This section describes how to install ArcSight SmartConnector.
To install ArcSight SmartConnector:
This application is a component of HP ArcSight and is not included in Kaspersky CyberTrace.
%ARCSIGHT_HOME%
).Adding a connector
If this window is not displayed, configure ArcSight SmartConnector manually. For this purpose, run the following command:
%ARCSIGHT_HOME%/current/bin/runagentsetup.sh
It is the same port that is specified on the Settings > Service tab of Kaspersky CyberTrace Web (by default, it is 9998
).
It is the same IP address that is specified on the Settings > Service tab of Kaspersky CyberTrace Web (by default, it is 127.0.0.1
).
You can specify (ALL)
if you want Arcsight SmartConnector to receive events from all network interfaces of the computer on which it runs. (Note that you cannot specify (ALL)
in the Feed Service configuration file.)
Raw TCP
.false
.Parameters for sending detection events
Click Next.
Type of destination
Click Next.
By default, it is 8443.
false
.false
.false
.Destination parameters
Click Next.
Connector details
Click Next.
Warning about user privileges
You can either run the Connector Setup Wizard as root, or run the following command as root:
%ARCSIGHT_HOME%/current/bin/arcsight agentsvc -i -u $username -sn $service_name
Here
$username
is the name of the operating system user that will run the service.$service_name
is the service name.We recommend that you set the service name to be the same as the connector name.
The %ARCSIGHT_HOME%/current/logs/agent.log
log file will contain messages about the installation process.
Skip the next step that describes how to specify the service parameters.
Click Next.
We recommend that you set the service name to be the same as the connector name.
Specifying service parameters
Click Next.
/etc/init.d/arc_$service_name start
In this command, $service_name
is the service name.
After you have installed ArcSight SmartConnector, you can install Feed Service and integrate it with ArcSight. For more information, see section "Integration steps (ArcSight)".
Page top