Default Topics
Transformation Hub manages the distribution of events to topics, to which consumers can subscribe and receive events from.
Transformation Hub includes the following default topics:
| Topic Name | Event Type | Producers For This Topic |
|---|---|---|
| mf-event-avro-esmfiltered | Filtered Avro events for consumption by ESM, Vertica, or Intelligence, depending on the enrichment scenario. | Transformation Hub, ESM |
|
mf-event-cef-esmfiltered |
Filtered CEF events for consumption by ESM. | SmartConnector, Connector in Transformation Hub (CTH). |
| mf-event-avro-enriched | Event data in Avro format that has been enriched by the Enrichment Stream Processors. | Transformation Hub |
| th-arcsight-avro | For ArcSight product use only. Event data in Avro format. | Transformation Hub, SmartConnector, Connector in Transformation Hub (CTH) or ESM |
| th-arcsight-avro-sp_metrics | For ArcSight product use only. Routing stream processor operational metrics data. | |
| th-arcsight-json-datastore | For ArcSight product use only. Transformation Hub dynamic configuration data. | |
| th-binary_esm | Binary security events, a format consumed by ArcSight ESM. | SmartConnector |
| th-cef | CEF event data. | SmartConnector, Connector in Transformation Hub (CTH). |
| th-cef-other | CEF event data destined for a non-ArcSight subscriber. | |
| th-syslog | The Connector in Transformation Hub (CTH) feature sends raw syslog data to this topic using a Collector. | Should only be configured as Collector or CTH destination. |
In addition, using ArcSight Management Center, you can create new custom topics to which your SmartConnectors can connect and send events.
Topic Data Preservation
Topic data is preserved across Transformation Hub restarts, reinstalls, and upgrades.
- When a Transformation Hub reinstall is performed, all data in a Kafka topic is preserved. No data is lost.
- When the consumer resumes data collection from the topics, the consumer re-starts where it last left off. No data is lost.