Integrating ArcSight with Enterprise Ticketing Systems Dhiraj Sharan Senior Software Engineer May 2006 © 2006 ArcSight Confidential

© 2006 ArcSight Confidential Agenda Enterprise System Integration Options Available in the ArcSight Manager Enterprise Ticketing Integration deep dive: Export to External System How Export to External System works Need for an Enterprise System Connector Case Study: ArcSight Remedy Connector Introduction to Remedy Action Request System Architecture of ArcSight Remedy Connector Mapping the Schema between Remedy and ArcSight Installation and Configuration © 2006 ArcSight Confidential

© 2006 ArcSight Confidential Options Available for Enterprise System Integration with the ArcSight Manager 1. Export to External System Export/import of XML files done by the Manager 2. Archive Tool Externally launched command line client to export/import XML files from the Manager 3. External Scripts Launch external scripts from Rule Actions or interactively from Console Tools © 2006 ArcSight Confidential

© 2006 ArcSight Confidential Options Available for Enterprise System Integration with the ArcSight Manager 4. SMTP Send email notifications from Rule Actions 5. SNMP Send SNMP traps from the Manager 6. Enterprise System Connector Native integration © 2006 ArcSight Confidential

Export to External System © 2006 ArcSight Confidential

Export to External System at the User Level Export to External System of Event Export to External System of Case 1. User Driven: right click on Event in Console 2. Automated: from Rule Action 3. User Drive: right click on Case in Console 4. Automated: via Case Search Group © 2006 ArcSight Confidential

1. User Driven Export to External System of Event Right click on Event in Console —> Export —> External Event Tracking System © 2006 ArcSight Confidential

2. Automated Export to External System of Event Automated Export to External System from Rule Action © 2006 ArcSight Confidential

3. User Driven Export to External System of Case Right click on Case —> Export —> External Event Tracking System © 2006 ArcSight Confidential

4. Automated Export to External System of Case Automated Export to External System from Case Search Group server.properties # ------------------------------------------------------------ # External Ticket System Configuration # This configures in no. of seconds, data should be exported # to external trouble ticket systems. external.export.interval=60 # The Case Search Group that should be used for automatically # exporting events of cases that fall in the search criteria. #external.export.querygroup.uri=/All Cases/All Cases/Export Cases # Upper limit on number of cases to be exported from the query # group in one export cycle. external.export.querygroup.max=100 © 2006 ArcSight Confidential

Tracking Event Exports via Cases Purpose: Audit Export to External System Case gets created behind the scenes in /All Cases/System Cases if the export was for an Event instead of a Case Export to External System from Console UI right click on an Event Export to External System from Rule Action So umbrella Case always there for ANY export © 2006 ArcSight Confidential

Export to External System: Export as XML File Periodic export/import every 60 seconds (default) Cases and their events are exported in archive XML format Archive file exported to archive/exports directory ExternalEventTrackingData_<timestamp>.xml Archive imports checked from archive/imports directory DTDs of XML files available in schema/xml/archive directory on Manager © 2006 ArcSight Confidential

© 2006 ArcSight Confidential Agenda Refresher Enterprise System Integration Options Available in the ArcSight Manager Enterprise Ticketing Integration deep dive: Export to External System How Export to External System works Need for an Enterprise System Connector Case Study: ArcSight Remedy Connector Introduction to Remedy Action Request System Architecture of ArcSight Remedy Connector Mapping the Schema between Remedy and ArcSight Installation and Configuration © 2006 ArcSight Confidential

Enterprise System Connector © 2006 ArcSight Confidential

Need for a Custom Connector To link archive XML with External Ticketing System ArcSight Manager Enterprise System Connector External Ticketing System Common ArcSight Standard for Ticketing Integration Custom Connector for Specific External Ticketing Systems Export to External System © 2006 ArcSight Confidential

ArcSight Remedy Connector © 2006 ArcSight Confidential

BMC Remedy Action Request System (ARS) ARS is a Application Builder but NOT an Application ARS builds Service Applications in a request-centric, forms-driven, Workflow-based architecture ARS Integration Method Remedy ARS API library Remote API Protocol : Sun RPC Use Case for the current ArcSight Remedy Connector Use Remedy as a ticketing interface instead of ArcSight Cases © 2006 ArcSight Confidential

Case Study: ArcSight Remedy Connector ArcSight Remedy Connector is a broker between ArcSight Manager and Remedy ARS Remedy ARS server connection Uses Remedy ARS API library ARS API Protocol: Sun RPC ArcSight Manager connection Uses XML file based protocol from Export to External System feature Runs as a service on the ArcSight Manager machine Watches for manager exported files in archive/exports Parses Archive XML and prepares data to submit to Remedy form Near real-time data transfer (default 60 seconds) © 2006 ArcSight Confidential

