Editing Connector Parameters

ArcSight supports a large number of connector types to gather security events from a variety of sources, including syslog, log files, relational databases, and proprietary devices. Accordingly, configuration parameters vary widely depending on the type of connector being configured.

You can edit parameters (simple and table) for a specific connector, or for multiple connectors of the same type at the same time.

Note: The maximum number of selected entries when managing Connectors/Collectors is 50.

Updating Simple Parameters for a Connector

The following procedure describes how to update simple parameters for a specific connector.

To update parameters for a specific connector:

  1. Click Node Management.

  2. In the navigation tree, browse to the connector you wish to update.

  3. In the management panel, the Connector summary tab displays.

  4. On the Connector tab, next to Connector Parameters, click .

  5. Modify parameters as necessary, and then click Next.

    Note: When editing parameters that include a file path, enter the path in POSIX format (for example, /folder/filename).

  6. When complete, click Done. The updated parameters display in the Connector Parameters table of the Connector summary tab.

Updating Table Parameters for a Connector

Certain connectors, such as the Microsoft Windows Event connector, have table parameters. You can update the table parameters for a specific connector when necessary.

To update table parameters for a specific connector:

  1. Click Node Management.

  2. In the navigation tree, browse to the connector you wish to update. In the management panel, the Connector summary tab displays.

  3. On the Connector summary tab, next to Table Parameters, click .

  4. Modify parameters as necessary and then click Next.

    • To add more rows of parameter information, click the Add Row link.

    • You can use an Excel-compatible program to prepare a comma-separated values text file with the information and click the Import File button to load the entire table at once. The file needs to be in the same format as the rows shown on the Update Table Parameters page, and it needs to include a header row with parameter labels in the order shown on that page. For fields that require checkbox values, enter True or False as the value. An example is shown below.

      .

  5. When complete, click Done. The updated table parameters display in the Table Parameters section of the Connector page.

    Note: You can import a CSV file that was exported from another connector as long as you export and import the CSV file from the same container. If the CSV file was exported from a different container, you need to change the secret parameters, such as the password, which appear in obfuscated format in the CSV file to plain text before you import the CSV file.

Updating Simple and Table Parameters for Multiple Connectors

If you have multiple connectors of the same type, you can change the simple and table parameters for all the connectors at the same time.

To edit parameters for multiple connectors of the same type:

  1. Click Node Management.

  2. In the navigation tree, select the host where the connectors reside.

  3. In the management panel, select the connectors whose parameters you want to update.

  4. Click Parameters. The Update Connect Parameters wizard starts.

  5. Review the dialog box, and then click Next.

  6. Follow the instructions in the wizard.

    • You can choose to modify the simple parameters for all the selected connectors at once or modify the simple parameters per connector.

    • If the connectors have table parameters, the table parameters are displayed so that you can modify them. If you have many table parameters to modify for multiple connectors, you can import the parameters from a CSV file. You can also export the table parameters to a CSV file for use as a backup or to import on another Connector Appliance.

      Note: When you update parameters for connectors of different versions, the newer connectors might have additional parameters. In this case, only those parameters shared by all connectors are displayed for updating.

  7. Click Done when complete.