Default Topics
Transformation Hub manages the distribution of events to topics, to which consumers can subscribe and receive events from.
Transformation Hub includes the following default topics:
| Topic Name | Event Type | Valid Destinations |
|---|---|---|
| mf-event-avro-esmfiltered | Filtered Avro events for consumption by ESM. | SmartConnector or Connector in Transformation Hub (CTH). |
|
mf-event-cef-esmfiltered |
Filtered CEF events for consumption by ESM. | SmartConnector or Connector in Transformation Hub (CTH). |
| mf-event-avro-enriched | Event data in Avro format that has been enriched by the Enrichment Stream Processors. | Transformation Hub |
| th-arcsight-avro | For ArcSight product use only. Event data in Avro format. | Transformation Hub |
| th-arcsight-avro-sp_metrics | For ArcSight product use only. Routing stream processor operational metrics data. | |
| th-arcsight-json-datastore | For ArcSight product use only. Event data in JSON format for use by ArcSight infrastructure management | |
| th-binary_esm | Binary security events, which is the formatconsumed by ArcSight ESM. | SmartConnector |
| th-cef | CEF event data. | SmartConnector or Connector in Transformation Hub (CTH). |
| th-cef-other | CEF event data destined for a non-ArcSight subscriber. | |
| th-syslog | The Connector in Transformation Hub (CTH) feature sends raw syslog data to this topic using a Collector. | Should only be configured as Collector or CTH destination. |
In addition, using ArcSight Management Center, you can create new custom topics to which your SmartConnectors can connect and send events.
Topic Data Preservation
Topic data is preserved across Transformation Hub restarts, reinstalls, and upgrades.
- When a Transformation Hub reinstall is performed, all data in a Kafka topic is preserved. No data is lost.
- When the consumer resumes data collection from the topics, the consumer re-starts where it last left off.
No data is lost.