Open topic with navigation

Consuming Events from Transformation Hub

ESM can consume events from the ArcSight Transformation Hub. This is done first by configuring the SmartConnector as follows:

During SmartConnector setup:

  1. Add the ArcSight Manager destination as described in the ArcSight SmartConnectors User's Guide.

    Additionally, set these options:

    Option Setting Purpose
    AUP Master Destination true To enable event enrichment with zone information. If the setting is true, ESM sends zone information back to the connector. The connector then adds the zone information in events forwarded to ESM.
    Filter Out All Events true To filter out and aggregate, and therefore reduce event volume sent to ESM. This increases efficiency and reduces processing time.

  2. Save the configuration.

  3. Add another destination. This time, select Transformation Hub, also described in the ArcSight SmartConnectors User's Guide.

    • For Content Type, select ESM. This configures the connector to send binary events to Transformation Hub.
    • Specify the topic that was configured in Transformation Hub that will be consumed by ESM. Make note of this topic name because you will specify it again during Manager setup.

During ArcSight Manager setup:

  1. Make sure you have ESM defined connection information to the Transformation Hub deployment.

  2. Specify the same topic as in the SmartConnector.

    If this configuration was not done during ESM installation, refer to the ESM Administrator's Guide for procedures to use the managersetup command and launch the configuration wizard again.

On the Console, the Transformation Hub connector is represented as follows:

Icon Color Description
Green

Indicates that

  • The connector has been set up with ArcSight Manager as destination with AUP Master Destination = true, and Filter Out All Events = true.
  • The connector has been set up with Transformation Hub destination with ESM as content type with topic also specified.
  • ArcSight Manager has been set up as an Transformation Hub consumer.
Grey

Indicates that the Manager setup is not configured as a Transformation Hub consumer even if the SmartConnector itself is set with the appropriate Transformation Hub destination, content type, and topic. Therefore, Manager is not consuming events coming in from Transformation Hub.

Note: Transformation Hub configurations on the SmartConnector side and the Manager side must match.

If the SmartConnector is not set up with the Transformation Hub destination for ESM, even if the Manager is configured for Transformation Hub consumption during Manager setup, the icon on the Console will appear as a regular connector.

For more information about Transformation Hub, refer to the ArcSight Open Data Platform Transformation Hub Guide.