ArcSight Enterprise Security Manager

Overview

ArcSight Enterprise Security Manager (ESM) provides a big data analytics approach to enterprise security by transforming big data into actionable intelligence.

D3's integration with ArcSight ESM provides the ability to ingest security events based on a query viewer and manage active lists and entries.

D3 SOAR is providing REST operations to function with ArcSight Enterprise Security Manager.

ArcSight Enterprise Security Manager is available for use in:

D3 SOAR	V15.2.26.0+
Category	SIEM
Deployment Options	Option II, Option IV

Connection

To connect to ArcSight Enterprise Security Manager from D3 SOAR, please follow this part to collect the required information below:

Parameter	Description	Example
Server URL	The server URL of the ArcSight ESM instance.	https://1.1.1.1:1234
User Name	The Arcsight ESM account username for authentication.	admin
Password	The Arcsight ESM account password for authentication.	PASSWORD

Permission Requirements

All endpoints in the ArcSight Enterprise Security Manager API require the Normal User permission scope.

Reader Note

ArcSight Enterprise Security Manager’s default user profiles with description are as follows:

Normal User: Has full privileges to use the Command Center and ArcSight Console, and all tools. Only apply this user type to accounts that actually need access to the ArcSight Manager.
Management Tool: Has only the privileges needed to run certain management tools used in conjunction with network management products.
Forwarding Connector: Has only the privileges needed by the Forwarding Connector.
Archive Utility: Has only the privileges needed to run the archive utility. Access to specific resources is controlled through ACLs.
Connector Installer: A specialized identity used only to add SmartConnectors to the system.
Web User: Has privileges to use the Command Center only, not the ArcSight Console.

Please note that only the Normal User User Type can be used in order to use D3 connection and commands.

Configuring ArcSight Enterprise Security Manager to Work with D3 SOAR

ArcSight Command Center VS ArcSight Management Console

ArcSight is using both a client service (ArcSight Command Center) and a browser server (ArcSight Management Console).

ArcSight Command Center is a web interface for ArcSight ESM. You can access the ESM server via the ArcSight Console or a web browser (ArcSight Command Center). There are features you can view and perform in the Console but not in the Command Center, and vice versa.

ArcMC (ArcSight Management Console) is a single management interface for administering and monitoring.

If you have sufficient licensing on the ArcSight Management Console, it is recommended to use the ArcSight Management Console. If you need to create more users on the console, create an analyst profile from the ArcSight Command Center. For more about the differences between ArcSight Command Center and ArcSight Management Console, see the linked user manuals above. D3 SOAR will require the ArcSight Management Console for configuration. Configured users can access the ArcSight Command Center.

Adding a New User with Permissions from the ArcSight Management Console

Connect to the ArcSight Management Console.
On the left sidebar, select the Resources tab. Select Users from the dropdown list. Alternatively, you can use the shortcut (Ctrl+Alt+U). Under Shortcuts, find the default admin at Users > Shared > Administrator. You may use the default admin user or create a new user for the integration connection. To add a new user, right click the Administrator folder and select New User.
(Optional) Complete the configuration of the new user. Fill in the required fields (i.e., User ID, Password and Confirm) for the user. Select Normal User for User Type. It is highly recommended to input an E-mail for password recovery purposes. Click OK to confirm your configurations and create the user.

Reader Note

The created user account can be used to access the ArcSight Command Center.

Configuring D3 SOAR to Work with ArcSight Enterprise Security Manager

Log in to D3 SOAR.
Find the ArcSight Enterprise Security Manager integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type ArcSight Enterprise Security Manager in the search box to find the integration, then click it to select it.
4. Click New Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to ArcSight Enterprise Security Manager.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add your desired description for the connection.
6. Configure User Permissions: Defines which users have access to the connection.
7. Active: Check the tick box to ensure the connection is available for use.
8. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input your domain level Server URL.
  2. Input your User Name.
  3. Input your Password.
9. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.
10. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
  To set up a connection health check, check the Connection Health Check tickbox. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.
Test the connection.
1. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.
2. Click OK to close the alert window.
3. Click Add to create and add the configured connection.

Commands

ArcSight Enterprise Security Manager includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the ArcSight Enterprise Security Manager API, please refer to the ArcSight Enterprise Security Manager API reference at https://<server address>/detect-api/#/.

Reader Note

Certain permissions are required for each command. Please refer to the Permission Requirements and Configuring ArcSight Enterprise Security Manager to Work with D3 SOAR for details.

Note for Time-related parameters

The input format of time-related parameters may vary based on your account settings. As a result, the sample data provided in our commands is different from what you see. To set your preferred time format, follow these steps:

Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose your desired date and time format.

After that, you will be able to view your preferred time format when configuring the DateTime input parameters for commands.

Add Active List Entries

Adds new entries to the specified active list.

Reader Note

Active List ID and Entries are required parameters to run this command.

Run the List Active Lists command to obtain Active List IDs. Active List IDs can be found in the returned raw data at the path $[*].resourceId.
Run the List Active List Entries command to view a list of all available entry fields. Entries can be found in the returned raw data at the path $.fields.
If the input entry fields and their order are different from the active list’s existing columns, the error message “Entries have different columns” will be returned.

Input

Input Parameter	Required/Optional	Description	Example
Active List ID	Required	The ID of the active list to add the new entries. Active List IDs can be obtained using the List Active Lists command.	H***Uf1nE1b0w==
Entries	Required	The entry object(s) to add to the specified active list. You may run the List Active List Entries command to view a list of all available fields in an active list. Note: The input entry fields and their order must match the existing columns and their order in the specified active list.	[ { "hostName": "test-host", "EventID": "12345678" } ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "fields": [
        "hostName",
        "StartTime",
        "LastEventReceived",
        "EventID"
    ],
    "entries": [
        {
            "fields": [
                "server-dns1",
                "",
                "",
                "12345678"
            ]
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "Columns": [
        "hostName",
        "StartTime",
        "LastEventReceived",
        "EventID"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

fields	hostName StartTime LastEventReceived EventID
entries	{'fields': ['server-dns1', '', '', '12345678']}

Error Handling

If the Return Data or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add Active List Entries failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Add Active List Entries failed.

Status Code: 404.

Message: Resource Not Found.

Clear Active List Entries

Clears all entries from the specified active list.

Reader Note

Active List ID is a required parameter to run this command.

Run the List Active Lists command to obtain Active List IDs. Active List IDs can be found in the returned raw data at the path $[*].resourceId.

Input

Input Parameter	Required/Optional	Description	Example
Active List ID	Required	The ID of the active list to clear all entries. Active List IDs can be obtained using the List Active Lists command.	HN***b0w==

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "fields": [
        "hostName",
        "StartTime",
        "LastEventReceived",
        "EventID"
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "Columns": [
        "hostName",
        "StartTime",
        "LastEventReceived",
        "EventID"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

fields

hostName
StartTime
LastEventReceived
EventID

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Clear Active List Entries failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Clear Active List Entries failed.

Status Code: 404.

Message: Resource Not Found.

Create Active List

Creates an active list.

Reader Note

Parent Group ID is an optional parameter to run this command.
- Run the Get Active List Path command to obtain Parent Group IDs. Parent Group IDs can be found in the path $.[*]pathToRoot.
You can create multiple active lists with the same name.

Input

Input Parameter	Required/Optional	Description	Example
Active List Name	Required	The name of the active list.	testAL
Active List Display Name	Optional	The display name of the active list. If this parameter is not defined, the active list name will be the display name.	TESTAL
Description	Optional	The description for the active list.	desc
Multi-mapped	Optional	The option to enable the active list to have multiple instances of field pairings mapped to multiple values. If this parameter is not defined, the default value is False.	True
Cache Model	Optional	The cache model used for the active list. The available options are Read Optimized, Write Synchronized and Unchanged. If this parameter is not defined, the default value is Read Optimized.	Read Optimized
Active List Type	Required	The active list type (Event Based or Field Based). Event Based active lists are “fixed” while Field Based active lists are more flexible. Note: The Fields parameter is only available if Field Based is selected. The Active List Type cannot be modified after the active list has been created. Ensure you have selected the correct active list type.	Field Based
Case Sensitive Type	Required	The case-sensitive setting to apply to the active list. The available case-sensitive types are Case Sensitive, Key Case Insensitive and Key and Value Insensitive.	Case Sensitive
Parent Group ID	Optional	The ID of the group to assign the active list to. If this parameter is not defined, the active list will be created as Unassigned. Group IDs can be obtained using the Get Active List Path command. Note: The assigned group cannot be modified after the active list has been created.	0JDIt***c1zbw==
Fields	Optional	The JSON-formatted list of fields of the active list. Note: This parameter is only available when the selected Active List Type is Field Based. Fields cannot be modified after the active list has been created. Ensure you have input the correct fields.	[ { "name": "EventID", "type": "String", "key": false }, { "name": "hostName", "type": "String", "key": true }, { "name": "LastEventReceived", "type": "Date", "key": false }, { "name": "StartTime", "type": "Date", "key": true } ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "resourceId": "***",
    "name": "testAL",
    "alias": "TESTAL",
    "description": "desc",
    "reference": {
        "id": "***",
        "uri": "/All Active Lists/ArcSight Administration/Devices/TESTAL",
        "referenceString": "",
        "managerID": "***",
        "referenceType": 24,
        "isModifiable": true,
        "referenceName": "ActiveList"
    },
    "type": 1,
    "typeName": "ActiveList",
    "isAdditionalLoaded": false,
    "modificationCount": 0,
    "createdTimestamp": 1667341076505,
    "modifiedTimestamp": 1667341076505,
    "disabled": false,
    "inactive": false,
    "deprecated": false,
    "localID": ***,
    "state": 2,
    "creatorName": "admin",
    "modifierName": "admin",
    "optimizeData": false,
    "capacity": 10000,
    "entryTimeToLive": 0,
    "multiMap": true,
    "partialCache": false,
    "timePartitioned": false,
    "activeListType": "FIELD_BASED",
    "caseSensitiveType": "CASE_SENSITIVE",
    "countLimit": 0,
    "cacheModel": "READ_OPTIMIZED",
    "initialized": true,
    "uri": "/All Active Lists/ArcSight Administration/Devices/TESTAL",
    "inCache": true,
    "attributeInitializationInProgress": false,
    "signature": {
        "id": "***",
        "modificationCount": 0
    },
    "displayName": "TESTAL",
    "fields": [
        {
            "name": "hostName",
            "type": "String",
            "key": true
        },
        {
            "name": "StartTime",
            "type": "Date",
            "key": true
        },
        {
            "name": "LastEventReceived",
            "type": "Date",
            "key": false
        },
        {
            "name": "EventID",
            "type": "String",
            "key": false
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "ActiveListName": "testAL",
    "ActiveListID": "***",
    "ActiveListURI": "/All Active Lists/ArcSight Administration/Devices/TESTAL",
    "Description": "desc"
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

