mode installation requires a unique license file. Obtain licenses from HP Customer Support and install them on the machines on which you will be installing in silent mode, or ensure that the location where the license is placed is accessible from those machines. Generating the Silent Install Properties File This procedure generates the two properties files and then instructs you to combine them into one file. The resulting file is used for future silent installations. 1 Log in to the machine on which you wish to generate the installation properties file. If you want the silent mode installations to be done as root user, log in as root in this step. Otherwise, log in as a non-root user. 2 Run this command: ./ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin -r <directory_location> where <installer_build_number> is the build number of the installer file, and <directory_location> is the location of the directory where the generated properties file will be placed. This cannot be the same location where ArcSight Management Center is being installed. The properties file must be called installer.properties. 3 Install ArcSight Management Center in GUI mode, as described in “GUI Mode Installation” on page 17 until you arrive at step 10. At Step 10 of the installation procedure, do the following: a Click Previous instead of clicking Done to proceed further. b Then, click Cancel to stop the installation. 4 When the confirmation message appears, click Cancel. Click Quit to clear this message. 5 Navigate to the directory location you specified for the installer.properties file earlier. The following is an example of the generated installer.properties file. # Replay feature output # --------------------- # This file was built by the Replay feature of InstallAnywhere. # It contains variables that were set by Panels, Consoles or Custom Code. #Choose Install Folder
  • 23. 2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 23 #--------------------- USER_INSTALL_DIR=/opt/<arcmc_installation_folder>/<build number>/installdir #Install #------- -fileOverwrite_/opt/<arcmc_installation_folder>/<build number>/installdir/UninstallerData/Uninstall_ArcSight_Managemen t_Center_2.0.lax=Yes #Intervention Required #--------------------- USER_AND_PORT_1=username USER_AND_PORT_2=443 6 Start the configuration wizard with the option to record configuration properties: <install_dir>/current/arcsight/arcmc/bin/arcsight arcmcsetup -i recorderui When prompted to enter a file name to capture the configuration properties, enter a meaningful name; for example, config.properties, and then browse to choose the same directory as the installer.properties file. 7 Step through the configuration wizard, as described starting at Step 10 of “GUI Mode Installation” on page 17. 8 After the configuration properties file is generated, append the contents of this file to the installer.properties file generated in the previous procedure, Generating the Silent Install Properties File, to create a combined file. For example, you can use the cat command to concatenate both files: cat installer.properties config.properties > <combinedproperties.properties> 9 Include the following property in the combined file: ARCSIGHT_CONAPP_SETUP_PROPERTIES=<directory_location>/ <combined_properties_file> where <directory_location> is the path of the directory where the combined file is located, and <combined_properties_file> is the file name of the combined file you created earlier. Use the combined file for future ArcSight Management Center silent mode installations, as described in Installing Using the Generated Properties File below. Installing Using the Generated Properties File To install ArcSight Management Center using Silent mode, do the following. 1 Uninstall the previously installed version of ArcSight Management Center, as explained in “Uninstalling Software ArcSight Management Center” on page 26
  • 24. 2 Software Installation 24 HP ArcSight Management Center Administrator’s Guide Confidential 2 Make sure the machine on which you install ArcSight Management Center complies with the requirements listed in the HP ArcSight Management Center Release Notes, and the prerequisites listed in “Prerequisites for Installation” on page 16. 3 Copy the combined properties file you generated previously to the location where you have copied the ArcSight Management Center software. 4 Do one of the following:  Edit the licensePanel.path property in the silent mode properties file to include the location of the license file for this instance of the installation. (A unique license file is required for each instance of installation.), OR  Set the licensePanel.path property to point to a file, such as arcmc_license.zip. Then, for each instance of the silent mode installation, copy the relevant license file to the location and rename it to arcmc_license.zip. Doing so will avoid the need to update the combined properties file for each installation. 5 Run these 2 commands from the directory where you copied the ArcSight Management Center software:  chmod +x ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin  ./ArcSight-ArcMC-2.0.0.