This ArcSight FlexConnector Configuration training course provides an overview of the ArcSight SmartConnectors components and explains the ArcSight ESM Schema. It teaches to construct and manipulate FlexConnector configuration and property files and use various parsing methods including fixed delimited, regular expressions, syslog, and JSON. Examples from standard connectors are used to illustrate device-specific methodologies. Advanced configuration options such as multi-line Regex, parser linking and conditional mapping are also covered.
By attending ArcSight FlexConnector Configuration workshop, delegates will learn to:
- Install ArcSight Connector software, configure a functional FlexConnector, and test with an ESM Active Channel
- Use the FlexConnector Wizard to create fixed delimited configuration files
- Use the Regex Tester tool to create common and sub-message parsing and token-toevent mapping
- Create a tailored Categorization file for a parent FlexConnector and test its function in an active channel
- Navigate the connector configuration file hierarchy to locate, display and edit
- Attend a training on ArcSight ESM Admin and Analyst or equivalent practical experience
- Attend a training on ArcSight ESM Advanced Administrator or equivalent practical experience
- Working knowledge of Regular Expressions
The ArcSight FlexConnector Configuration class is ideal for:
- Security Administrators, Content authors/architects and IT integrators, who build and install custom connectors to provide critical event data feeds to ArcSight ESM or Logger. This can also include senior analysts for networks, security systems, enterprise applications and databases.