resourceId	Hx***=
name	testAL
alias	TESTAL
description	desc
reference	{'id': 'HxMd*=', 'uri': '/All Active Lists/ArcSight Administration/Devices/TESTAL', 'referenceString': '', 'managerID': 'XT*=', 'referenceType': 1, 'isModifiable': True, 'referenceName': 'ActiveList'}
type	1
typeName	ActiveList
isAdditionalLoaded	False
modificationCount	0
createdTimestamp	1667341076505
modifiedTimestamp	1667341076505
disabled	False
inactive	False
deprecated	False
localID	***
state	2
creatorName	admin
modifierName	admin
optimizeData	False
capacity	10000
entryTimeToLive	0
multiMap	True
partialCache	False
timePartitioned	False
activeListType	FIELD_BASED
caseSensitiveType	CASE_SENSITIVE
countLimit	0
cacheModel	READ_OPTIMIZED
initialized	True
uri	/All Active Lists/ArcSight Administration/Devices/TESTAL
inCache	True
attributeInitializationInProgress	False
signature	{'id': 'HxM***=', 'modificationCount': 0}
displayName	TESTAL
fields	{'name': 'hostName', 'type': 'String', 'key': True} {'name': 'StartTime', 'type': 'Date', 'key': True} {'name': 'LastEventReceived', 'type': 'Date', 'key': False} {'name': 'EventID', 'type': 'String', 'key': False}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Create Active List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Create Active List failed.

Status Code: 404.

Message: Resource Not Found.

Delete Active List Entries

Deletes select entries from the specified active list.

Reader Note

Active List ID and Entries are required parameters to run this command.

Run the List Active Lists command to obtain Active List IDs. Active List IDs can be found in the returned raw data at the path $[*].resourceId.
Run the List Active List Entries command to view a list of all available entry fields. Entries can be found in the returned raw data at the path $.fields.
If the input entry fields and their order are different from the active list’s existing columns, the error message “Entries have different columns” will be returned.

Input

Input Parameter	Required/Optional	Description	Example
Active List ID	Required	The ID of the active list to delete entries. Active List IDs can be obtained using the List Active Lists command.	HN***=
Entries	Required	The entry object(s) to delete from the specified active list. You may run the List Active List Entries command to view a list of all available fields in an active list. Note: The input entry fields and their order must match the existing columns and their order in the specified active list.	[ { "hostName": "host", "EventID": "12345678" } ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "fields": [
        "hostName",
        "StartTime",
        "LastEventReceived",
        "EventID"
    ],
    "entries": [
        {
            "fields": [
                "DESKTOP-123",
                "",
                "",
                "12345678"
            ]
        },
        {
            "fields": [
                "DESKTOP-789",
                "",
                "",
                "12345679"
            ]
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "Columns": [
        "hostName",
        "StartTime",
        "LastEventReceived",
        "EventID"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

fields	hostName StartTime LastEventReceived EventID
entries	{'fields': ['DESKTOP-123', '', '', '12345678']} {'fields': ['DESKTOP-789', '', '', '76233910']}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Delete Active List Entries failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Delete Active List Entries failed.

Status Code: 404.

Message: Resource Not Found.

Delete Active Lists

Deletes the specified active list(s).

Reader Note

The parameter Active List IDs is required to run this command.

Run the List Active Lists command to obtain Active List IDs. Active List IDs can be found in the returned raw data at the path $[*].resourceId.

Input

Input Parameter	Required/Optional	Description	Example
Active List IDs	Required	The ID(s) of the active list(s) to delete. Active List IDs can be obtained using the List Active Lists command.	[ "Hx***g==" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "resourceId": "HxM***=",
        "Status": "204 No Content",
        "Message": "Resource Is deleted successfully."
    }
]

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

RESOURCEID	STATUS	MESSAGE
H***=	204 No Content	Resource Is deleted successfully.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Delete Active Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Delete Active Lists failed.

Status Code: 404.

Message: Resource Not Found.

Fetch Event

Returns event(s) from the ArcSight ESM platform based on specified query view. Query views must be created from the ArcSight console first, after which the corresponding query viewer ID can be obtained using the Get Query Viewer command. "Event ID" and at least one other time field must be included in the data fields. Run the Get Query Viewer command and check the values under the “columnHeaders” key.

Reader Note

Before inputting a Query Viewer ID for the Fetch Event command, use the Get Query Viewer command to check if it has an “Event ID” and at least one of the associated time-related fields. The fields will be returned under the “columnHeaders” key. See the list below for the time-related fields.

Query Time Type is an optional parameter to run this command. Some possible query time types (only the query time types listed in the returned result of running the Get Query Viewer command are applicable) are as follows:

Start Time
End Time
Agent Receipt Time
Manager Receipt Time
Device Time
Event Time

Input

Input Parameter	Required/Optional	Description	Example
Start Time	Required	The start time of the time range to fetch events in UTC time.	2022-11-01 00:00
End Time	Required	The end time of the time range to fetch events in UTC time.	2022-11-02 00:00
Query Time Type	Optional	The time field to fetch events by. Run the Get Query Viewer command and refer to the returned raw data at the path $.data.columnHeaders for a list of available time fields (e.g. Manager Receipt Time). In most cases, Manager Receipt Time is treated as Event Time. Note: If this parameter is not defined, the default query time field is Manager Receipt Time.	Manager Receipt Time
Number of Event(s) Fetched	Optional	The maximum number of the most recent results from the specified query viewer to return. If this parameter is not defined, 50 is the default value.	10
Query Viewer IDs	Required	The IDs of the created query views to filter results. Query views must first be created on the ArcSight ESM user interface. Existing Query Viewer IDs can be obtained using the Get Query Viewer command. Note: It is recommended to limit the query time range (e.g. less than 30 days) when creating a query viewer from the ArcSight ESM user interface to reduce impact on performance.	cZ-m***SthA==
Tolerance Scope	Optional	The tolerance scope in minutes of the query to fetch events between start and end time to avoid the loss of events. Events will be fetched between {Start Time - Tolerance Scope, End Time}.	10

