You can configure SmartConnectors to set a specific priority level for events that match specific criteria. One of the typical applications of this is to change the default priority mapping. By default, SmartConnectors will map the device priority (which may contain multiple levels) to the standard priority levels: Very-High, High, Medium, and Low. For example, if a device has eight priority levels (0-7) where 0 is the highest priority, then most likely 0 and 1 will be mapped to Very-High, 2 and 3 to High, 4 and 5 to Medium, and 6 and 7 to Low. You can use this feature to change this behavior and make the SmartConnector set the priority based on different parameters. For example, assume two firewalls, one of which is your production firewall and the other an internal firewall used for testing. You can configure the SmartConnectors to set the priority to Low for all the events coming from the internal firewall and leave the rest of the events with the default priority mapping.
SmartConnectors can be configured to optimize their performance and increase their functionality. SmartConnectors can be configured to enable aggregation, batching, and time zone correction functionality. You can also send control commands from the ArcSight Console to SmartConnectors to manage the flow of events.
Note: SmartConnector configuration also affects the ability to automatically create the assets that represent network devices. Each SmartConnector needs to report an IP address or hostname for its sensor so its events can be identified on the network. See the configuration guides for your SmartConnectors to ensure they are reporting this information.
For information on how to import and export SmartConnectors configurations, see Importing and Exporting SmartConnector Configurations.
Tip: SmartConnectors can send event information to the Manager in a compressed format using HTTP compression. Using compression lowers the overall network bandwidth used by SmartConnectors dramatically, without impacting their performance. By default, all SmartConnectors have compression enabled. You can disable compression on SmartConnectors by modifying the ARCSIGHT_HOME/user/agent/agent.properties file as described in "Disabling Event Compression" in "Configuring ArcSight SmartConnectors" in SmartConnector User’s Guide.