<installer_build_number>.0.bin -i silent -f <combined_properties_file> where <installer_build_number> is the build number of the installer file. The rest of the installation and configuration proceeds silently without requiring further input. Enabling/Disabling ArcSight Management Center as a System Service To enable or disable ArcSight Management Center as a system service: 1 On the menu bar, click Adminstration > System Admin. 2 In the navigation bar, click System Settings. 3 In the management panel, select Start as a Service to enable starting as a system service, or select Do not start as a service to disable. 4 Click Save. ArcSight Management Center Operations This section details the operation of ArcSight Management Center: how to connect, which processes run while ArcSight Management Center is active, and commands for using the ArcSight Management Center command-line utility (arcmcd). Connecting to the ArcSight Management Center User Interface Use this URL to connect to ArcSight Management Center: https://<hostname or IP address>:<configured_port>
  • 25. 2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 25 where hostname or IP address is the system on which you installed ArcSight Management Center. If ArcSight Management Center was installed as root and the default port was used, then <configured_port> is optional. To login for the first time, use the following default credentials: Username: admin Password: password For security, change the default credentials immediately after first logging in. For more information on changing credentials, see Chapter 11‚ Change Password‚ on page 214. ArcSight Management Center Processes After installation, the following processes run as part of ArcSight Management Center:  apache  aps  postgresql  web The ArcSight Management Center Daemon (arcmcd) The arcmcd utility enables a number of management and control tasks for the ArcSight Management Center software process, including starting, stopping and restarting. The syntax to run arcmcd is as follows: <install_dir>/current/arcsight/arcmc/bin/arcmcd <command> Where <install_dir> is the installation directory of ArcSight Management Center, and <command> is a command listed in Table 2-1. If ArcSight Management Center is installed to run as a system service, you can use arcmcd to manage a specific process. Process-specific commands are marked with an asterisk(*). Table 2-1 arcmcd Commands Command Description start Starts aps, apache, postgresql, and web processes. stop Stops aps, apache, postgresql, and web processes. restart Restarts aps, apache, postgresql, and web processes. status Displays the current status of all processes. quit Stops aps, apache, postgresql, and web processes, as well as the ArcSight Management Center application. start <process_name>* Starts the named process. For example, start apache.
  • 26. 2 Software Installation 26 HP ArcSight Management Center Administrator’s Guide Confidential Uninstalling Software ArcSight Management Center Uninstall ArcSight Management Center in the same user mode in which the installation was performed. For example, if you performed the installation as root, then you must perform the uninstallation as root Uninstalling in GUI Mode To uninstall Software ArcSight Management Center in GUI mode: 1 In the directory where you installed ArcSight Management Center, enter: <install_dir>/UninstallerData/Uninstall_ArcSight_Management_Center _2.0 2 The uninstall wizard starts. Click Uninstall to start uninstalling ArcSight Management Center and follow the prompts in the wizard. 3 After uninstalling, manually delete the /userdata directory. Uninstalling in Console Mode If you installed ArcSight Management Center in Console mode, then, by default, uninstallation occurs in Console mode. To uninstall in Console mode: 1 At the command line, enter: <install_dir>/UninstallerData/Uninstall_ArcSight_Management_Cen ter_2.0 2 After uninstalling, manually delete the /userdata directory. At the prompt, press Enter again to confirm uninstallation. The application will be uninstalled. Uninstalling in Silent Mode If you installed ArcSight Management Center in Silent mode, then, by default, uninstallation occurs in Silent mode. stop <process_name>* Stops the named process. For example, stop apache. restart <process_name>* Restarts the named process. For example, restart apache. If using GUI mode and uninstalling ArcSight Management Center software over an SSH connection, make sure that you have enabled X window forwarding using the -X option, so that you can view the screens of the uninstall wizard. If using PuTTY, you also need an X11 client on the machine from which you are connecting to the Linux machine. Table 2-1 arcmcd Commands Command Description
  • 27. 2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 27 To uninstall in Silent mode: 1 At the command line, enter: <install_dir>/UninstallerData/Uninstall_ArcSight_Management_Cen ter_2.0. The application will be uninstalled without further interaction. 2 After uninstalling, manually delete the /userdata directory. Upgrading to Software ArcMC 2.0 For instructions on upgrading ArcSight Management Center 1.0 to ArcSight Management Center 2.0, see the ArcSight Management Center 2.0 Release Notes. Migrating from Connector Appliance You can migrate the following to ArcSight Management Center 2.0:  Software Connector Appliance 6.4 Patch 3/6.4 Patch 3 Hotfix  Connector Appliance (hardware) 6.4 Patch 3 For instructions and details, see the ArcSight Management Center Migration Guide.
