20.2 Data Ingestion to ArcSight Intelligence

1. Navigate to the directory <sentinel_installation_path>/opt/novell/sentinel/bin.

2. Switch to the novell user:

   su novell

3. Run data uploader tool to forward data present in existing partitions to Transformation Hub with the required parameters.

   Example:

   ./data_uploader.sh -from=<YYYYMMDD> -to=<YYYYMMDD> -masterurl=<hostname>:32081 -workerurl=<hostname>:9093 -certdir=<path to cert directory>

1. Export the following access token dependencies, which you can remove later if not needed to invoke vault anymore.

   export PASSPHRASE=$(kubectl get secret vault-passphrase -n core -o json 2>/dev/null | jq -r '.data.passphrase')

   export ENCRYPTED_ROOT_TOKEN=$(kubectl get secret vault-credential -n core -o json 2>/dev/null | jq -r '.data."root.token"')

   export VAULT_TOKEN=$(echo ${ENCRYPTED_ROOT_TOKEN} | openssl aes-256-cbc -md sha256 -a -d -pass pass:"${PASSPHRASE}")

2. Request Vault to generate the certificate for your external access host.

   /opt/arcsight/kubernetes/bin/vault write -tls-skip-verify -format=json RE/issue/coretech common_name=SENTINEL_HOST

3. From the output generated above, create three different files as explained below:

   1. server.crt (create this .crt file by copying contents under the key "certificate":". Once done, the server.crt file should contain a string starting with -----BEGIN CERTIFICATE---- and ending with -----END CERTIFICATE----)

   2. server.key (create this .key file by copying contents under the key "private_key": ". Once done, the server.key file should contain a string starting with -----BEGIN RSA PRIVATE KEY---- and ending with -----END RSA PRIVATE KEY----)

   3. issuingca.crt (create this .crt file by copying contents under the key "issuing_ca":". Once done, the issuingca.crt file should contain a string starting with ----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE----)

   Once created, copy these three files to any custom directory in Sentinel server.

4. In the Sentinel server go to the above created custom directory which contains the three files and run the commands below:

   awk '{gsub(/\\n/,"\n")}1' server.key  > tmp && mv -f tmp server.key

   sed -i 's/\\n//g' server.key

   awk '{gsub(/\\n/,"\n")}1' issuingca.crt  > tmp && mv -f tmp issuingca.crt

   sed -i 's/\\n//g' issuingca.crt

   awk '{gsub(/\\n/,"\n")}1' server.crt  > tmp && mv -f tmp server.crt

   sed -i 's/\\n//g' server.crt

   The above commands formats the certificate files in that directory to the desire format. Now copy the entire directory and its content (server.crt, server.key, issuingca.crt) into the same directory path in the Collector Manager's server. It is important to recreate the same directory path for this folder in the Collector Manager as in the Sentinel server.

Perform the following steps to add a CA certificate in the FIPS keystore.

1. Add the issuingca.crt certificate generated in the Generating External Certificate section to the FIPS keystore of the Sentinel server using the below command:

   ./convert_to_fips.sh -i <sentinel_installation_path>/<custom-directory-containing-cdf-generated-certificates>/issuingca.crt

2. Add the same issuingca.crtcertificate to the all the FIPS keystore of the RCM server using the below command:

   ./convert_to_fips.sh -i <rcm_installation_path>/<custom-directory-containing-cdf-generated-certificates>/issuingca.crt