I am trying to configure CEF formatted logs in 4.6. Even though i configured data source as Arcsight (CEF) device, in logs its showing me "ArcSight CEF? False" and arcsight pre-processor is not getting called.

Is there any other file where we need to configure this in 4.6.

asked 18 Sep '14, 01:23

Praful's gravatar image

Praful ♦♦
1264923
accept rate: 5%


In 4.6 , there is no dependency on the resource type, Its present in more setting under Step 2

link

answered 18 Sep '14, 01:24

Praful's gravatar image

Praful ♦♦
1264923
accept rate: 5%

Also you can specify custom diff config files for different resource types that have data coming in the CEF format. No longer restricted to just arc sight resource.

link

answered 15 Oct '14, 14:20

anjan's gravatar image

anjan ♦♦
1112311
accept rate: 22%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×4
×2

Asked: 18 Sep '14, 01:23

Seen: 1,005 times

Last updated: 15 Oct '14, 14:20