XMA: How to modify FILTERS file to write to two ArcSight (LAF) devices simultaneously

XMA: How to modify FILTERS file to write to two ArcSight (LAF) devices simultaneously

Note:  LAF file and filter names will be referenced as LAFxxx or xxx, where:

xxx = ARC (XMA 2.57 and earlier versions)
           CEF  (XMA 2.60 and later versions)

If the LAF macro has already been run once to install the ArcSight adapter, the user can do the following if they want to write to a second ArcSight log from a single XMA installation:
 
  1. Make a copy of the LAFxxx  file

                Example:

                FUP DUP $SYSTEM.XYGATEMA.LAFxxx, $SYSTEM.XYGATEMA.LAFxxx2, SAVEALL
 
  1. Edit the (original) LAFxxx file.  Change all  instances of the following:
       
        EVALUATE_MSG STOP                  to            EVALUATE_MSG CONTINUE

 
  1. Edit the (new) LAFxxx2 file.   Change all instances of the following:

               ^xxx_STATUS                                to            ^xxx_STATUS2
               ^xxx_ACTIONTYPE                        to            ^xxx_ACTIONTYPE2
               ^xxx_ROUTING                             to            ^xxx_ROUTING2
               ^xxx_ALERTSTRINGS                    to            ^xxx_ALERTSTRINGS2
 
  1. All filter names in the LAFxxx2 file will also need to be changed to differentiate them from the names in the LAFxxx file.   All filter names start with $ARC (XMA 2.57 or earlier) or $CEF (XMA 2.60 or later), so this might be changed to $ARC2 or $CEF2 instead, depending on the XMA version. 

                Example:

                $ARC-LOGONS-SSH would be changed to $ARC2-LOGONS-SSH.

                  or

                $CEF-LOGONS-SSH would be changed to $CEF2-LOGONS-SSH.
 

                This pattern would be repeated for all filters in the file.
 
  1. Change filter name $ARC2-OBJECT-ACCESS-SUCCESS-XYGAT to $AR2-OBJECT-ACCESS-SUCCESS-XYGAT.  This is to prevent a possible error when the syntax check is run, due to a too-long filter name.   In an XMA 2.60 file, this would be $CEF2-OBJECT-ACCESS-SUCCESS-XYGAT to $CF2-OBJECT-ACCESS-SUCCESS-XYGAT. 
  1. Edit the FILTERS file using the XMA_EDIT_FILTERS macro or the XCF GUI.   Find the ArcSight log  filter entry:


Example (XMA 2.57 or earlier FILTERS file):

                ! Begin ArcSight Log Adapter Filters - Version 1.22
                #DEFINE ^ARC_STATUS ACTIVE
                #DEFINE_BEGIN ^ARC_ACTIONTYPE
                ! TCP
                  ACTIONTYPE SYSLOGQ
                 IPALERT_MSGDELIMITER CR
                #DEFINE_END
                #DEFINE_BEGIN ^ARC_ROUTING
                 IPALERT_ADDRESS 192.168.11.127
                 IPALERT_PORT 514
                 IPALERT_IPPROCESS $ZTC0
                #DEFINE_END
                #INCLUDE \CHICAGO.$VTDW8.XMA260.LAFARC              
                ! End ArcSight Log Adapter Filters

                Copy all of the lines in this filter (shown in bold in the example) and paste to make a second
                LAF filter.  Make the necessary changes for the second ArcSight device (shown in red).


                Example (XMA 2.57 or earlier FILTERS file):

                #DEFINE ^ARC_STATUS ACTIVE
                #DEFINE_BEGIN ^ARC_ACTIONTYPE
                ! TCP
                  ACTIONTYPE SYSLOGQ
                 IPALERT_MSGDELIMITER CR
                #DEFINE_END
                #DEFINE_BEGIN ^ARC_ROUTING
                 IPALERT_ADDRESS 192.168.11.127
                 IPALERT_PORT 514
                 IPALERT_IPPROCESS $ZTC0
                #DEFINE_END
                #INCLUDE \CHICAGO.$VTDW8.XMA260.LAFARC
                !
                !
                #DEFINE ^ARC_STATUS2 ACTIVE
                #DEFINE_BEGIN ^ARC_ACTIONTYPE2
                ! TCP
                  ACTIONTYPE SYSLOGQ
                 IPALERT_MSGDELIMITER CR
                #DEFINE_END
                #DEFINE_BEGIN ^ARC_ROUTING2
                 IPALERT_ADDRESS 192.168.22.13
                 IPALERT_PORT 515
                 IPALERT_IPPROCESS $ZTC0
                #DEFINE_END
                #INCLUDE \CHICAGO.$VTDW8.XMA260.LAFARC2


^ARC_STATUS2, ^ARC_ACTIONTYPE2 and ^ARC_ROUTING2  should match the changes made to the LAFARC2 file.  The file referenced in the #INCLUDE for the second filter should be the LAFARC2 file.   There?s no reason to use two different TCP/IP stacks  unless there is a need due to routing or network issues.

Remember - in an XMA 2.60 or later FILTERS file, all instances of "^ARC"  will be  represented as "^CEF".

 
  1. Save and exit the FILTERS file.

If this article did not provide a solution, please open a case with our support team by sending an email message to support@xypro.com.