OpenText ArcSight Community

Knowledge Document: Alert can not create any cases with base events on SOAR

Caroline Oest

Environment Arcsight Platform 24.2 ESM version:7.6.4 SOAR version:24.2 Situation Check the SOAR logs and found the following exception. 1733207588.296642389,"2024-12-03T14:33:08.296642389+08:00","[2024-12-03 06:33:08.291] [ERROR] [jms-arcsight…
- 13 hours ago
- OpenText ArcSight
- ArcSight Tips
Knowledge Document: ArcSight Platform pods are on an Evicted status

Caroline Oest

Some suggestions are provided whenever a set of pods are shown on the Evicted status Environment ArcSight Platform 2X.X.X with any of the below capabilities: Fusion/Core Transformation Hub SOAR Recon Intelligence Situation…
- 5 days ago
- OpenText ArcSight
- ArcSight Tips
Knowledge Document: [SOAR] Error: 'No active license' due to a DNS issue

Caroline Oest

This issue is part of KM000008641. Environment ArcSight SOAR 3.11.0 Situation The SOAR UI displays a license error, as shown in the screenshot below: After following the instructions in KM000008641, the issue was not resolved…
- 7 days ago
- OpenText ArcSight
- ArcSight Tips
New ArcSight ESM Administrator and Analyst Training Class

Caroline Oest

Learn how to use the ArcSight console and ArcSight Command Center to monitor security events, configure ESM, manage users, and manage ESM network intelligence resources. You will also be introduced to triaging and resolving cases with ArcSight SOAR. …
- 1 month ago
- OpenText ArcSight
- ArcSight Tips
Knowledge Document: SOAR to disable/enable duplication check on some Integration actions

Caroline Oest

Environment SOAR all versions Situation After integration done, processing actions on these might got the message "Duplicate" because the action has been proceeded but not yet got response. There's a need to skip the duplication check on these integrations…
- 1 month ago
- OpenText ArcSight
- ArcSight Tips
Knowledge Document: SOAR alternative capability to Send Email To Scope Item Recipients

Caroline Oest

SOAR alternative capability to Send Email To Scope Item Recipients Environment SOAR 3.11 ArcSight Platform 24.2 Situation The SMTP Action capability "Send Email To Scope Item Recipients" will send email with some blank fields with HTML…
- 1 month ago
- OpenText ArcSight
- ArcSight Tips
Knowledge Document: SOAR to import playbook from older version

Caroline Oest

"Invalid workflow template selected" issue Environment SOAR version 3.11 Situation There're situations that playbook(s) need to be synced from an older versions of SOAR or downloaded from marketplace to the later one such as 3.11.…
- 1 month ago
- OpenText ArcSight
- ArcSight Tips
Updated ArcSight ESM Administrator and Analyst course

Caroline Oest

This Instructor-led 5-day class is an introductory course you learn how to use the ArcSight console and ArcSight Command Center to monitor security events, configure ESM, manage users, and manage ESM network intelligence resources. You will also be introduced…
- 2 months ago
- OpenText ArcSight
- ArcSight Tips
Integrate Platform and SOAR to existing SIEM

maresj

Hello, currently I have software version of Logger,ArcMC and ESM on separated servers. If I want to use SOAR and other Arcsight Platform products can I just setup 4th server with CDF and then use for example this config " example-install-config-recon…
- 5 months ago
- OpenText ArcSight
- ArcSight Discussions
Scheduled playbook editor in SOAR

Martinien Brou

Hello everyone, I've been trying a build a python script through the scheduled playbook editor on the SOAR but I'm facing some difficulties: First, I checked the python interpreter installed on it. import sys print(sys.version) 2.7.3.1-SNAPSHOT (version…
- 5 months ago
- OpenText ArcSight
- ArcSight Discussions
Is it possible to make the SOAR use local server files ?

Martinien Brou

Hello everyone, I'm trying some configurations where I need the SOAR to use local files and send it to some other parties by mail. Is that possible ? Best Regards, Marty
- 6 months ago
- OpenText ArcSight
- ArcSight Discussions
Downloading Arcsight reports with the SOAR

Martinien Brou

Hello everyone ! Could you please help me with ideas for a problem I'm currently facing. In our company, we just integrated the SOAR platform. And there are a bunch of tasks that we'd like to automate land the first one is sending the reports to…
- 6 months ago
- OpenText ArcSight
- ArcSight Discussions
Request for Inclusion of Email Gateway Security Device Mail Marshal in SOAR automation/Blocking

Soc Analyst

Hi Team, We're using arcsight SIEM & SOAR for last 6 years & 1 year respectively. We need to integrate Mail Marshal which is used as email gateway security in our organization. Kindly consider integrating the device with SOAR asap. We also can project…
- 8 months ago
- OpenText ArcSight
- ArcSight Ideas
Trend Micro Integration for ArcSight SOAR

Karl Gustav

Hello, I have already owned an old integration code from Trend Micro vendo for Deep Discovery Analyzer. I try to convert or take piece by piece from old code an try to build a plugin for ArcSight according to desired structure in documentatio below. An…
- 9 months ago
- OpenText ArcSight
- ArcSight Discussions
Integrate ITSM with ArcSight SOAR