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "eventId": ***,
        "managerId": ***,
        "name": "Start event: query viewer generation 2022102603",
        "type": "BASE",
        "startTime": 1667338317601,
        "endTime": 1667338317601,
        "managerReceiptTime": 1667338317601,
        "bytesIn": -123456,
        "bytesOut": -12467,
        "sessionId": -9223***00,
        "generator": {
            "id": "cZ-m9***=",
            "uri": "/All Query Viewers/Personal/admin's Query Viewers/2022102603",
            "referenceString": "",
            "referenceID": ***,
            "managerID": "XTt***=",
            "referenceType": 51,
            "isModifiable": false,
            "referenceName": "QueryViewer"
        },
        "agent": {
            "mutable": true,
            "hostName": "hostname",
            "address": ***,
            "addressAsBytes": "wK***=",
            "zone": {
                "id": "M-fU***UdQ==",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 1.1.1.1-1.1.1.2",
                "referenceString": "",
                "referenceID": ***,
                "managerID": "XTt***Q==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetLocalId": -922***76000,
            "translatedAddress": -9223***000,
            "macAddress": -92***6000,
            "version": "7***.0",
            "id": "3pzt***3w==",
            "type": "arcsight_security_manager",
            "name": "Manager Internal Agent"
        },
        "device": {
            "mutable": true,
            "hostName": "hostname",
            "address": 32***03,
            "addressAsBytes": "w***==",
            "zone": {
                "id": "M-fU***pYAT3UdQ==",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 1.1.1.1-1.1.1.2",
                "referenceString": "",
                "referenceID": ***,
                "managerID": "XTtdz***Q==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetId": "4L***==",
            "assetLocalId": 171***5,
            "translatedAddress": -9223***6000,
            "macAddress": -922***4776000,
            "assetName": "assetname",
            "version": "7.***.0",
            "vendor": "ArcSight",
            "product": "ArcSight"
        },
        "concentratorAgents": [
            {
                "mutable": true,
                "hostName": "hostname",
                "address": 32***03,
                "addressAsBytes": "wK***=",
                "zone": {
                    "id": "M-fU3***Q==",
                    "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 1.1.1.1-1.1.1.2",
                    "referenceString": "",
                    "referenceID": ***,
                    "managerID": "XTtd***==",
                    "referenceType": 29,
                    "isModifiable": false,
                    "referenceName": "Zone"
                },
                "assetLocalId": -92233***00,
                "translatedAddress": -9223***6000,
                "macAddress": -9223***6000,
                "version": "7.***.0",
                "id": "3pztd***==",
                "type": "arcsight_security_manager",
                "name": "Manager Internal Agent"
            }
        ],
        "modelConfidence": 4,
        "severity": 0,
        "relevance": 10,
        "assetCriticality": 0,
        "priority": 3,
        "agentSeverity": 1,
        "agentReceiptTime": -922***000,
        "deviceEventCategory": "/QueryViewer/Generate",
        "deviceSeverity": "Warning",
        "deviceReceiptTime": 16673***1,
        "deviceEventClassId": "queryviewer:1",
        "deviceProcessId": -21***648,
        "deviceDirection": -214***48,
        "file": {
            "name": "2022102603",
            "path": "/All Query Viewers/Personal/admin's Query Viewers/2022102603",
            "type": "QueryViewer",
            "size": -922337***6000,
            "createTime": -922337***6000,
            "modificationTime": -92233***000
        },
        "originator": "SOURCE",
        "source": {
            "mutable": true,
            "hostName": "1.1.1.1",
            "address": 32***910,
            "addressAsBytes": "wK***==",
            "zone": {
                "id": "M-fU32***Q==",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 1.1.1.1",
                "referenceString": "",
                "referenceID": 2,
                "managerID": "XTtdzY***uQ==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetId": "49AQ9***==",
            "assetLocalId": 171***87,
            "translatedAddress": -92233***6000,
            "macAddress": -9223***76000,
            "assetName": "1.1.1.1",
            "processId": -21***48,
            "port": -21***48,
            "translatedPort": -21***8,
            "serviceName": "/X***pc",
            "geo": {
                "mutable": true,
                "longitude": 0,
                "longitudeLong": 0,
                "latitude": 0,
                "latitudeLong": 0
            }
        },
        "destination": {
            "mutable": true,
            "hostName": "esm.**t",
            "address": 323***903,
            "addressAsBytes": "wK***==",
            "zone": {
                "id": "M-fU32***3UdQ==",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 2.2.2.2",
                "referenceString": "",
                "referenceID": 5,
                "managerID": "XTtdzYI***Q==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetId": "4Lztd***dVg==",
            "assetLocalId": 171***185,
            "translatedAddress": -92233***76000,
            "macAddress": -92**7**00,
            "assetName": "esm***",
            "processId": -214***8,
            "port": 8443,
            "translatedPort": -21***,
            "userName": "admin",
            "userId": "1KXNS***uQ==",
            "geo": {
                "mutable": true,
                "longitude": 0,
                "longitudeLong": 0,
                "latitude": 0,
                "latitudeLong": 0
            }
        },
        "baseEventCount": 1,
        "deviceCustomString1": "",
        "deviceCustomString2": "",
        "deviceCustomString4": "1KXN***DuQ==",
        "deviceCustomNumber1": -9***00,
        "deviceCustomNumber2": -922***6000,
        "deviceCustomNumber3": -9223***00,
        "flexNumber1": -922337***00,
        "flexNumber2": -92233720***00,
        "deviceCustomDate1": 1667***1,
        "deviceCustomDate2": -92***776000,
        "flexDate1": -92233***6000,
        "deviceCustomFloatingPoint1": 5e-123,
        "deviceCustomFloatingPoint2": 5e-234,
        "deviceCustomFloatingPoint3": 5e-345,
        "deviceCustomFloatingPoint4": 5e-567,
        "deviceCustom": {
            "mutable": true,
            "string1Label": "Query Reference",
            "string2Label": "Configuration Resource",
            "string4Label": "Query Viewer Launched by",
            "date1Label": "Start time"
        },
        "eventAnnotation": {
            "stage": {
                "id": "R9***g==",
                "uri": "/All Stages/Queued",
                "referenceString": "",
                "referenceID": 1,
                "managerID": "XTtdzYI***==",
                "referenceType": 34,
                "isModifiable": false,
                "referenceName": "Stage"
            },
            "flags": 0,
            "modificationTime": 16***17601,
            "auditTrail": "1,16***29,root,Queued,,,,\n",
            "version": 1,
            "eventId": 33***7,
            "endTime": 16673***01,
            "managerReceiptTime": 16***17601,
            "stageUpdateTime": 1667***1
        },
        "locality": 0,
        "persistence": -21***83648,
        "ttl": 10,
        "dummyField": "dummyField",
        "aggregatedEventCount": 1,
        "correlatedEventCount": 0,
        "domainNumber1": -92233***6000,
        "concentratorDevices": [
            {
                "mutable": true,
                "hostName": "hostname",
                "address": 32***,
                "addressAsBytes": "wK***=",
                "zone": {
                    "id": "M-f***UdQ==",
                    "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 2.2.2.2",
                    "referenceString": "",
                    "referenceID": 1,
                    "managerID": "XTt***1uQ==",
                    "referenceType": 29,
                    "isModifiable": false,
                    "referenceName": "Zone"
                },
                "assetId": "4Lzt***g==",
                "assetLocalId": 171***5,
                "translatedAddress": -922***76000,
                "macAddress": -9223***776000,
                "assetName": "assetName",
                "version": "7***9.0",
                "vendor": "ArcSight",
                "product": "ArcSight"
            }
        ],
        "objectTypeName": "SecurityEvent",
        "originalAgent": {
            "mutable": true,
            "hostName": "hostName",
            "address": 32***903,
            "addressAsBytes": "wK***=",
            "zone": {
                "id": "M-fU***=",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 1.2.3.4",
                "referenceString": "",
                "referenceID": 1,
                "managerID": "XTtd**==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetLocalId": -9223**6000,
            "translatedAddress": -9223***6000,
            "macAddress": -922***6000,
            "version": "7.***.0",
            "id": "3pztd***",
            "type": "arcsight_security_manager",
            "name": "Manager Internal Agent"
        },
        "finalDevice": {
            "mutable": true,
            "hostName": "hostName",
            "address": 32***3,
            "addressAsBytes": "wK***=",
            "zone": {
                "id": "M-fU***==",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 3.3.3.3",
                "referenceString": "",
                "referenceID": 2,
                "managerID": "XTt***=",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetId": "4Lz***=",
            "assetLocalId": 171***5,
            "translatedAddress": -922***776000,
            "macAddress": -9223372***6000,
            "assetName": "assetName",
            "version": "7.***29.0",
            "vendor": "ArcSight",
            "product": "ArcSight"
        }
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "EventIDs": [
        "***"
    ],
    "EventNames": [
        "Start event: query viewer generation 2022102603"
    ],
    "eventTypes": [
        "BASE"
    ],
    "StartTime": [
        "November 1, 2022 9:31:57.601 PM"
    ],
    "EndTime": [
        "November 1, 2022 9:31:57.601 PM"
    ],
    "Messages": [
        ""
    ]
}

Return Data

Indicates one of the possible command execution states: Successful, Successful with No Event Data, or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

EVENTID	MANAGERID	NAME	TYPE	STARTTIME	ENDTIME	MANAGERRECEIPTTIME	BYTESIN	BYTESOUT	SESSIONID	GENERATOR	AGENT	DEVICE	CONCENTRATORAGENTS	MODELCONFIDENCE	SEVERITY	RELEVANCE	ASSETCRITICALITY	PRIORITY	AGENTSEVERITY	AGENTRECEIPTTIME	DEVICEEVENTCATEGORY	DEVICESEVERITY	DEVICERECEIPTTIME	DEVICEEVENTCLASSID	DEVICEPROCESSID	DEVICEDIRECTION	FILE	ORIGINATOR	SOURCE	DESTINATION	BASEEVENTCOUNT	DEVICECUSTOMSTRING1	DEVICECUSTOMSTRING2	DEVICECUSTOMSTRING4	DEVICECUSTOMNUMBER1	DEVICECUSTOMNUMBER2	DEVICECUSTOMNUMBER3	FLEXNUMBER1	FLEXNUMBER2	DEVICECUSTOMDATE1	DEVICECUSTOMDATE2	FLEXDATE1	DEVICECUSTOMFLOATINGPOINT1	DEVICECUSTOMFLOATINGPOINT2	DEVICECUSTOMFLOATINGPOINT3	DEVICECUSTOMFLOATINGPOINT4	DEVICECUSTOM	EVENTANNOTATION	LOCALITY	PERSISTENCE	TTL	DUMMYFIELD	AGGREGATEDEVENTCOUNT	CORRELATEDEVENTCOUNT	DOMAINNUMBER1	CONCENTRATORDEVICES	OBJECTTYPENAME	ORIGINALAGENT	FINALDEVICE
	-***	Start event: query viewer generation 2022102603	BASE		17601	1667***1	-***48	-***648	-9223***808	{'id': '*=', 'uri': "/All Query Viewers/Personal/admin's Query Viewers/2022102603", 'referenceString': '', 'referenceID': 4 'managerID': '*51uQ==', 'referenceType': 51, 'isModifiable': False, 'referenceName': 'QueryViewer'}	{'mutable': True, 'hostName': 'esm.arcsight', 'address': 3232257903, 'addressAsBytes': 'wKhXbw==', 'zone': {'id': 'M-fU32AABABCDVFpYAT3UdQ==', 'uri': '/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 1.5.2.3', 'referenceString': '', 'referenceID': 2, 'managerID': 'XTtdz*=', 'referenceType': 29, 'isModifiable': False, 'referenceName': 'Zone'}, 'assetLocalId': 5808, 'translatedAddress': -92268, 'macAddress': -922308, 'version': '7.6.0.0', 'id': '3pzt*=', 'type': 'arcsight_security_manager', 'name': 'Manager Internal Agent'}	{'mutable': True, 'hostName': 'esm.arcsight', 'address': 3*903, 'addressAsBytes': 'wKhXbw==', 'zone': {'id': 'M-fUYAT3UdQ==', 'uri': '/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 19-15', 'referenceString': '', 'referenceID': 1, 'managerID': 'XTtdzYIBABCA=', 'referenceType': 29, 'isModifiable': False, 'referenceName': 'Zone'}, 'assetId': '4Lzt=', 'assetLocalId': 1185, 'translatedAddress': -9225808, 'macAddress': -9223372808, 'assetName': 'esm.arcsight', 'version': '*729.0', 'vendor': 'ArcSight', 'product': 'ArcSight'}	[{'mutable': True, 'hostName': 'esm.arcsight', 'address': 3*03, 'addressAsBytes': '==', 'zone': {'id': 'M-fU32Q==', 'uri': '/All Zones/ArcSight System/Private Address Space Zones/RFC15', 'referenceString': '', 'referenceID': 1, 'managerID': 'X*=', 'referenceType': 29, 'isModifiable': False, 'referenceName': 'Zone'}, 'assetLocalId': -95808, 'translatedAddress': -922854775808, 'macAddress': -92854775808, 'version': '7.6.09.0', 'id': '3*gEXQqdp3w==', 'type': 'arcsight_security_manager', 'name': 'Manager Internal Agent'}]	4	0	10	0	3	1	-922337***775808	/QueryViewer/Generate	Warning	1***01	queryviewer:102	-214***48	-2***	{'name': '20221*03', 'path': "/All Query Viewers/Personal/admin's Query Viewers/2022102603", 'type': 'QueryViewer', 'size': -9225808, 'createTime': -922808, 'modificationTime': -*808}	SOURCE			1			1KXN**uJyDuQ==	-922**775808	-922**775808	-**775808	-9**75808	-**808	1**	-922**08	-92233***75808	5**4	5**24	**24	5**24			0	-2147**648	10	dummyField	1	0	-92**4775808		SecurityEvent

