Installing and Configuring the FlexConnector

Installation and configuration consists of installing the FlexConnector core software, and then selecting and configuring the destination for the log messages.

The installation process installs the framework, tools, and sample files necessary for configuring a FlexConnector. Once a FlexConnector is installed, it functions the same as any SmartConnector.

The installation directory (for example, C:\FlexConnector\current) is referred to as $ARCSIGHT_HOME, regardless of the platform.

To successfully configure a FlexConnector, the ArcSight Manager or Logger and database components with which the FlexConnector will communicate must be up and running. The FlexConnector tries to connect to the destination during the configuration process. If it cannot connect, configuration fails.

Management of FlexConnectors

There are currently two ways to manage SmartConnectors: through ArcSight Management Center (also referred to as "ArcMC") and through ArcSightConnector Appliance.  Eventually, ArcSight Management Center will replace ArcSightConnector Appliance.

• ArcSight Connector Appliance

• ArcSight Management Center

ArcSight Connector Appliance

The ArcSightConnector Appliance is a hardware solution that incorporates a number of onboard ArcSightSmartConnectors and a web-based user interface that provides centralized management for SmartConnectors across a potentially large number of hosts.

FlexConnectors can generally be managed by a Connector Appliance and can be hosted on the appliance if they are compatible with a Linux platform. The Connector Appliance ships with several prototype FlexConnectors, including the following:

• ArcSight FlexConnector File

• ArcSight FlexConnector ID-Based DB

• ArcSight FlexConnector Multiple DB

• ArcSight FlexConnector Regex File

• ArcSight FlexConnector Regex Folder File

• ArcSight FlexConnector Time-Based DB

• ArcSight FlexConnector XML File

For detailed information and instructions for using the Connector Appliance, see the ArcSight Connector Appliance Administrator’s Guide.

ArcSight Management Center

ArcSight Management Center includes all of the functions of ArcSightConnector Appliances, and also the ability to manage and monitor an additional range of ArcSight products, such as Connector Appliances, Loggers, and other ArcSight Management Centers, as illustrated in the following figure.

ArcSight Management Center uses the concept of nodes to manage various entities.  A node is a networked ArcSight product that can be centrally managed using ArcSight Management Center.  Each node is associated with a single networked host that has been assigned either a hostname, an IP address, or both.

A single host can include multiple nodes.  For example, a single Connector Appliance (with a single IP address or hostname) could have multiple containers, each of which could be a separate node.  In addition, a node can be in a parent or child relationship with other modes.

You can perform any of the following node management tasks:

• View managed nodes by location, host, or node type
• Add, view, edit, and delete locations for hosts
• Add nodes from a host, import hosts from a .csv file, view and delete hosts, view all hosts in a location, move hosts to different locations, and scan hosts for new connectors or containers

See the ArcSight Management Center Administrator’s Guide for details.