ArcSight Console-Based Methods

The Console provides two ways to populate the network model:

All the tools for modeling the network are in the Console. The Network Modeling Wizard provides a quick way to add basic assets to your Network Model at setup time.

Manually, Using Network Modeling Resources

Set parameters for every asset using the network modeling resources (Assets, Asset Ranges, Zones, Networks, and Customers) and asset modeling resources (Asset Categories, Vulnerabilities, and Locations).

Use these tools in conjunction with the other batch-loading methods that only offer limited distinctions. As long as primary identifiers, such as IP address, host name, and MAC address, remain the same, the automatic update methods only update fields with new information so the Network Model remains stable.

See the topic “ArcSight Network Model” in ESM 101.

In a Batch Using the Network Modeling Wizard

The Console provides a Network Modeling wizard as a set-up and configuration tool (menu option Tools > Network Model). The Network Modeling wizard enables you to load Assets, Asset Ranges, and Zones along with Asset Category information. If you also add a vulnerability scanner as described in SmartConnector-, the existing assets in the model are updated with the vulnerability scan report data.

The Network Modeling Wizard is flexible. It can take output from any device type in CSV format. The CSV file can include as many new or pre-existing asset categories as are relevant to the devices without having to add asset category information one by one later using the Asset Category resource in the Console. This tool is appropriate for initial set-up and configuration, not as a method for maintaining the network model.

For more about the Network Modeling Wizard, see Populating the Network Model Using the Wizard.