Fetch Event Field Mapping

Please note that Fetch Event commands require event field mapping. Field mapping plays a key role in the data normalization process part of the event pipeline. Field mapping converts the original data fields from the different providers to the D3 fields which are standardized by the D3 Model. Please refer to Event and Incident Intake Field Mapping for details.

If you require a custom field mapping, click +Add Field to add a custom field mapping. You may also remove built-in field mappings by clicking x. Please note that two underscore characters will automatically prefix the defined Field Name as the System Name for a custom field mapping. Additionally, if an input Field Name contains any spaces, they will automatically be replaced with underscores for the corresponding System Name.

As a system integration, the ArcSight Enterprise Security Manager integration has some pre-configured field mappings for default field mapping.

Default Event Source
The Default Event Source is the default set of field mappings that are applied when this fetch event command is executed. For out-of-the-box integrations, you will find a set of field mapping provided by the system. Default event source provides field mappings for common fields from fetched events . The default event source has a “Main Event JSON Path” (i.e., $) that is used to extract a batch of events from the response raw data. Click Edit Event Source to view the “Main Event JSON Path”.
- Main Event JSON Path: $
  The Main Event JSON Path determines the root path where the system starts parsing raw response data into D3 event data. The JSON path begins with $, representing the root element. The path is formed by appending a sequence of child elements to $, each separated by a dot (.). Square brackets with nested quotation marks ([‘...’]) should be used to separate child elements in JSON arrays.
  For example, the root node of a JSON Path is $. The child node denoting the Unique Event Key field would be eventId. Putting it together, the JSON Path expression to extract the Unique Event Key is $.eventId.

The pre-configured field mappings are detailed below:

Field Name	Source Field
Model Confidence	.modelConfidence
Relevance	.relevance
Destination Device	.destination.hostname
Destination IP address	.destination.address
Destination port	.destination.port
Destination MAC	.destination.macAddress
Destination zone	.destination.zone.uri
End Time	.endTime
Unique Event Key	.eventId
Event Type	.type
Start Time	.startTime
Description	.sessionId
Receipt time	.managerReceiptTime
Severity	.severity
Source Device	.source.hostname
Source IP address	.source.address
Source port	.source.port
Source MAC address	.source.macAddress
Source Priority	.priority
Source zone	.source.zone.uri

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Fetch Event failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Fetch Event failed.

Status Code: 404.

Message: Resource Not Found.

Get Active List Path

Retrieves the full path of the specified active list(s). This command can be used to obtain the Group ID required for creating an active list. After running the command, refer to the returned key fields and compare the two path values of the ActiveListPaths and ActiveListURI key fields. These two path values correspond with each other.

For example,

“ActiveListURIs”: “/All Active Lists/ArcSight Administration/Devices/TESTAL1101g”

“ActiveListPaths”: “01000124/0AhIKR==/0JDItt==/HxMdFN==”

The group ID is displayed under “ActiveListPaths”. “01000124” is the group ID for “All Active Lists”, “0AhIKR==” is the group ID for “ArcSight Administration”, “0JDItt==” is the group ID for “Devices”. Please note the last path “TESTAL1101g” is the active list name and “HxMdFN==” is the corresponding active list ID.

Reader Note

Active List IDs is a required parameter to run this command.

Run the List Active Lists command to obtain Active List IDs. Active List IDs can be found in the returned raw data at the path $[*].resourceId.

Input

Input Parameter	Required/Optional	Description	Example
Active List IDs	Required	The ID(s) of the active list(s) to retrieve the full path to root. Active List IDs can be obtained using the List Active Lists command.	[ "HxM***Yg==" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "resourceId": "HxMd***=",
        "name": "testAL1101g",
        "alias": "TESTAL1101g",
        "description": "testAL1101g desc",
        "reference": {
            "id": "HxM***=",
            "uri": "/All Active Lists/ArcSight Administration/Devices/TESTAL1101g",
            "referenceString": "",
            "managerID": "XTtd***=",
            "referenceType": 24,
            "isModifiable": true,
            "referenceName": "ActiveList"
        },
        "type": 24,
        "typeName": "ActiveList",
        "isAdditionalLoaded": false,
        "modificationCount": 0,
        "createdTimestamp": 1667341076505,
        "modifiedTimestamp": 1667341076505,
        "disabled": false,
        "inactive": false,
        "deprecated": false,
        "localID": 103079215224,
        "state": 2,
        "creatorName": "admin",
        "modifierName": "admin",
        "optimizeData": false,
        "capacity": 10000,
        "entryTimeToLive": 0,
        "multiMap": true,
        "partialCache": false,
        "timePartitioned": false,
        "activeListType": "FIELD_BASED",
        "caseSensitiveType": "CASE_SENSITIVE",
        "countLimit": 0,
        "cacheModel": "READ_OPTIMIZED",
        "initialized": true,
        "uri": "/All Active Lists/ArcSight Administration/Devices/TESTAL1101g",
        "pathToRoot": "010001***/0Ah***MKLz2g==/0JDIttU**bw==/Hx***g==",
        "inCache": true,
        "attributeInitializationInProgress": false,
        "signature": {
            "id": "HxMdF***=",
            "modificationCount": 0
        },
        "displayName": "TESTAL1101g",
        "fields": [
            {
                "name": "hostName",
                "type": "String",
                "key": true
            },
            {
                "name": "StartTime",
                "type": "Date",
                "key": true
            },
            {
                "name": "LastEventReceived",
                "type": "Date",
                "key": false
            },
            {
                "name": "EventID",
                "type": "String",
                "key": false
            }
        ]
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "ActiveListIDs": [
        "HxMdF***="
    ],
    "ActiveListNames": [
        "testAL1101g"
    ],
    "ActiveListURIs": [
        "/All Active Lists/ArcSight Administration/Devices/TESTAL1101g"
    ],
    "ActiveListPaths": [
        "01***4/0Ah***MKLz2g==/0JDIt***==/HxMdFN***g=="
    ]
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

RESOURCEID	NAME	ALIAS	DESCRIPTION	REFERENCE	TYPE	TYPENAME	ISADDITIONALLOADED	MODIFICATIONCOUNT	CREATEDTIMESTAMP	MODIFIEDTIMESTAMP	DISABLED	INACTIVE	DEPRECATED	LOCALID	STATE	CREATORNAME	MODIFIERNAME	OPTIMIZEDATA	CAPACITY	ENTRYTIMETOLIVE	MULTIMAP	PARTIALCACHE	TIMEPARTITIONED	ACTIVELISTTYPE	CASESENSITIVETYPE	COUNTLIMIT	CACHEMODEL	INITIALIZED	URI	PATHTOROOT	INCACHE	ATTRIBUTEINITIALIZATIONINPROGRESS	SIGNATURE	DISPLAYNAME	FIELDS
HxMdFNYQ***OYg==	testAL1101g	TESTAL1101g	testAL1101g desc	{'id': 'Hx*Yg==', 'uri': '/All Active Lists/ArcSight Administration/Devices/TESTAL1101g', 'referenceString': '', 'managerID': 'X*==', 'referenceType': 24, 'isModifiable': True, 'referenceName': 'ActiveList'}	24	ActiveList	False	0	1667341076505	1667341076505	False	False	False	103079215224	2	admin	admin	False	10000	0	True	False	False	FIELD_BASED	CASE_SENSITIVE	0	READ_OPTIMIZED	True	/All Active Lists/ArcSight Administration/Devices/TESTAL1101g	01000100010001024/*g==/0JDIttUUBABCnThuywc1zbw==/HxMdFNY*g==	True	False	{'id': 'HxMdFNYQBABCJ***=', 'modificationCount': 0}	TESTAL1101g	[{'name': 'hostName', 'type': 'String', 'key': True}, {'name': 'StartTime', 'type': 'Date', 'key': True}, {'name': 'LastEventReceived', 'type': 'Date', 'key': False}, {'name': 'EventID', 'type': 'String', 'key': False}]

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Active List Path failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Get Active List Path failed.

Status Code: 404.

Message: Resource Not Found.

Get Active Lists

Retrieves information of the specified active list(s) by Active List name or ID.

Reader Note

The input parameter Active List Names Or IDs is required to run this command.

Run the List Active Lists command to obtain Active List Names Or IDs. Active List IDs can be found in the returned raw data at the path $[*].resourceId. Active List Names can be found in the returned raw data at the path $[*].name.