  • 28. 2 Software Installation 28 HP ArcSight Management Center Administrator’s Guide Confidential Installing the ArcSight Management Center Agent The ArcSight Management Center Agent runs on managed hosts and enables their management by ArcSight Management Center. Whether you need to install the ArcSight Management Center on a managed host depends on the host’s form factor. For Software Form Factors Before adding a managed software form factor (Software ArcSight Management Center, Software Connector Appliance, or Software Logger) as a host, you must first manually transfer the ArcSight Management Center Agent installer to the application host, and then run the installer. Completion of the installation will automatically start the Agent. You can then add the host to ArcSight Management Center. For more information, see “Manual Installation Procedure” on page 28. If a software ArcMC will be For Hardware Appliances When adding a hardware appliance (ArcSight Management Center Appliance, Connector Appliance or Logger Appliance) as a host, ArcSight Management Center automatically pushes the ArcSight Management Center Agent installer to the appliance, installs it, and then starts the service.The appliance is then ready to manage in ArcSight Management Center. You will not need to take any manual installation steps.. For Software Connectors Software connectors do not require the installation of the ArcSight Management Center Agent. Manual Installation Procedure You need to transfer, copy, or download the ArcSight Management Center Agent installer file to any Software ArcMC, Software Logger, or Software Connector Appliance you intend to add for management. (You can use any file transfer utility, such as FTP.) You must then manually run the Agent installer on the host and complete the installation. The ArcSight Management Center Agent and the managed application must both be installed using the same user mode. For example, if the Software Logger to be managed is installed as a root user, then the ArcSight Management Center Agent must also be installed as a root user. To manually install the ArcSight Management Center Agent: 1 In the directory to where you transferred the installer, run these 2 commands: An ArcMC used to manage products must have an Agent installed with the same version number as the ArcMC. For example, if your ArcMC 2.1 will be used to manage products, then the ArcMC Agent running on that ArcMC must also be version 2.1. An ArcMC used to manage products must have an Agent installed with the same version number as the ArcMC. For example, if your ArcMC 2.1 will be used to manage products, then the ArcMC Agent running on that ArcMC must also be version 2.1.
  • 29. 2 Software Installation Confidential HP ArcSight Management Center Administrator’s Guide 29  chmod +x ArcSight-ArcMCAgent- 2.0.0.<agent_installer_build_number>.0.bin  ./ArcSight-ArcMCAgent- 2.0.0.<agent_installer_build_number>.0.bin LAX_VM <install_dir>/current/local/jre/bin/java where <agent_installer_build_number>is the build number of the latest installer and <install_dir> is the installation directory of the software product. The installation wizard starts. Review the dialog box, and then click Next.The required installation path is the install directory (that is, the same directory where Software Connector Appliance or Software Logger is installed). 2 Follow the prompts to complete the installation. The Agent is automatically started upon completion of the installation process. ArcSight Management Center Agent Operations After installation, the arcmcagent process runs on the managed host. This process automatically starts after either automatic or manual installation. However, if the Agent stops for any reason, it can be manually started. To manually start, stop, or restart the Agent: 1 On the managed host’s GUI, click Setup > System Admin > Process status. 2 Select arcmcagent from the list of processes. 3 Click Start|Stop|Restart, as necessary. On Software ArcMC, Software Connector Appliance, or Software Logger To manually start or stop the Agent on Software ArcMC, Software Connector Appliance, or Software Logger: 1 Run <install_dir>/current/arcsight/<conapp|logger| arcmc>/bin/<conappd|loggerd|arcmcd> <start|stop> arcmcagent Agent Verification To verify that the Agent is running on a host, use one of the following procedures:  In the managed host’s GUI, click Setup > System Admin > Process Status. The ArcSight Management Center Agent (arcmcagent) will be shown as a process in the running state.  (For Software ArcMC, Software Connector Appliance, or Software Logger Only) After you install the Agent, run this command at the command line: <install_dir>/current/arcsight/<conapp|logger>/bin/<conappd|log gerd> status The Agent is shown as a service in the running state. Uninstalling the ArcSight Management Center Agent To uninstall the ArcSight Management Center Agent, run the following command:
  • 30. 2 Software Installation 30 HP ArcSight Management Center Administrator’s Guide Confidential <install_dir>/arcmcagent/UninstallerData/Uninstall_ArcSight_Manage ment_Center_Agent_2.0 The Uninstall Wizard will launch. Click Uninstall to begin the wizard. When the uninstallation completes, click Done. • Always stop and then uninstall any previous version of the ArcSight Management Center Agent before installing a new version. • If uninstalling either Software ArcMC, Software Logger or Software Connector Appliance, make sure that the ArcSight Management Center Agent is uninstalled from the node before beginning the uninstall of the managed product.
