About Routes
A route is a method of retrieving events in a topic that meet certain criteria and then copying them into a new topic. Use routes to filter events into your topics for your own requirements, such as selecting a group of events for more detailed examination.
A route comprises these components:
- Name: Name of the route.
- Routing Rule: A logical filter that defines criteria by which events will be categorized into topics. The criteria are defined in terms of CEF and Avro fields for Transformation Hub 3.4 and later, and CEF only for Transformation Hub 3.3 and earlier.
- Source Topic: The topic being filtered for events which match the routing rule.
- Destination Topic: The topic to which a copy of an event matching the routing rule should be copied. (A copy of the event will remain in the source topic.)
- Description: A short description of the route.
You can add, edit, or delete routes in ArcMC. Routes only apply to CEF and Avro topics for Transformation Hub 3.4 and later, and CEF only for Transformation Hub 3.3 and earlier. Routes created to or from a binary topic (such as th-binary_esm) will not function.
Every Avro routing created in Transformation Hub 3.4 and earlier using th-arcsight-avro as source topic will be automatically overridden after upgrading to Transformation Hub 3.5. As a general guideline, th-arcsight-avro is no longer recommended as a source topic for Avro routing, since enrichment stream processors were added as intermediate layer between th-arcsight-avro and mf-event-avro-enriched in Transformation Hub 3.5 . This makes the mf-event-avro-enriched topic the new primary source topic for Recon’s database scheduler (replacing th-arcsight-avro). As a result, the routing starting point should start from the mf-event-avro-enriched topic to benefit from event enrichment.