Input

Input Parameter	Required/Optional	Description	Example
Active List Names Or IDs	Required	The name(s) or ID(s) of the active list to retrieve. Active List Names and IDs can be obtained using the List Active Lists command. If there are duplicate names or IDs, only the first active list with the same name or ID will be listed in the returned results.	[ "All Monitored Devices" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "resourceId": "H***w==",
        "name": "All Monitored Devices",
        "description": "This active list is populated by the All Monitored Devices rule. The active list stores entries for 365 days and is used by queries to retrieve device activity information by dashboards and reports.",
        "reference": {
            "id": "HycbN***=",
            "uri": "/All Active Lists/ArcSight Administration/Devices/All Monitored Devices",
            "referenceString": "",
            "managerID": "XTtdzY***uQ==",
            "referenceType": 24,
            "isModifiable": true,
            "referenceName": "ActiveList"
        },
        "type": 24,
        "typeName": "ActiveList",
        "isAdditionalLoaded": false,
        "modificationCount": 1,
        "createdTimestamp": 1661302194213,
        "modifiedTimestamp": 1661302380771,
        "versionID": "AAA***Ov",
        "contentVersionID": "AAA***Ow",
        "disabled": false,
        "inactive": false,
        "deprecated": false,
        "localID": 103079***140,
        "state": 2,
        "creatorName": "admin",
        "modifierName": "admin",
        "optimizeData": false,
        "capacity": 100000,
        "entryTimeToLive": 315***00,
        "multiMap": false,
        "partialCache": false,
        "timePartitioned": false,
        "activeListType": "FIELD_BASED",
        "caseSensitiveType": "CASE_SENSITIVE",
        "countLimit": 0,
        "cacheModel": "READ_OPTIMIZED",
        "initialized": true,
        "uri": "/All Active Lists/ArcSight Administration/Devices/All Monitored Devices",
        "inCache": true,
        "attributeInitializationInProgress": false,
        "signature": {
            "id": "HycbNbE***==",
            "modificationCount": 1
        },
        "displayName": "All Monitored Devices",
        "fields": [
            {
                "name": "DeviceHostName",
                "type": "String",
                "key": true
            },
            {
                "name": "DeviceVendor",
                "type": "String",
                "key": true
            },
            {
                "name": "DeviceProduct",
                "type": "String",
                "key": true
            },
            {
                "name": "DeviceZone",
                "type": "ResourceReference",
                "subType": "Zone",
                "key": true
            },
            {
                "name": "Customer",
                "type": "ResourceReference",
                "subType": "Customer",
                "key": true
            },
            {
                "name": "TotalEventCount",
                "type": "Long",
                "key": false
            },
            {
                "name": "EventCountSLC",
                "type": "Long",
                "key": false
            },
            {
                "name": "DeviceAddress",
                "type": "IPAddress",
                "key": false
            },
            {
                "name": "AgentName",
                "type": "String",
                "key": false
            },
            {
                "name": "LastEventReceived",
                "type": "Date",
                "key": false
            }
        ]
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "ActiveListNames": [
        "All Monitored Devices"
    ],
    "ActiveListIDs": [
        "HycbNbEU***hUw=="
    ],
    "ActiveListURIs": [
        "/All Active Lists/ArcSight Administration/Devices/All Monitored Devices"
    ],
    "Descriptions": [
        "This active list is populated by the All Monitored Devices rule. The active list stores entries for 365 days and is used by queries to retrieve device activity information by dashboards and reports."
    ]
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.
The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

RESOURCEID	NAME	DESCRIPTION	REFERENCE	TYPE	TYPENAME	ISADDITIONALLOADED	MODIFICATIONCOUNT	CREATEDTIMESTAMP	MODIFIEDTIMESTAMP	VERSIONID	CONTENTVERSIONID	DISABLED	INACTIVE	DEPRECATED	LOCALID	STATE	CREATORNAME	MODIFIERNAME	OPTIMIZEDATA	CAPACITY	ENTRYTIMETOLIVE	MULTIMAP	PARTIALCACHE	TIMEPARTITIONED	ACTIVELISTTYPE	CASESENSITIVETYPE	COUNTLIMIT	CACHEMODEL	INITIALIZED	URI	INCACHE	ATTRIBUTEINITIALIZATIONINPROGRESS	SIGNATURE	DISPLAYNAME	FIELDS
Hyc***w==	All Monitored Devices	This active list is populated by the All Monitored Devices rule. The active list stores entries for 365 days and is used by queries to retrieve device activity information by dashboards and reports.	{'id': 'HycbNbE*=', 'uri': '/All Active Lists/ArcSight Administration/Devices/All Monitored Devices', 'referenceString': '', 'managerID': 'XTtdz*uQ==', 'referenceType': 24, 'isModifiable': True, 'referenceName': 'ActiveList'}	24	ActiveList	False	1	1661302194213	1661302380771	AAA***jy2zGOv	AA***2zGOw	False	False	False	1030***5140	2	admin	admin	False	100000	3153***000	False	False	False	FIELD_BASED	CASE_SENSITIVE	0	READ_OPTIMIZED	True	/All Active Lists/ArcSight Administration/Devices/All Monitored Devices	True	False	{'id': 'HycbN***==', 'modificationCount': 1}	All Monitored Devices	[{'name': 'DeviceHostName', 'type': 'String', 'key': True}, {'name': 'DeviceVendor', 'type': 'String', 'key': True}, {'name': 'DeviceProduct', 'type': 'String', 'key': True}, {'name': 'DeviceZone', 'type': 'ResourceReference', 'subType': 'Zone', 'key': True}, {'name': 'Customer', 'type': 'ResourceReference', 'subType': 'Customer', 'key': True}, {'name': 'TotalEventCount', 'type': 'Long', 'key': False}, {'name': 'EventCountSLC', 'type': 'Long', 'key': False}, {'name': 'DeviceAddress', 'type': 'IPAddress', 'key': False}, {'name': 'AgentName', 'type': 'String', 'key': False}, {'name': 'LastEventReceived', 'type': 'Date', 'key': False}]

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Active Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Get Active Lists failed.

Status Code: 404.

Message: Resource Not Found.

Get Events By IDs

Retrieves information of the specified event(s) by event ID.

Reader Note

The parameter Event IDs is required to run this command.

You should already have the Event IDs before running the command. If you need to know the Event IDs for specific events, run the Fetch Event command to obtain Event IDs. Event IDs can be found in the returned raw data at the path $[*].eventId. Only events from the past 36 months are retrievable.