  • 31. Confidential HP ArcSight Management Center Administrator’s Guide 31 Chapter 3 The User Interface The following topics are discussed here. Overview This chapter provides a general overview of the ArcSight Management Center interface. ArcSight Management Center uses a browser-based user interface. Refer to the ArcSight Management Center Release Notes for the latest information on supported browsers. The Menu Bar The menu bar provides access to the main functional components of ArcSight Management Center. The menu bar includes the Home, Node Management, Configuration Management and Administration menus. “Overview” on page 31 “The Menu Bar” on page 31 “Logout” on page 34
  • 32. 3 The User Interface 32 HP ArcSight Management Center Administrator’s Guide Confidential Home The Home page displays information on all monitored products.  The management panel displays the Monitoring Summary table, showing all products which are currently reporting issues.  In addition, the aggregated health status for products of each type is displayed in pie graph format, showing total number of nodes, as well as the number corresponding to each status. A summary table shows the same data in percentage format.  The navigation panel enables you to display a monitoring summary for individual product types in the management panel. Click the product type to display the product’s monitoring summary. For more information on viewing and configuring monitoring, see Chapter 7‚ Monitoring‚ on page 133. Node Management Use Node Management to manage any of the following node types:  Software Connectors  Hardware or Software Connector Appliances  Hardware or Software Loggers  Hardware or Software ArcSight Management Centers
  • 33. 3 The User Interface Confidential HP ArcSight Management Center Administrator’s Guide 33 For more information on adding and managing nodes, see Chapter 4‚ Managing Nodes‚ on page 35. From the same menu, you can also perform selected management tasks on managed ArcSight products. See Chapter 5‚ Managing HP ArcSight Products‚ on page 61. Configuration Management Use Configuration Management to create and manage node configurations, and synchronization (pushing) of configurations across multiple nodes. You can manage any of these configuration types:  Logger configurations  System Admin configurations  Connector configurations  Connector Appliance  ArcSight Management Center configurations For more information on configuration management, see Chapter 6‚ Managing Configurations‚ on page 103. Administration The Administration menu contains these items:  Backup enables you to back up your current ArcSight Management Center configuration. Restore enables you to restore your configuration from a saved backup. For more information, see Chapter 8‚ Managing Backups and Restores‚ on page 143.  Snapshot enables you to take a snapshot image of HP ArcSight Management Center, to produce logs that are useful in troubleshooting. For more information, see Chapter 9‚ Creating Snapshots‚ on page 147.  Repositories enables you to manage repositories that store files, such as logs, certificates, and drivers. For more information, see Chapter 10‚ Managing Repositories‚ on page 149.  System Admin describes the system administration tools that enable you to create and manage users and user groups, and to configure security settings for your system. For more information, see Chapter 11‚ System Admin - ArcSight Management Center‚ on page 163. Help Click the Help link to display the online help, which explains the functionality and features of ArcSight Management Center. From the help landing page, you can navigate to or search for specific topics. About The Help > About screen displays the currently running version number of ArcSight Management Center. When done viewing, click OK.
  • 34. 3 The User Interface 34 HP ArcSight Management Center Administrator’s Guide Confidential Logout Click Logout to end your ArcSight Management Center session. By default, ArcSight Management Center automatically ends your session after 15 minutes of inactivity.
