Using the Recon Integration Commands

Integration with Recon requires specific browser versions. See the ESM Support Matrix for details.

If a Recon deployment is available, you can create target parameters then execute commands to run a search. You can run searches:

• By Source and Destination
• By Vendor and Product

Where: Navigator > Resources > Integration Commands

Configure target with target parameters:

1. Select the Targets tab.
2. Expand /All Integration Targets/ArcSight Administration/Recon.

3. Right-click Recon 1 and select Edit Target.

   The target's Edit panel opens.

4. Click the Integration Parameters tab.

5. Click the Add icon and add the first parameter using the following:

   Parameter name = Host

   Type = Text (the default)

   Value = Enter the host information for Recon

6. Click the Add icon again and add the second parameter using the following:

   Parameter name = Port

   Type = Text (the default)

   Port = 443, the default port for Recon. If using a different port, enter it here.

7. Create additional targets if applicable, for example, using a different value for host or port.

Run the search commands:

1. Open an active channel.
2. Right-click an event, select Integration Commands, and select Recon Search.

3. In the popup, select a type of Recon Search command:

   By Source and Destination

   or

   By Vendor and Product

   Select a target, then click OK to close the popup.

   Note: If you did not perform the previous set of steps in Configure target with target parameters:, you are next prompted in another popup to enter the IP address for the Recon host. In the same popup, you have the option to save this IP address parameter to the target. See Entering/Saving Command Parameters at Runtime for information.

4. Click OK again.

Your preferred browser launches the Recon Search page.

See also Running Recon Searches.