Input

Input Parameter	Required /Optional	Description	Example
Event IDs	Required	The ID(s) of the event(s) to retrieve. Event IDs can be obtained using the Fetch Event command. Note: Only events from the past 36 months are retrievable.	[ "3***7" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "eventId": 33***07,
        "managerId": -8,
        "name": "Start event: query viewer generation 2022102603",
        "type": "BASE",
        "startTime": 1667338317601,
        "endTime": 1667338317601,
        "managerReceiptTime": 1667338317601,
        "bytesIn": -2147***48,
        "bytesOut": -21***48,
        "sessionId": -9223***000,
        "generator": {
            "id": "cZ-m9FoQBABC64Yl9sLSthA==",
            "uri": "/All Query Viewers/Personal/admin's Query Viewers/2022102603",
            "referenceString": "",
            "referenceID": 4013,
            "managerID": "XTtd***Q==",
            "referenceType": 51,
            "isModifiable": false,
            "referenceName": "QueryViewer"
        },
        "agent": {
            "mutable": true,
            "hostName": "es**ht",
            "address": 32322***03,
            "addressAsBytes": "wK***=",
            "zone": {
                "id": "M-fU3***T3UdQ==",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255",
                "referenceString": "",
                "referenceID": 1522,
                "managerID": "XTtdz***Q==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetLocalId": -9223***00,
            "translatedAddress": -9223**000,
            "macAddress": -9223***000,
            "version": "7.6***9.0",
            "id": "3pztd***qdp3w==",
            "type": "arcsight_security_manager",
            "name": "Manager Internal Agent"
        },
        "device": {
            "mutable": true,
            "hostName": "es***ght",
            "address": 323***03,
            "addressAsBytes": "w***w==",
            "zone": {
                "id": "M-fU***=",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255",
                "referenceString": "",
                "referenceID": 1522,
                "managerID": "XTt&&&==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetId": "4LztdzYI***=",
            "assetLocalId": 171***85,
            "translatedAddress": -922337****,
            "macAddress": -92233**00,
            "assetName": "es***",
            "version": "7.6**",
            "vendor": "ArcSight",
            "product": "ArcSight"
        },
        "concentratorAgents": [
            {
                "mutable": true,
                "hostName": "esm.arcsight",
                "address": 3232257903,
                "addressAsBytes": "wK***=",
                "zone": {
                    "id": "M-f**Q==",
                    "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255",
                    "referenceString": "",
                    "referenceID": 1**2,
                    "managerID": "XTtd***1uQ==",
                    "referenceType": 29,
                    "isModifiable": false,
                    "referenceName": "Zone"
                },
                "assetLocalId": -9223**00,
                "translatedAddress": -9223**000,
                "macAddress": -92233***54776000,
                "version": "7.6.0.2729.0",
                "id": "3p**p3w==",
                "type": "arcsight_security_manager",
                "name": "Manager Internal Agent"
            }
        ],
        "modelConfidence": 4,
        "severity": 0,
        "relevance": 10,
        "assetCriticality": 0,
        "priority": 3,
        "agentSeverity": 1,
        "agentReceiptTime": -9223372036854776000,
        "deviceEventCategory": "/QueryViewer/Generate",
        "deviceSeverity": "Warning",
        "deviceReceiptTime": 16**601,
        "deviceEventClassId": "qu**2",
        "deviceProcessId": -2147**8,
        "deviceDirection": -21**48,
        "file": {
            "name": "2022102603",
            "path": "/All Query Viewers/Personal/admin's Query Viewers/2022102603",
            "type": "QueryViewer",
            "size": -922**6000,
            "createTime": -9223372036854776000,
            "modificationTime": -9223*6000
        },
        "originator": "SOURCE",
        "source": {
            "mutable": true,
            "hostName": "192***8",
            "address": 32**0,
            "addressAsBytes": "w***,
            "zone": {
                "id": "M-fU***Q==",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255",
                "referenceString": "",
                "referenceID": 1522,
                "managerID": "XTt***Q==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetId": "49AQ**=",
            "assetLocalId": 171**87,
            "translatedAddress": -922***6000,
            "macAddress": -922***0,
            "assetName": "192.168***",
            "processId": -21***48,
            "port": -214***48,
            "translatedPort": -214**648,
            "serviceName": "/X***,
            "geo": {
                "mutable": true,
                "longitude": 0,
                "longitudeLong": 0,
                "latitude": 0,
                "latitudeLong": 0
            }
        },
        "destination": {
            "mutable": true,
            "hostName": "e***",
            "address": 32***03,
            "addressAsBytes": "wKh***,
            "zone": {
                "id": "M-f***dQ==",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255",
                "referenceString": "",
                "referenceID": 1522,
                "managerID": "XT***uQ==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetId": "4***=",
            "assetLocalId": 171**85,
            "translatedAddress": -922***776000,
            "macAddress": -92233***776000,
            "assetName": "e***ht",
            "processId": -21**648,
            "port": 8443,
            "translatedPort": -21***648,
            "userName": "admin",
            "userId": "1KXN***=",
            "geo": {
                "mutable": true,
                "longitude": 0,
                "longitudeLong": 0,
                "latitude": 0,
                "latitudeLong": 0
            }
        },
        "baseEventCount": 1,
        "deviceCustomString1": "",
        "deviceCustomString2": "",
        "deviceCustomString4": "1KXNS***=",
        "deviceCustomNumber1": -92233**6000,
        "deviceCustomNumber2": -9223***76000,
        "deviceCustomNumber3": -9223372***000,
        "flexNumber1": -92233***000,
        "flexNumber2": -922337***776000,
        "deviceCustomDate1": 1667338317601,
        "deviceCustomDate2": -9223372036854776000,
        "flexDate1": -9223372036854776000,
        "deviceCustomFloatingPoint1": 5e-123,
        "deviceCustomFloatingPoint2": 5e-123,
        "deviceCustomFloatingPoint3": 5e-123,
        "deviceCustomFloatingPoint4": 5e-123,
        "deviceCustom": {
            "mutable": true,
            "string1Label": "Query Reference",
            "string2Label": "Configuration Resource",
            "string4Label": "Query Viewer Launched by",
            "date1Label": "Start time"
        },
        "eventAnnotation": {
            "stage": {
                "id": "R9MHiNf***",
                "uri": "/All Stages/Queued",
                "referenceString": "",
                "referenceID": 22***,
                "managerID": "XTtdz***=",
                "referenceType": 34,
                "isModifiable": false,
                "referenceName": "Stage"
            },
            "flags": 0,
            "modificationTime": 1667338317601,
            "auditTrail": "1,166***73729,root,Queued,,,,\n",
            "version": 1,
            "eventId": 3323707,
            "endTime": 1667338317601,
            "managerReceiptTime": 1667338317601,
            "stageUpdateTime": 166**601
        },
        "locality": 0,
        "persistence": -21***8,
        "ttl": 10,
        "dummyField": "dummyField",
        "aggregatedEventCount": 1,
        "correlatedEventCount": 0,
        "domainNumber1": -922337***0,
        "concentratorDevices": [
            {
                "mutable": true,
                "hostName": "es***ht",
                "address": 323***3,
                "addressAsBytes": "wK***,
                "zone": {
                    "id": "M-fU***3UdQ==",
                    "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255",
                    "referenceString": "",
                    "referenceID": 15***,
                    "managerID": "XTtdz***==",
                    "referenceType": 29,
                    "isModifiable": false,
                    "referenceName": "Zone"
                },
                "assetId": "4Lztd***g==",
                "assetLocalId": 17***85,
                "translatedAddress": -922***76000,
                "macAddress": -9223***6000,
                "assetName": "es***ight",
                "version": "7***0",
                "vendor": "ArcSight",
                "product": "ArcSight"
            }
        ],
        "objectTypeName": "SecurityEvent",
        "originalAgent": {
            "mutable": true,
            "hostName": "esm.arcsight",
            "address": 3***3,
            "addressAsBytes": "wKhXbw==",
            "zone": {
                "id": "M-fU32A***Q==",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255",
                "referenceString": "",
                "referenceID": 1***,
                "managerID": "XTt***uQ==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetLocalId": -922337***0,
            "translatedAddress": -922337***0,
            "macAddress": -922***00,
            "version": "7.6.0.2729.0",
            "id": "3pztdz***p3w==",
            "type": "arcsight_security_manager",
            "name": "Manager Internal Agent"
        },
        "finalDevice": {
            "mutable": true,
            "hostName": "es***ht",
            "address": 32***3,
            "addressAsBytes": "wK***=",
            "zone": {
                "id": "M-fU32***=",
                "uri": "/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 192.168.0.0-192.168.255.255",
                "referenceString": "",
                "referenceID": 1522,
                "managerID": "XTtdz***uQ==",
                "referenceType": 29,
                "isModifiable": false,
                "referenceName": "Zone"
            },
            "assetId": "4Lzt***==",
            "assetLocalId": 171**185,
            "translatedAddress": -922***6000,
            "macAddress": -92***4776000,
            "assetName": "es***t",
            "version": "7***.0",
            "vendor": "ArcSight",
            "product": "ArcSight"
        }
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "EventIDs": [
        "***"
    ],
    "EventNames": [
        "Start event: query viewer generation 2022102603"
    ],
    "eventTypes": [
        "BASE"
    ],
    "StartTime": [
        "November 1, 2022 9:31:57.601 PM"
    ],
    "EndTime": [
        "November 1, 2022 9:31:57.601 PM"
    ],
    "Messages": [
        ""
    ]
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

EVENTID	MANAGERID	NAME	TYPE	STARTTIME	ENDTIME	MANAGERRECEIPTTIME	BYTESIN	BYTESOUT	SESSIONID	GENERATOR	AGENT	DEVICE	CONCENTRATORAGENTS	MODELCONFIDENCE	SEVERITY	RELEVANCE	ASSETCRITICALITY	PRIORITY	AGENTSEVERITY	AGENTRECEIPTTIME	DEVICEEVENTCATEGORY	DEVICESEVERITY	DEVICERECEIPTTIME	DEVICEEVENTCLASSID	DEVICEPROCESSID	DEVICEDIRECTION	FILE	ORIGINATOR	SOURCE	DESTINATION	BASEEVENTCOUNT	DEVICECUSTOMSTRING1	DEVICECUSTOMSTRING2	DEVICECUSTOMSTRING4	DEVICECUSTOMNUMBER1	DEVICECUSTOMNUMBER2	DEVICECUSTOMNUMBER3	FLEXNUMBER1	FLEXNUMBER2	DEVICECUSTOMDATE1	DEVICECUSTOMDATE2	FLEXDATE1	DEVICECUSTOMFLOATINGPOINT1	DEVICECUSTOMFLOATINGPOINT2	DEVICECUSTOMFLOATINGPOINT3	DEVICECUSTOMFLOATINGPOINT4	DEVICECUSTOM	EVENTANNOTATION	LOCALITY	PERSISTENCE	TTL	DUMMYFIELD	AGGREGATEDEVENTCOUNT	CORRELATEDEVENTCOUNT	DOMAINNUMBER1	CONCENTRATORDEVICES	OBJECTTYPENAME	ORIGINALAGENT	FINALDEVICE
	-1*	Start event: query viewer generation 2022102603	BASE	16673***1	1667***1	1667***1	-2147***	-2147***48	-922***75808	{'id': 'cZ-m*==', 'uri': "/All Query Viewers/Personal/admin's Query Viewers/2022102603", 'referenceString': '', 'referenceID': 4013, 'managerID': 'XTtdzYIB*=', 'referenceType': 51, 'isModifiable': False, 'referenceName': 'QueryViewer'}				4	0	10	0	3	1	-922***775808	/QueryViewer/Generate	Warning	1667***	queryvie***:102	-21474***48	-2***48	{'name': '2022102603', 'path': "/All Query Viewers/Personal/admin's Query Viewers/2022102603", 'type': 'QueryViewer', 'size': -92233*808, 'createTime': -9223775808, 'modificationTime': -9223**808}	SOURCE			1			1KXNSzYIBABCA21m2uJyDuQ==	-9223372036854775808	-9223372036854775808	-9223372036854775808	-9223372036854775808	-9223372036854775808	1667338317601	-9223372036854775808	-9223372036854775808	5e-324	5e-324	5e-324	5e-324	{'mutable': True, 'string1Label': 'Query Reference', 'string2Label': 'Configuration Resource', 'string4Label': 'Query Viewer Launched by', 'date1Label': 'Start time'}	{'stage': {'id': 'R9MHiNfoAABCA*=', 'uri': '/All Stages/Queued', 'referenceString': '', 'referenceID': 2, 'managerID': 'XTtdzYIBABCAYCk=', 'referenceType': 34, 'isModifiable': False, 'referenceName': 'Stage'}, 'flags': 0, 'modificationTime': 1667338317601, 'auditTrail': '1,1667429,root,Queued,,,,\n', 'version': 1, 'eventId': 3, 'endTime': 1617601, 'managerReceiptTime': 1617601, 'stageUpdateTi*17601}	0	-21474***648	10	dummyField	1	0	-9223***775808		SecurityEvent

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Events By IDs failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Get Events By IDs failed.

Status Code: 404.

Message: Resource Not Found.

Get Query Viewer

Retrieves information of the specified query viewer(s).