  • 35. Confidential HP ArcSight Management Center Administrator’s Guide 35 Chapter 4 Managing Nodes The following topics are discussed here. Overview A node is a networked HP ArcSight product that can be centrally managed using ArcSight Management Center. Each node is associated with a single networked host which has been assigned either a hostname, an IP address, or both. Node types can include any of the following HP ArcSight products:  Connector Appliances or Software Connector Appliances  Logger Appliances or Software Loggers  Containers or software connectors  Other ArcSight Management Centers A single host can include multiple nodes. For example, a single Connector Appliance (with a single IP address or hostname) could have multiple containers, each of which could be a separate node. In addition, a node can be in a parent or child relationship with other nodes. You can perform any of the following node management tasks:  View managed nodes by location, by host, or by node type.  Add, view, edit, and delete locations for hosts.  Add nodes from a host, import hosts from a CSV file, view and delete hosts, view all hosts in a location, move hosts to different locations, and scan hosts for new connectors or containers. “Overview” on page 35 “Node Management” on page 36 “The Navigation Tree” on page 36 “The Management Panel” on page 37 “Locations” on page 47 “Hosts” on page 49
  • 36. 4 Managing Nodes 36 HP ArcSight Management Center Administrator’s Guide Confidential Node Management To manage nodes, on the menu bar, click Node Management. The Node Management UI displays. The Node Management UI comprises two panels:  The left side displays the navigation tree.  The right side displays the management panel, enabling you to perform management operations on items selected in the navigation tree. The Navigation Tree The navigation tree organizes managed nodes into a hierarchy, and comprises the following: System: System displays the entire set of nodes managed by ArcSight Management Center. Location: Individual locations are displayed under System, listed in the order in which they were added. Locations are logical groupings you can use to organize a list of hosts. For more information, see “Locations” on page 47. Host: Each location branch shows all hosts assigned to that location, listed by hostname, in the order in which they were added. For more information, see “Hosts” on page 49.
  • 37. 4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 37 Nodes: Each host branch shows all managed nodes associated with that host. A node can be any of the following types: Connector Appliance or Software Connector Appliance: Each Connector Appliance or Software Connector Appliance is shown as a separate node. Logger Appliance or Software Logger: Each Logger Appliance or Software Logger is shown as a separate node. ArcSight Management Center: Each Software ArcSight Management Center or ArcSight Management Center Appliance is shown as a separate node. Container: If the host includes any containers, each is shown as a node. Connector: If a container node contains a connector, the connector is shown under the container node in which it is contained. Since items in the tree are organized hierarchically, each item in the tree includes all branches displayed below it. For example, a Location branch includes all hosts assigned to that location. Click + to expand any branch and view any items included in the branch. The Management Panel Select an item in the navigation tree to display its details on one of the tabs in the management panel. For example, to display the details of a host shown in the navigation tree, select the host in the tree. The management panel will display details and controls pertaining to that host. Management Tabs The tabs displayed in the management panel depend on the type of item selected in the navigation tree. The management tabs displayed will show detailed information associated with the selected item. To view the number of nodes associated with a host, hover over the host entry in the tree. The count shown includes the host itself. Selected Item Type Management Tabs Shown System Locations, Hosts, Containers, Connectors, Connector Appliances, Loggers, ArcMCs Location Hosts, Containers, Connectors, Connector Appliances, Loggers, ArcMCs Host Containers, Connectors, Connector Appliances, Loggers, ArcMCs
