ArcSight Integration with SureMDM
To integrate ArcSight with the SureMDM Web Console, follow these steps:
- Navigate to SureMDM Web Console > Settings (icon located at the top-right of the screen) > Account Settings > SIEM Integration.
- Configure the following settings and click Validate.
| Settings | Description |
|---|---|
| Enable SIEM Integration | Enable this option to allow configuration of SIEM settings. |
| Select Server | Select ArcSight from the dropdown menu. |
| Syslog Format | Select either RFC5424 or RFC3164, based on your ArcSight configuration. |
| Server Address | Enter the IP address or Fully Qualified Domain Name (FQDN) of the ArcSight server. |
| Port | Enter the port number configured in ArcSight to receive syslog events. |
| Protocol | Select the communication protocol (TCP, UDP, or TCP/TLS) configured in ArcSight. |
| TCP Message Framing | Select the TCP message framing option required by your ArcSight configuration. Otherwise, retain the default value (None). |
After the configuration is successfully validated, SureMDM will forward system activity logs and device logs to ArcSight using the configured syslog settings.
Related ArcSight Articles
For additional information about ArcSight SmartConnectors, refer to the following official documentation:
Disclaimer
The third-party configuration steps in this article are based on the vendor's documentation available at the time of publication and may change. Always refer to the official vendor documentation for the latest instructions.