Reader Note

Query Viewer Name Or ID is a required parameter to run this command.

Run the List Query Viewer IDs command to obtain Query Viewer Names/IDs. Query Viewer Names can be found in the returned raw data at the path $[*].name. Query Viewer IDs can be found in the returned raw data at the path $[*].resourceId. Alternatively, you can obtain the values from the ArcSight ESM user interface.

Input

Input Parameter

Required/Optional

Description

Example

Query Viewer Name Or ID

Required

The name or ID of the query viewer to retrieve. Query Viewer Names and IDs can be obtained using the List Query Viewer command. If there are duplicate names or IDs, only the first query viewer with the same name or ID will be listed in the returned results.

Note: Input query viewer names are case-sensitive.

2022***3

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "resourceId": "cZ-m9F***9sLSthA==",
    "name": "2***2603",
    "reference": {
        "id": "cZ-m9FoQB***=",
        "uri": "/All Query Viewers/Personal/admin's Query Viewers/2022102603",
        "referenceString": "",
        "managerID": "XTtd***=",
        "referenceType": 51,
        "isModifiable": true,
        "referenceName": "QueryViewer"
    },
    "type": 51,
    "typeName": "QueryViewer",
    "isAdditionalLoaded": false,
    "modificationCount": 0,
    "createdTimestamp": 1666828505596,
    "modifiedTimestamp": 1666828505596,
    "disabled": false,
    "inactive": false,
    "deprecated": false,
    "localID": 219***178,
    "state": 2,
    "creatorName": "admin",
    "modifierName": "admin",
    "supportsToggle": false,
    "enabled": true,
    "queryViewerId": "cZ-m**thA==",
    "data": {
        "timestamp": 1667416511654,
        "startTimestamp": 1664824508223,
        "endTimestamp": 1667416508223,
        "rows": [
            "TRIMMED..."
        ],
        "columnHeaders": [
            "Event ID",
            "Start Time",
            "Manager Receipt Time",
            "Customer",
            "End Time",
            "Message",
            "Name",
            "Raw Event"
        ],
        "colHeaderTS": 166741***655,
        "maxColumns": 8,
        "properties": {}
    },
    "columnAliasMap": {
        "eventId": "Event ID",
        "rawEvent": "Raw Event",
        "name": "Name",
        "startTime": "Start Time",
        "endTime": "End Time",
        "managerReceiptTime": "Manager Receipt Time",
        "message": "Message",
        "customer": "Customer"
    },
    "refreshInterval": 900000,
    "initialized": true,
    "uri": "/All Query Viewers/Personal/admin's Query Viewers/2022102603",
    "inCache": true,
    "attributeInitializationInProgress": false,
    "signature": {
        "id": "cZ-m9FoQBABC64Yl9sLSthA==",
        "modificationCount": 0
    },
    "displayName": "2022102603"
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "QueryViewerName": 202***03,
    "QueryViewerDisplayName": 202***3,
    "QueryViewerID": "cZ-m9F***=",
    "QueryViewerURI": "/All Query Viewers/Personal/admin's Query Viewers/2022102603",
    "ColumnHeaders": [
        "Event ID",
        "Start Time",
        "Manager Receipt Time",
        "Customer",
        "End Time",
        "Message",
        "Name",
        "Raw Event"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

resourceId	cZ-m***=
name	202**3
reference	{'id': 'c*=', 'uri': "/All Query Viewers/Personal/admin's Query Viewers/2022102603", 'referenceString': '', 'managerID': 'XTtdzY*=', 'referenceType': 51, 'isModifiable': True, 'referenceName': 'QueryViewer'}
type	51
typeName	QueryViewer
isAdditionalLoaded	False
modificationCount	0
createdTimestamp	1666828505596
modifiedTimestamp	1666828505596
disabled	False
inactive	False
deprecated	False
localID	219***78
state	2
creatorName	admin
modifierName	admin
supportsToggle	False
enabled	True
queryViewerId	cZ-&&&=
data	{'timestamp': 1667416511654, 'startTimestamp': 1664824508223, 'endTimestamp': 1667416508223, 'rows': ['TRIMMED...'], 'columnHeaders': ['Event ID', 'Start Time', 'Manager Receipt Time', 'Customer', 'End Time', 'Message', 'Name', 'Raw Event'], 'colHeaderTS': 1667416511655, 'maxColumns': 8, 'properties': {}}
columnAliasMap	{'eventId': 'Event ID', 'rawEvent': 'Raw Event', 'name': 'Name', 'startTime': 'Start Time', 'endTime': 'End Time', 'managerReceiptTime': 'Manager Receipt Time', 'message': 'Message', 'customer': 'Customer'}
refreshInterval	900000
initialized	True
uri	/All Query Viewers/Personal/admin's Query Viewers/2022102603
inCache	True
attributeInitializationInProgress	False
signature	{'id': 'cZ-m***=', 'modificationCount': 0}
displayName	2022102603

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Query Viewer failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Get Query Viewer failed.

Status Code: 404.

Message: Resource Not Found.

List Active List Entries

Retrieves entries from the specified active list.

Reader Note

Active List ID is a required parameter to run this command.

Run the List Active Lists command to obtain Active List ID. Active List IDs can be found in the returned raw data at the path $[*].resourceId.

Input

Input Parameter	Required /Optional	Description	Example
Active List ID	Required	The ID of the active list to retrieve entries. Active List ID can be obtained using the List Active Lists command.	HNa***==

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "fields": [
        "hostName",
        "StartTime",
        "LastEventReceived",
        "EventID"
    ],
    "entries": [
        {
            "fields": [
                "DESKTOP-123",
                "",
                "",
                "12345678"
            ]
        },
        {
            "fields": [
                "DESKTOP-456",
                "",
                "",
                "43554676"
            ]
        },
        {
            "fields": [
                "DESKTOP-789",
                "",
                "",
                "76233910"
            ]
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "Columns": [
        "hostName",
        "StartTime",
        "LastEventReceived",
        "EventID"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

fields	hostName StartTime LastEventReceived EventID
entries	{'fields': ['DESKTOP-123', '', '', '12345678']} {'fields': ['DESKTOP-789', '', '', '76233910']}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Active List Entries failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

List Active List Entries failed.

Status Code: 404.

Message: Resource Not Found.

List Active Lists

Retrieves information on active lists. If Active List Name is not entered, all active lists will be returned.

Input

Input Parameter	Required/Optional	Description	Example
Active List Name	Optional	The name of the active list to retrieve. This parameter can be used to search for all existing active lists with the same name. Note: This parameter is case-sensitive.	ipwatchlist

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "resourceId": "HycbNb***=",
        "name": "All Monitored Devices",
        "description": "This active list is populated by the All Monitored Devices rule. The active list stores entries for 365 days and is used by queries to retrieve device activity information by dashboards and reports.",
        "reference": {
            "id": "HycbN***==",
            "uri": "/All Active Lists/ArcSight Administration/Devices/All Monitored Devices",
            "referenceString": "",
            "managerID": "XTtd***==",
            "referenceType": 24,
            "isModifiable": true,
            "referenceName": "ActiveList"
        },
        "type": 24,
        "typeName": "ActiveList",
        "isAdditionalLoaded": false,
        "modificationCount": 1,
        "createdTimestamp": 1661302194213,
        "modifiedTimestamp": 1661302380771,
        "versionID": "AA***GOv",
        "contentVersionID": "AAAA***zGOw",
        "disabled": false,
        "inactive": false,
        "deprecated": false,
        "localID": 103***140,
        "state": 2,
        "creatorName": "admin",
        "modifierName": "admin",
        "optimizeData": false,
        "capacity": 100000,
        "entryTimeToLive": 31536000000,
        "multiMap": false,
        "partialCache": false,
        "timePartitioned": false,
        "activeListType": "FIELD_BASED",
        "caseSensitiveType": "CASE_SENSITIVE",
        "countLimit": 0,
        "cacheModel": "READ_OPTIMIZED",
        "initialized": true,
        "uri": "/All Active Lists/ArcSight Administration/Devices/All Monitored Devices",
        "inCache": true,
        "attributeInitializationInProgress": false,
        "signature": {
            "id": "Hyc***==",
            "modificationCount": 1
        },
        "displayName": "All Monitored Devices",
        "fields": [
            {
                "name": "DeviceHostName",
                "type": "String",
                "key": true
            },
            {
                "name": "DeviceVendor",
                "type": "String",
                "key": true
            },
            {
                "name": "DeviceProduct",
                "type": "String",
                "key": true
            },
            {
                "name": "DeviceZone",
                "type": "ResourceReference",
                "subType": "Zone",
                "key": true
            },
            {
                "name": "Customer",
                "type": "ResourceReference",
                "subType": "Customer",
                "key": true
            },
            {
                "name": "TotalEventCount",
                "type": "Long",
                "key": false
            },
            {
                "name": "EventCountSLC",
                "type": "Long",
                "key": false
            },
            {
                "name": "DeviceAddress",
                "type": "IPAddress",
                "key": false
            },
            {
                "name": "AgentName",
                "type": "String",
                "key": false
            },
            {
                "name": "LastEventReceived",
                "type": "Date",
                "key": false
            }
        ]
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "ActiveListNames": [
        "All Monitored Devices"
    ],
    "ActiveListIDs": [
        "HycbN***Uw=="
    ],
    "ActiveListURIs": [
        "/All Active Lists/ArcSight Administration/Devices/All Monitored Devices"
    ],
    "Descriptions": [
        "This active list is populated by the All Monitored Devices rule. The active list stores entries for 365 days and is used by queries to retrieve device activity information by dashboards and reports."
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