  • 38. 4 Managing Nodes 38 HP ArcSight Management Center Administrator’s Guide Confidential For example, if you selected a location item from the navigation tree, the Hosts, Containers, Connectors, Connector Appliances, Loggers and ArcMCs tabs would be shown. Each tab would display the items of the named type associated with the selected location, including details on those items. For example, the Hosts tab would show any hosts in the location, while the Connector Appliances tab would show any Connector Appliances in the same location. Tab Controls These controls are commonly displayed on all tabs in the management panel:  Toolbar Buttons: Toolbar buttons enable operations related to the items on the tab.  Items Table: Items corresponding to the tab header are displayed in a table. For example, locations are listed in tabular format on the Locations tab.  Table Header Check Box: Click the check box in the table header to toggle selection of all check boxes in a single column.  Bulk Operations Buttons: On most tabs, buttons beneath the items list enable you to perform operations on one or more items. Choose one or multiple items in the list by selecting the checkbox next to each, and then click the button to perform the indicated operation. For example, to delete multiple items such as hosts, select one or more hosts on the Hosts tab, and then click Delete. The selected hosts would be deleted. In addition, each tab may have controls individual to that item type. For example, the Connectors tab includes controls related to the management of connectors (see Chapter 5‚ Managing Connectors‚ on page 78). The Locations Tab The Locations tab displays all locations defined in ArcSight Management Center. The Locations tab includes these buttons: Node Connectors, Connector Appliances, Loggers, ArcMCs Add Location Adds a new location. Import Imports host information from a CSV file. For more information, see “Importing Hosts” on page 53 Export Exports host information to a CSV file. For more information, see “Exporting Hosts” on page 56 Selected Item Type Management Tabs Shown
  • 39. 4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 39 The Locations tab includes the following columns:  Name: Location name.  Number of Hosts: Number of hosts assigned to the location.  Action: Shows a control for editing a location. For more information on editing a location, see “Editing a Location” on page 48. This button enables operations on one or more selected locations:  Delete: Deletes the selected locations from ArcSight Management Center. For more information on managing locations, see “Locations” on page 47. The Hosts Tab The Hosts tab displays all hosts associated with the location selected in the navigation tree. The Hosts tab includes these buttons: The Hosts tab includes the following columns: Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column. Add Host Adds a host. Edit Edits a host. Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
  • 40. 4 Managing Nodes 40 HP ArcSight Management Center Administrator’s Guide Confidential  Hostname: Fully qualified domain name (FQDN) of the host. The hostname must match the hostname in the host’s SSL certificate.  Issues: Status of certificate or Arc MC Agent associated with the host. Possible indicators include:  None: No issues are associated with the host.  Host Certificate Mismatch: The hostname does not match the hostname in the SSL certificate. For instructions on downloading and importing certificates for the host, see “Downloading and Importing Host Certificates” on page 59.  Agent Out of Date: Indicates either that the host’s Agent version is not the same as the ArcSight Management Center, or that ArcSight Management Center 2.0 cannot communicate with ArcSight Management Center Agent 1.0. For instructions on remotly upgrading the Agent version on an appliance host, see “Upgrading or Installing the ArcMC Agent on an Appliance Host” on page 58.  Agent Stopped: The Agent process on the host has been stopped.  Agent Uninstalled: The Agent on the host has been uninstalled.  Path: Path to the host.  Type: Type of host. (On an ArcMC Appliance, the localhost is shown as Software.)  Model: If an appliance, shows the HP ArcSight model number of the appliance. If the host is not an appliance, the label Software is shown.  Version: Version number of the software on the host.  Agent Version: Version number of the ArcSight Management Center Agent running on the host.  Comment: Any comments on the host.  Action: Shows a control for scanning a host for new connectors. For more information on scanning a host, see Chapter 5‚ Managing Connectors‚ on page 78. These buttons enable operations on one or more selected hosts:  Delete: Deletes the selected hosts from ArcSight Management Center.  Move: Moves the selected hosts to a new location.  Update Agent: Updates the ArcSight Management Center Agent on an appliance host to the latest version. (If the Agent is not currently installed, this button will install the Agent.) For more information on managing hosts, see “Hosts” on page 49.