Vikas Rawat

Integrate ITSM with ArcSight SOAR for create incident update incident and close incident
- 9 months ago
- OpenText ArcSight
- ArcSight Discussions
ArcSight SOAR Case

Yang Lichien

I use ESM as the Alert Source for SOAR, but the rule in ESM triggers only when the same source Address and URL occur 1000 times within 24 hours, whereas SOAR Case triggers for every single event. Where should I adjust this?
- 10 months ago
- OpenText ArcSight
- ArcSight Discussions
SOAR Case Classification

mcglynn1

Allow Classification using scope value matches regex and scope value does not match regex. This ability is used for other functionality and filters in SOAR.
- 10 months ago
- OpenText ArcSight
- ArcSight Ideas
SOAR integration

Desmond Ozurumba

Hello Team SOAR does not work with FortiGate Multi-VDOM environment. Currently SOAR only add IP address or URLs to root VDAM on FortiGate. This is a limitation. Our organisation It is an important feature to have Kindly take it as a priority …
- over 1 year ago
- OpenText ArcSight
- ArcSight Ideas
Soar Case Search Scope Item Value Operators

mcglynn1

Soar Case Search Scope Item Value Operators allow for contains, not contains in subnet and not in subnet. This feature would allow for more precise search operators such as Equals. Current our IPS feeds events to SOAR and has Blocked or Would be Blocked…
- over 1 year ago
- OpenText ArcSight
- ArcSight Ideas
SOAR allow sharing and/or export of case search filters

mcglynn1

In soar you can create search filters for viewing cases. The filters are unique per user and does not allow sharing among other users. This feature would allow filters to be created per user or be able to share filters with other users or users in the…
- over 1 year ago
- OpenText ArcSight
- ArcSight Ideas
Assigning IP addresses from SOAR to Multiple VDOM on FortiGate

Joy Eku

Hello Opentext, FortiGate Multi-VDOM environment is not compatible with SOAR. At present, SOAR only appends IP addresses or URLs to the root VDOM on FortiGate, presenting a significant limitation. Our project integrating SOAR with FortiGate is currently…
- over 1 year ago
- OpenText ArcSight
- ArcSight Ideas
SOAR-Adding IP Addresses to Multi-VDOM on FortiGate

chukwuemelie

Hello Opentext, SOAR does not work with FortiGate Multi-VDOM environment. Currently SOAR only add IP address or URLs to root VDAM on FortiGate. We are currently stuck with the project on SOAR-FortiGate integration and support confirmed to us that…
- over 1 year ago
- OpenText ArcSight
- ArcSight Ideas
SOAR should support integrate with Symantec Bluecoat Proxy SG version 7.3

Vikas Rawat

SOAR should support integrate with Bluecoat Proxy SG version 7.3, as the last supported version shows 6.6 which is too old as compare to latest version.
- over 1 year ago
- OpenText ArcSight
- ArcSight Ideas
Create a playbook that runs on a regular basis with "Create Workflow Playbook" not "SCHEDULED PLAYBOOKS"

Hongyu Zhang

I have a question about "SCHEDULED PLAYBOOKS" (RESPOND > Playbooks > SCHEDULED PLAYBOOKS) I would like to create a playbook that runs on a regular basis. Is the above "SCHEDULED PLAYBOOKS" the only way to achieve this? Is it possible to create a playbook…
- over 1 year ago
- OpenText ArcSight
- ArcSight Ideas
SOAR-Adding IP Addresses to Multi-VDOM on FortiGate

JohnMmeni01

Hello Team SOAR does not work with FortiGate Multi-VDOM environment. Currently SOAR only add IP address or URLs to root VDAM on FortiGate. This is a limitation. We are stuck with the project on SOAR-FortiGate integration and support confirmed to us…
- over 1 year ago
- OpenText ArcSight
- ArcSight Ideas

Menu

OpenText ArcSight

Knowledge Document: Alert can not create any cases with base events on SOAR

Knowledge Document: ArcSight Platform pods are on an Evicted status

Knowledge Document: [SOAR] Error: 'No active license' due to a DNS issue

New ArcSight ESM Administrator and Analyst Training Class

Knowledge Document: SOAR to disable/enable duplication check on some Integration actions

Knowledge Document: SOAR alternative capability to Send Email To Scope Item Recipients

Knowledge Document: SOAR to import playbook from older version

Updated ArcSight ESM Administrator and Analyst course

Integrate Platform and SOAR to existing SIEM

Scheduled playbook editor in SOAR

Is it possible to make the SOAR use local server files ?

Downloading Arcsight reports with the SOAR

Request for Inclusion of Email Gateway Security Device Mail Marshal in SOAR automation/Blocking

Trend Micro Integration for ArcSight SOAR

Integrate ITSM with ArcSight SOAR

ArcSight SOAR Case

SOAR Case Classification

SOAR integration

Soar Case Search Scope Item Value Operators

SOAR allow sharing and/or export of case search filters

Assigning IP addresses from SOAR to Multiple VDOM on FortiGate

SOAR-Adding IP Addresses to Multi-VDOM on FortiGate

SOAR should support integrate with Symantec Bluecoat Proxy SG version 7.3

Create a playbook that runs on a regular basis with "Create Workflow Playbook" not "SCHEDULED PLAYBOOKS"

SOAR-Adding IP Addresses to Multi-VDOM on FortiGate

Resources

Menu

Popular Tags

Resources