This document discusses integrating ArcSight with enterprise ticketing systems. It describes the options available in ArcSight Manager for enterprise integration, including exporting to external systems. It then provides a deep dive on exporting to external systems and the need for custom connectors. The rest of the document uses an ArcSight Remedy connector case study to illustrate how integration with Remedy works, including the architecture, schema mapping, installation, and configuration.

1. www.hp.com © 2014 HP Confidential 1
Integrating ArcSight with
Enterprise Ticketing Systems
Dhiraj Sharan
Senior Software Engineer

2. www.hp.com © 2014 HP Confidential 2
Agenda
► Enterprise System Integration
•Options Available in the ArcSight Manager
► Enterprise Ticketing Integration deep dive:
Export to External System
•How Export to External System works
► Need for an Enterprise System Connector
► Case Study: ArcSight Remedy Connector
•Introduction to Remedy Action Request System
•Architecture of ArcSight Remedy Connector
•Mapping the Schema between Remedy and ArcSight
•Installation and Configuration

3. www.hp.com © 2014 HP Confidential 3
Options Available for Enterprise System
Integration with the ArcSight Manager
1. Export to External System
•Export/import of XML files done by the Manager
2. Archive Tool
•Externally launched command line client to export/import XML
files from the Manager
3. External Scripts
•Launch external scripts from Rule Actions or interactively from
Console Tools

4. www.hp.com © 2014 HP Confidential 4
Options Available for Enterprise System
Integration with the ArcSight Manager
4. SMTP
•Send email notifications from Rule Actions
5. SNMP
•Send SNMP traps from the Manager
6. Enterprise System Connector
•Native integration

5. www.hp.com
Export to External
System
© 2014 HP Confidential 5

6. www.hp.com © 2014 HP Confidential 6
Export to External System at the User Level
► Export to External System of Event
► Export to External System of Case
1. User Driven: right click on Event in Console
2. Automated: from Rule Action
3. User Drive: right click on Case in Console
4. Automated: via Case Search Group

7. www.hp.com © 2014 HP Confidential 7
1. User Driven
Export to External System of Event
Right click on Event in Console —> Export —> External Event Tracking System

8. www.hp.com © 2014 HP Confidential 8
2. Automated
Export to External System of Event
Automated Export to External System from Rule Action

9. www.hp.com © 2014 HP Confidential 9
3. User Driven
Export to External System of Case
Right click on Case —> Export —> External Event Tracking System

10. www.hp.com © 2014 HP Confidential 10
4. Automated
Export to External System of Case
Automated Export to External System from Case Search Group
server.properties
# ------------------------------------------------------------
# External Ticket System Configuration
# ------------------------------------------------------------
# This configures in no. of seconds, data should be exported
# to external trouble ticket systems.
external.export.interval=60
# The Case Search Group that should be used for automatically
# exporting events of cases that fall in the search criteria.
#external.export.querygroup.uri=/All Cases/All Cases/Export Cases
# Upper limit on number of cases to be exported from the query
# group in one export cycle.
external.export.querygroup.max=100

11. www.hp.com © 2014 HP Confidential 11
Tracking Event Exports via Cases
► Purpose: Audit Export
to External System
► Case gets created
behind the scenes in
/All Cases/System Cases
if the export was for an
Event instead of a Case
•Export to External System from Console UI right click on an Event
•Export to External System from Rule Action
► So umbrella Case always there for ANY export

12. www.hp.com © 2014 HP Confidential 12
Export to External System: Export as XML File
► Periodic export/import every 60 seconds (default)
► Cases and their events are exported in archive
XML format
► Archive file exported to archive/exports directory
―ExternalEventTrackingData_<timestamp>.xml
► Archive imports checked from archive/imports directory
―ExternalEventTrackingData_<timestamp>.xml
► DTDs of XML files available in schema/xml/archive
directory on Manager

13. www.hp.com © 2014 HP Confidential 13
Agenda Refresher
► Enterprise System Integration
•Options Available in the ArcSight Manager
► Enterprise Ticketing Integration deep dive:
Export to External System
•How Export to External System works
► Need for an Enterprise System Connector
► Case Study: ArcSight Remedy Connector
•Introduction to Remedy Action Request System
•Architecture of ArcSight Remedy Connector
•Mapping the Schema between Remedy and ArcSight
•Installation and Configuration

14. www.hp.com
Enterprise System
Connector
© 2014 HP Confidential 14

15. www.hp.com © 2014 HP Confidential 15
Need for a Custom Connector
To link archive XML with External Ticketing System
ArcSight
Manager
Enterprise
System
Connector
External
Ticketing
System
Common ArcSight Standard
for Ticketing Integration
Custom Connector for Specific
External Ticketing Systems
Export to
External System

16. www.hp.com
ArcSight Remedy
Connector
© 2014 HP Confidential 16

17. www.hp.com © 2014 HP Confidential 17
BMC Remedy Action Request System (ARS)
► ARS is a Application Builder but NOT an Application
► ARS builds Service Applications in a request-centric,
forms-driven, Workflow-based architecture
► ARS Integration Method
•Remedy ARS API library
•Remote API Protocol : Sun RPC
► Use Case for the current ArcSight Remedy Connector
•Use Remedy as a ticketing interface instead of ArcSight Cases