  • 41. 4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 41 The Containers Tab The Containers tab displays all containers associated with the item selected in the navigation tree. For example, if you selected a location in the tree, since locations include hosts, the Containers tab would display all containers associated with all hosts in the selected location. The Containers tab includes these buttons: The Containers tab includes the following columns:  Name: Name of the container.  Path: Path to the container.  Port: Port number through which the container is communicating.  Version: Software version of the container.  Status: Status of the container. Possible values for container status are:  Improper configuration: Initial default state.  Initializing connection: The connector has a resolvable URL, but ArcSight Management Center has not logged in to the connector yet.  Down: There was an exception trying execute the login command.  Unauthorized: The login command was executed, but login has failed.  Connecting: The login is in progress.  Connected: The login was successful.  Empty: Login successful, but the container doesn't have connectors.  Initialized: Login successful and the container has connectors.  Last Check: Date and time of last status check.  Action: Shows controls for executing container management tasks. These enable editing of containers, sending commands to containers, adding a new connector to a Scan Host Scans a host. (Shown when a host is selected in the navigation tree.) Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
  • 42. 4 Managing Nodes 42 HP ArcSight Management Center Administrator’s Guide Confidential container, running Logfu diagnostics, displaying a list of container certificates, deploying a container, starting the FlexConnector wizard, and starting the Diagnostics wizard. These controls are explained in detail in Chapter 5‚ Managing Containers‚ on page 68. These buttons enable operations on one or more selected containers:  Delete: Deletes the selected containers from ArcSight Management Center.  Properties: Set properties on selected containers.  Certificates: Manage certificates on selected containers.  FIPS: Enable or disable FIPS on selected containers.  Upgrade: Upgrades selected containers.  Credentials: Manage credentials on selected containers.  Logs: Manage logs on selected containers. For more information on managing containers, see Chapter 5‚ Managing Connectors‚ on page 78. The Connectors Tab The Connectors tab displays all software connectors associated with the item selected in the navigation tree. For example, if you selected a container in the navigation tree, the Connectors tab would show all connectors in the selected container. If the selected item in the navigation tree is a container, a toolbar enables connector and container management tasks, including adding a new connector, editing the container, sending container commands, running Logfu diagnostics, refreshing the list of connectors, displaying a list of container certificates, deploying a container, starting the FlexConnector wizard, and starting the Diagnostics wizard. For details of each of these tasks, see Chapter 5‚ Managing Connectors‚ on page 78. The Connectors tab includes these buttons: The Connectors tab includes the following columns:  Name: Name of the connector. Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
  • 43. 4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 43  Path: Path to the connector.  Type: Type of connector.  EPS In: Events per second received by the connector.  EPS Out: Events per second sent by the connector to its destination.  Cache: Connector cache size.  Last Check: Date and time of the last status check.  Action: Shows a variety of controls for executing software connector management tasks. These enable sending a connector command, sharing a connector, and starting the FlexConnector edit wizard. These buttons enable operations on one or more selected connectors.  Delete: Deletes connectors from ArcSight Management Center.  Runtime Parameters: Change the runtime parameters on selected connectors.  Destinations: Sets the destinations of selected connectors.  Parameters: Sets the parameters of selected connectors. For more information on managing connectors, see Chapter 5‚ Managing Connectors‚ on page 78. The Connector Summary Tab To view a single connector in detail, click the connector in the navigation tree. The toolbar on the summary tab includes the following buttons: Tables below the toolbar show connector specifics, including basic connector data, parameters, and connector destinations. These tables include the following columns: Send Command Sends a command to the connector. Remove Connector Removes the connector. Logfu Run Logfu diagnostics on the connector. Share Shares the connector through ArcExchange.
  • 44. 4 Managing Nodes 44 HP ArcSight Management Center Administrator’s Guide Confidential Connector Data  Type: Type of connector.  Status: Connector status.  Input Events (SLC): Total number of events received by the connector since it was last checked (generally once per minute).  Input EPS (SLC): Events per second received by the connector since it was last checked (generally once per minute). Connector Parameters Click Connector Parameters to toggle display of this table. Connector Parameters includes:  Click to edit parameters.  Parameters: Parameters can include connector network port, IP address, and protocol, and other information.  Value: Parameter value. Table Parameters (WUC Connectors Only)  Domain Name: Connector domain name.  Host Name: Connector host name.  User Name: Connector user name.  Security Logs: Indicates whether security events are collected.  System Logs: Indicates whether system events are collected.  Application: Indicates whether application events are collected from the Common Application Event Log.  Custom Log Names: List of custom application log names, if any.  Microsoft OS Version: Microsoft operating system for the connector.  Locale: Connector locale. Destinations Click Destinations to toggle display of this table. The Destinations table includes:  Click to add additional destinations.  Name: Destination name.  Output Events (SLC): Total number of events output by the connector to the destination since it was last checked (generally once per minute).  Output EPS (SLC): Events per second output by the connector to the destination since it was last checked (generally once per minute).  Cached: Total number of events cached to be transmitted to the destination.  Type: Destination type.  Location: Location of the destination.  Device Location: Location of the device on which the destination is located.  Comment: Comments on the destination.  Parameters: Destination-specific parameters, such as IP address, port, and protocol.