Architecture: ArcSight Remedy Connector Remedy ARS Server ArcSight Manager ArcSight Remedy Connector Remedy User Remedy Administrator Archive XML File Export/Import ArcSight Manager Server ArcSight Remedy Connector Architecture Remedy Web Server Remedy Database ARS RPC Protocol © 2006 ArcSight Confidential

Versions and Platforms ArcSight Remedy Connector Current Release: 3.0.4 Platforms: Windows, Solaris, Redhat Linux Supported ArcSight Manager Versions Same Connector supports Manager versions 2.5, 3.0, 3.5 Connector independent of Manager versions as long as Archive XML schema remains same Supported Remedy ARS Versions Connector tested with Remedy ARS versions 5.1 to 6.3 Future Remedy ARS versions maintain backward compatibility with Remedy ARS APIs used by Connector © 2006 ArcSight Confidential

Data Flow: ArcSight Remedy Connector ArcSight ConsoleTM Action Remedy Ticket ID and Status put as Archive XML file for updates Remedy Ticket ID and Status imported by the Manager Remedy Ticket ID and Status reported back to the remedy connector Manual or Automatic Export to External System of Cases and Events Case and Event data exported to the XML file Ticket created in Remedy Remedy Connector parses the XML data ArcSight Remedy Connector ArcSight Manager ArcSight XML Archive The data flow is in several steps and has a direction of flow. A detailed description should show up when a particular step is being described and the data flow direction should be appropriately marked. These are the steps, their direction, and text:   Step 1 (ArcSight Console to ArcSight Manager) : Manual or Automatic Export to External System of Cases and Events. Step 2 (ArcSight Manager to Archive XML File) : Case and Event data exported to the XML File Step 3 (ArcSight XML File to ArcSight Remedy Connector) : Remedy Connector parses the xml data. Step 4 (ArcSight Remedy Connector to Remedy ARS Server) : Ticket created in Remedy Step 5 (Remedy ARS Server to ArcSight Remedy Connector) : Remedy Ticket ID and Status reported back to the Remedy Connector Step 6 (ArcSight Remedy Connector to Archive XML File) : Remedy Ticket ID and Status put as Archive XML file for updates. Step 7 (Archive XML File to the ArcSight Manager) : Remedy Ticket ID and Status imported by the Manager. Remedy ARS Server © 2006 ArcSight Confidential

© 2006 ArcSight Confidential Two-way Integration Connector brings the Remedy Ticket Number back to ArcSight Stored in Case External ID attribute Connector tracks Remedy Ticket Status changes and brings the STATUS back to ArcSight Configure which Case attribute should hold Status Sends ticket number and status to the manager via XML file in archive/imports directory Other fields not synchronized in the current Connector Use Case Connector can be modified to synchronize other fields too since the Archive XML interface supports it © 2006 ArcSight Confidential

Defining the ArcSight Form in ARS © 2006 ArcSight Confidential

Mapping ArcSight Schema to Remedy Schema # ------------------------------------------------------------ # Remedy field mappings for uplink (from arcsight to remedy) # Set the name of the remedy form the arcsight remedy client # should submit event data to. remedy.event.form=ArcSight Ticket # Set the number of fields in the form remedy.event.form.fields=3 # Set the remedy field names to arcsight attribute names mapping remedy.event.form.field[0].name=TicketName arcsight.event.attribute[0].name=name remedy.event.form.field[1].name=IncidentTime arcsight.event.attribute[1].name=endTime remedy.event.form.field[2].name=ReportDevice arcsight.event.attribute[2].name=deviceAddress Remedy Schema Every Remedy App is Unique with its own fields Define Fields as per ArcSight Event Attributes desired ArcSight Schema Choose the ArcSight Event attributes to send to Remedy Mapping ArcSight and Remedy Schema Configured in config/arcremedyclient.properties in the Connector Note Only the chosen Event fields are transferred to Remedy Case fields are not transferred in the current Use Case © 2006 ArcSight Confidential

Installation/Configuration Extract the ArcSightRemedyClient.3.0.4.zip file Running from command line: bin/arcremedyclient <params> Demonized version: bin/arcremedyclientsvc <params> Parameters ArcSight Manager installation directory path, Remedy Username, Remedy Password, Remedy Servername, Remedy Port © 2006 ArcSight Confidential

Installation/Configuration Setup to run as a Service Windows bin/arcremedyclientsvc –i Solaris/Linux startup/solaris/runAsRoot –i /etc/init.d/arcremedyclient service configuration and startup script Set JAVA_HOME to use the ArcSight Manager’s JRE Schema mapping and other configuration config/arcremedyclient.properties Troubleshooting logs/arcremedy.log © 2006 ArcSight Confidential

© 2006 ArcSight Confidential Questions and Answers Download Slides https://support.arcsight.com More ArcSight Events http://www.arcsight.com Join the User Forum https://forum.arcsight.com © 2006 ArcSight Confidential

© 2006 ArcSight Confidential www.arcsight.com © 2006 ArcSight Confidential