Configuration

You can configure SmartConnectors to set a specific priority level for events that match specific criteria. One of the typical applications of this is to change the default priority mapping. By default, SmartConnectors will map the device priority (which may contain multiple levels) to the standard priority levels: Very-High, High, Medium, and Low. For example, if a device has eight priority levels (0-7) where 0 is the highest priority, then most likely 0 and 1 will be mapped to Very-High, 2 and 3 to High, 4 and 5 to Medium, and 6 and 7 to Low. You can use this feature to change this behavior and make the SmartConnector set the priority based on different parameters. For example, assume two firewalls, one of which is your production firewall and the other an internal firewall used for testing. You can configure the SmartConnectors to set the priority to Low for all the events coming from the internal firewall and leave the rest of the events with the default priority mapping.

SmartConnectors can be configured to optimize their performance and increase their functionality. SmartConnectors can be configured to enable aggregation, batching, and time zone correction functionality. You can also send control commands from the ArcSight Console to SmartConnectors to manage the flow of events.

For information on how to import and export SmartConnectors configurations, see Importing and Exporting SmartConnector Configurations.