ArcSight SOAR "from the ground up" Build Guide

steve-m

4 Likes

over 3 years ago

April 1, 2022

These guides walk through adding SOAR to an existing ESM deployment. First, we’ll cover ESM content that needs to be configured. Next, we’ll install the ArcSight Platform “from the ground up” with CentOS 7.9 Minimal installed nodes. Then, we’ll configure SOAR using the Fusion interface and install the Forwarding Connector. Finally, we’ll configure SSO with Fusion and ESM. There’s also a troubleshooting section, as well as information on integrating SOAR with MITRE ATT&CK and MISP (Malware Information Sharing Platform).

ArcSight ESM 7.6 now includes the SOAR/ESM content as a part of default content. If you're running ESM 7.6 or upgrade to ESM 7.6, this package is included as part of the release and you don't need to download the "ArcSight ESM and SOAR Integration Content" from Marketplace. If you're running a version previous to ESM 7.6, a link to the SOAR/ESM content is below.

ArcSight SOAR 3.2 / ESM 7.6

PDF

ArcSight SOAR 3.1 / ESM 7.5

PDF

ArcSight ESM 7.5 and SOAR 3.1 Integration Content

https://marketplace.microfocus.com/arcsight/content/arcsight-esm-and-soar-integration-content

Tags:

ESM

Mitre Att&ck

ArcSight

Threat Intelligence

ArcSight SOAR

SecOps

Labels:

How To-Best Practice

steve-m over 2 years ago in reply to Edificer

Please contact Support, I've seen this before and they should have a fix for it.
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
Edificer over 2 years ago in reply to steve-m

i have an issue regarding

(Login to the ITOM Management Portal using “admin” and the “CDF administrator password” you specified during the “install” phase)

when ever i try to login it says invalid user, and my login :

admin: cdf password

but i can not login and i have been reinstalling and doing it over and over again on both redhat and centos but no use

please help me
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
steve-m over 2 years ago

I have attached an updated Build Guide for the 2022.1 release (SOAR 3.2 and ESM 7.6). ESM 7.6 now includes the SOAR/ESM content as a part of default content. If you're running ESM 7.6 or upgrade to ESM 7.6, this package is included as part of that release and you don't need to download the "ArcSight ESM and SOAR Integration Content" from Marketplace.
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
steve-m over 2 years ago

This content is now included with ArcSight ESM 7.6.
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
brettpladna81 over 3 years ago

Steve,

I know it's not relevant to this guide but for BIND, I would put those files you put in /etc/named into /var/named. I know for SELinux and permissions, it can cause problems to use /etc/named.
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel

Recommended

Menu

ArcSight Tips

ArcSight SOAR "from the ground up" Build Guide

Tags:

Labels:

Resources