18. www.hp.com © 2014 HP Confidential 18
Case Study: ArcSight Remedy Connector
► ArcSight Remedy Connector is a broker between
ArcSight Manager and Remedy ARS
•Remedy ARS server connection
―Uses Remedy ARS API library
―ARS API Protocol: Sun RPC
•ArcSight Manager connection
―Uses XML file based protocol from Export to External System feature
―Runs as a service on the ArcSight Manager machine
► Watches for manager exported files in archive/exports
► Parses Archive XML and prepares data to submit
to Remedy form
► Near real-time data transfer (default 60 seconds)

19. www.hp.com © 2014 HP Confidential 19
Architecture: ArcSight Remedy Connector
Remedy ARS Server
ArcSight
Manager
ArcSight
Remedy
Connector
Remedy User Remedy
Administrator
Archive XML File
Export/Import
ArcSight Manager Server
ArcSight Remedy
Connector Architecture
Remedy
Web Server
Remedy
Database
ARS RPC
Protocol

20. www.hp.com © 2014 HP Confidential 20
Versions and Platforms
► ArcSight Remedy Connector
•Current Release: 3.0.4
•Platforms: Windows, Solaris, Redhat Linux
► Supported ArcSight Manager Versions
•Same Connector supports Manager versions 2.5, 3.0, 3.5
•Connector independent of Manager versions as long as Archive
XML schema remains same
► Supported Remedy ARS Versions
•Connector tested with Remedy ARS versions 5.1 to 6.3
•Future Remedy ARS versions maintain backward compatibility
with Remedy ARS APIs used by Connector

21. www.hp.com © 2014 HP Confidential 21
Remedy ARS Server
Data Flow: ArcSight Remedy Connector
ArcSight
Manager
ArcSight
Remedy
Connector
ArcSight
ConsoleTM
ArcSight
XML
Archive
Manual or Automatic Export to
External System of Cases and Events
Case and Event data exported to the XML file
Remedy Connector parses the XML data
Ticket created in Remedy
Remedy Ticket ID and Status
reported back to the remedy connector
Remedy Ticket ID and Status
put as Archive XML file for updates
Remedy Ticket ID and Status
imported by the Manager
Action

22. www.hp.com © 2014 HP Confidential 22
Two-way Integration
► Connector brings the Remedy Ticket Number back to
ArcSight
•Stored in Case External ID attribute
► Connector tracks Remedy Ticket Status changes and
brings the STATUS back to ArcSight
•Configure which Case attribute should hold Status
► Sends ticket number and status to the manager via XML
file in archive/imports directory
► Other fields not synchronized in the current Connector
Use Case
► Connector can be modified to synchronize other fields
too since the Archive XML interface supports it

23. www.hp.com © 2014 HP Confidential 23
Defining the ArcSight Form in ARS

24. www.hp.com © 2014 HP Confidential 24
► Remedy Schema
•Every Remedy App
is Unique with its
own fields
•Define Fields as per
ArcSight Event Attributes
desired
► ArcSight Schema
―Choose the ArcSight Event attributes to send to Remedy
► Mapping ArcSight and Remedy Schema
―Configured in config/arcremedyclient.properties in the Connector
► Note
• Only the chosen Event fields are transferred to Remedy
• Case fields are not transferred in the current Use Case
# ------------------------------------------------------------
# Remedy field mappings for uplink (from arcsight to remedy)
# ------------------------------------------------------------
# Set the name of the remedy form the arcsight remedy client
# should submit event data to.
remedy.event.form=ArcSight Ticket
# Set the number of fields in the form
remedy.event.form.fields=3
# Set the remedy field names to arcsight attribute names mapping
remedy.event.form.field[0].name=TicketName
arcsight.event.attribute[0].name=name
remedy.event.form.field[1].name=IncidentTime
arcsight.event.attribute[1].name=endTime
remedy.event.form.field[2].name=ReportDevice
arcsight.event.attribute[2].name=deviceAddress
Mapping ArcSight Schema to Remedy Schema

25. www.hp.com © 2014 HP Confidential 25
Installation/Configuration
► Extract the ArcSightRemedyClient.3.0.4.zip file
► Running from command line:
•bin/arcremedyclient <params>
•Demonized version: bin/arcremedyclientsvc <params>
► Parameters
•ArcSight Manager installation directory path, Remedy Username,
Remedy Password, Remedy Servername, Remedy Port

26. www.hp.com © 2014 HP Confidential 26
Installation/Configuration
► Setup to run as a Service
•Windows
―bin/arcremedyclientsvc –i
•Solaris/Linux
―startup/solaris/runAsRoot –i
―/etc/init.d/arcremedyclient service configuration and startup script
► Set JAVA_HOME to use the ArcSight Manager’s JRE
► Schema mapping and other configuration
―config/arcremedyclient.properties
► Troubleshooting
―logs/arcremedy.log