  • 45. 4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 45  Action Buttons: Action buttons enable destination management tasks, such as editing the destination, removing the destination, editing the runtime parameters, adding a new failover destination, and sending destination commands. For more information on managing connectors, see Chapter 5‚ Managing Connectors‚ on page 78. The Connector Appliances Tab The Connector Appliances tab displays all hardware and Software Connector Appliances associated with the item selected in the navigation tree. For example, if you selected System in the navigation tree, the Connector Appliances tab would display all Connector Appliances in ArcSight Management Center; if you selected a Location, the tab would display all Connector Appliances in the selected location. The Connector Appliances tab includes the following buttons: The Connector Appliances tab includes the following columns:  Name: Name of the Connector Appliance.  Path: Path to the Connector Appliance.  Port: Port number through which the Connector Appliance is communicating.  Version: Software version of the Connector Appliance.  Status: Status of the Connector Appliance.  Last Check: Date and time of last status check.  Action: Shows a variety of controls for executing Connector Appliance management tasks, including rebooting, shutting down, and editing a configuration. This button enable operations on one or more selected Connector Appliances.  Set Configuration: Set the configuration of selected Connector Appliances. For more information on managing Connector Appliances in ArcSight Management Center, see Chapter 5‚ Managing Connector Appliances‚ on page 61. Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
  • 46. 4 Managing Nodes 46 HP ArcSight Management Center Administrator’s Guide Confidential The Loggers Tab The Loggers tab displays all hardware and Software Loggers associated with the item selected in the navigation tree. For example, if you selected System in the navigation tree, the Loggers tab would display all Loggers in ArcSight Management Center; while if you selected a Location, you would see all Loggers in that location. The Loggers tab includes the following buttons: The Loggers tab includes the following columns:  Name: Name of the Logger.  Path: Path to the Logger.  Port: Port number through which the Logger is communicating.  Version: Software version of the Logger.  Status: Status of the Logger.  Last Check: Date and time of last status check.  Action: Shows controls for executing Logger management tasks, including rebooting, shutting down, editing a configuration, and upgrading. This button enable operations on one or more selected Loggers.  Set Configuration: Set the configuration of selected Loggers. For more information on managing Logger Appliances in ArcSight Management Center, see Chapter 5‚ Managing Loggers‚ on page 64. The ArcMCs Tab The ArcMCs tab displays all Software ArcSight Management Centers and ArcSight Management Center Appliances associated with the item selected in the navigation tree. For example, if you selected System in the navigation tree, the ArcMCs tab would display Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column.
  • 47. 4 Managing Nodes Confidential HP ArcSight Management Center Administrator’s Guide 47 all managed ArcSight Management Centers; while if you selected a Location, you would see all Loggers in that location. The ArcMCs tab includes the following buttons: The ArcMCs tab includes the following columns:  Name: Name of the ArcSight Management Center.  Path: Path to the ArcSight Management Center.  Port: Port number through which the ArcSight Management Center is communicating.  Version: Software version of the ArcSight Management Center.  Status: Status of the ArcSight Management Center.  Last Check: Date and time of last status check.  Action: Shows controls for executing ArcMC management tasks, including rebooting, shutting down, and editing a configuration. This button enable operations on one or more selected ArcMCs.  Set Configuration: Set the configuration of the selected ArcMC. For more information on managing other ArcSight Management Centers in ArcSight Management Center, see Chapter 5‚ Managing Other ArcSight Management Centers‚ on page 63. Locations A location is a logical grouping of hosts. The grouping can be based on any criteria you choose, such as geographical placement or organizational ownership. Locations are a useful way to organize a set of hosts. For example, you could group all hosts in New York separately from hosts in San Francisco and assign them to locations named “New York” and “San Francisco”. Similarly, you could group hosts in a location named “Sales” and others in the location “Marketing”. A location can contain any number of hosts. For information on adding hosts to locations, see “About Adding a Host” on page 49. Adding a Location You can add any number of locations. To add a location: 1 Click Node Management. Refresh Refreshes tab data. Filter Displays drop-down lists of values on which to filter each table column. ArcSight Management Center includes one location by default (called Default) but you may add any number of others. The name of the Default location may be edited, if desired.