RESOURCEID	NAME	DESCRIPTION	REFERENCE	TYPE	TYPENAME	ISADDITIONALLOADED	MODIFICATIONCOUNT	CREATEDTIMESTAMP	MODIFIEDTIMESTAMP	VERSIONID	CONTENTVERSIONID	DISABLED	INACTIVE	DEPRECATED	LOCALID	STATE	CREATORNAME	MODIFIERNAME	OPTIMIZEDATA	CAPACITY	ENTRYTIMETOLIVE	MULTIMAP	PARTIALCACHE	TIMEPARTITIONED	ACTIVELISTTYPE	CASESENSITIVETYPE	COUNTLIMIT	CACHEMODEL	INITIALIZED	URI	INCACHE	ATTRIBUTEINITIALIZATIONINPROGRESS	SIGNATURE	DISPLAYNAME	FIELDS
HycbNbEUB***ShUw==	All Monitored Devices	This active list is populated by the All Monitored Devices rule. The active list stores entries for 365 days and is used by queries to retrieve device activity information by dashboards and reports.	{'id': 'HycbNbEUBABC*=', 'uri': '/All Active Lists/ArcSight Administration/Devices/All Monitored Devices', 'referenceString': '', 'managerID': 'XTtdzYIB*=', 'referenceType': 24, 'isModifiable': True, 'referenceName': 'ActiveList'}	24	ActiveList	False	1	1661302194213	1661302380771	A***zGOv	A***zGOw	False	False	False	103079215140	2	admin	admin	False	100000	3153***000	False	False	False	FIELD_BASED	CASE_SENSITIVE	0	READ_OPTIMIZED	True	/All Active Lists/ArcSight Administration/Devices/All Monitored Devices	True	False	{'id': 'Hycb***w==', 'modificationCount': 1}	All Monitored Devices

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Active Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

List Active Lists failed.

Status Code: 404.

Message: Resource Not Found.

List Customers

Retrieves information of all customers.

Input

N/A

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "resourceId": "Sc***=",
        "name": "clientA",
        "reference": {
            "id": "ScDOCW***g==",
            "uri": "/All Customers/clientA",
            "referenceString": "",
            "managerID": "XTtdzYIB**Q==",
            "referenceType": 35,
            "isModifiable": true,
            "referenceName": "Customer"
        },
        "type": 35,
        "typeName": "Customer",
        "isAdditionalLoaded": false,
        "modificationCount": 0,
        "createdTimestamp": 1667932238710,
        "modifiedTimestamp": 1667932238710,
        "disabled": false,
        "inactive": false,
        "deprecated": false,
        "localID": 1503***61,
        "state": 2,
        "creatorName": "admin",
        "modifierName": "admin",
        "country": "--",
        "initialized": true,
        "uri": "/All Customers/clientA",
        "inCache": true,
        "attributeInitializationInProgress": false,
        "signature": {
            "id": "ScDOCWI***fSg==",
            "modificationCount": 0
        },
        "displayName": "clientA"
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "CustomerNames": [
        "clientA"
    ],
    "CustomerIDs": [
        "ScDOC***Sg=="
    ],
    "CustomerURIs": [
        "/All Customers/clientA"
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks. can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

RESOURCEID	NAME	REFERENCE	TYPE	TYPENAME	ISADDITIONALLOADED	MODIFICATIONCOUNT	CREATEDTIMESTAMP	MODIFIEDTIMESTAMP	DISABLED	INACTIVE	DEPRECATED	LOCALID	STATE	CREATORNAME	MODIFIERNAME	COUNTRY	INITIALIZED	URI	INCACHE	ATTRIBUTEINITIALIZATIONINPROGRESS	SIGNATURE	DISPLAYNAME
ScDOCWIQ***fSg==	clientA	{'id': 'ScDOC*=', 'uri': '/All Customers/clientA', 'referenceString': '', 'managerID': 'XTtdzY*Q==', 'referenceType': 35, 'isModifiable': True, 'referenceName': 'Customer'}	35	Customer	False	0	1667932238710	1667932238710	False	False	False	15032***	2	admin	admin	--	True	/All Customers/clientA	True	False	{'id': 'ScDOCW***=', 'modificationCount': 0}	clientA

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Customers failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 500.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Get token failed.

Error Sample Data

List Customers failed.

Status Code: 500.

Message: Get token failed.

List Query Viewers

Retrieves information on query viewers. If the Query Viewer Name parameter is not defined, all query viewers will be returned.

Reader Note

Query Viewer Name is an optional parameter to run this command.

You should already have the query viewer name before running the command. If you need to know the query viewer name of a specific query viewer, run this command without any parameters defined to return a list of all query viewers. In the returned raw data, refer to the “displayName” key to view the corresponding query viewer names.

Input

Input Parameter	Required/Optional	Description	Example
Query Viewer Name	Optional	The name of the query viewer to retrieve. This parameter can be used to search for all existing query viewers with the same name. Note: This parameter is case-sensitive.	Top Confidence in Suspicious Address

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    "c-TvN3***Z8qcYA==",
    "c05***NYml6MSoA==",
    "c0whQ***HufA==",
    "c2-GuK***D8Q==",
    "c2ES6h***A=="
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "QueryViewerIDs": [
        "c-Tv***A=="
    ]
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

c-TvN***Z8qcYA==, c05DPp***A==, c0whQRz4***HufA==, c2-Gu***D8Q==, c2ES6***elXejPWA==

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Query Viewers failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

List Query Viewers failed.

Status Code: 404.

Message: Resource Not Found.

Update Active List

Updates the specified active list. Note: You cannot modify the schema (i.e., fields and types) of a created list. A new active list must be created to do so.

Reader Note

Active List ID is a required parameter to run this command.

Run the List Active Lists command to obtain List Active ID. Active List IDs can be found in the returned raw data at the path $[*].resourceId.

Input

Input Parameter	Required/Optional	Description	Example
Active List ID	Required	The ID of the active list to update. Active List IDs can be obtained using the List Active Lists command.	HN***w==
Active List Name	Optional	The updated name of the active list.	1101h NEW NAME
Active List Display Name	Optional	The updated display name of the active list.	1101H_New
Description	Optional	The updated description for the active list.	Update active list 1101h
Capacity	Optional	The updated maximum capacity of the number of entries in the active list. The default value is 1,000,000. Note: The number of entries in an active list will affect memory usage. Ensure you have allocated sufficient memory to the JVM.	1000
Entry Time To Live	Optional	The updated time to live (in seconds) of the active list’s entries.	36000
Count Limit	Optional	The updated count limit for the active list.	5000
Cache Model	Optional	The updated cache model used for the active list. The available options are Read Optimized, Write Synchronized and Unchanged.	Write Synchronized

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "resourceId": "HCGyS***==",
    "name": "1101h NEW NAME",
    "alias": "1101H_New",
    "description": "Update active list 1101h",
    "reference": {
        "id": "HCGy***=",
        "uri": "/All Active Lists/ArcSight Administration/1101H_New",
        "referenceString": "",
        "managerID": "XTtdz***uQ==",
        "referenceType": 24,
        "isModifiable": true,
        "referenceName": "ActiveList"
    },
    "type": 24,
    "typeName": "ActiveList",
    "isAdditionalLoaded": false,
    "modificationCount": 1,
    "createdTimestamp": 1667346099346,
    "modifiedTimestamp": 1667346498611,
    "disabled": false,
    "inactive": false,
    "deprecated": false,
    "localID": 10307***224,
    "state": 2,
    "creatorName": "admin",
    "modifierName": "admin",
    "optimizeData": false,
    "capacity": 1000,
    "entryTimeToLive": 36000,
    "multiMap": true,
    "partialCache": false,
    "timePartitioned": false,
    "activeListType": "FIELD_BASED",
    "caseSensitiveType": "KEY_CASE_INSENSITIVE",
    "countLimit": 5000,
    "cacheModel": "WRITE_SYNCHRONIZED",
    "initialized": true,
    "uri": "/All Active Lists/ArcSight Administration/1101H_New",
    "inCache": false,
    "attributeInitializationInProgress": false,
    "signature": {
        "id": "HCGyS***TA==",
        "modificationCount": 1
    },
    "displayName": "1101H_New",
    "fields": [
        {
            "name": "hostName",
            "type": "String",
            "key": true
        },
        {
            "name": "StartTime",
            "type": "Date",
            "key": true
        },
        {
            "name": "LastEventReceived",
            "type": "Date",
            "key": false
        },
        {
            "name": "EventID",
            "type": "String",
            "key": false
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "ActiveListName": "1101h NEW NAME",
    "ActiveListID": "HCGyS***13TA==",
    "ActiveListURI": "/All Active Lists/ArcSight Administration/1101H_New",
    "Description": "Update active list 1101h"
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

resourceId	HCGy***A==
name	1101h NEW NAME
alias	1101H_New
description	Update active list 1101h
reference	{'id': 'HCGySN*=', 'uri': '/All Active Lists/ArcSight Administration/1101H_New', 'referenceString': '', 'managerID': 'XTtd*==', 'referenceType': 24, 'isModifiable': True, 'referenceName': 'ActiveList'}
type	24
typeName	ActiveList
isAdditionalLoaded	False
modificationCount	1
createdTimestamp	1667346099346
modifiedTimestamp	1667346498611
disabled	False
inactive	False
deprecated	False
localID	10307***224
state	2
creatorName	admin
modifierName	admin
optimizeData	False
capacity	1000
entryTimeToLive	36000
multiMap	True
partialCache	False
timePartitioned	False
activeListType	FIELD_BASED
caseSensitiveType	KEY_CASE_INSENSITIVE
countLimit	5000
cacheModel	WRITE_SYNCHRONIZED
initialized	True
uri	/All Active Lists/ArcSight Administration/1101H_New
inCache	False
attributeInitializationInProgress	False
signature	{'id': 'HCG***Count': 1}
displayName	1101H_New
fields	{'name': 'hostName', 'type': 'String', 'key': True} {'name': 'StartTime', 'type': 'Date', 'key': True} {'name': 'LastEventReceived', 'type': 'Date', 'key': False} {'name': 'EventID', 'type': 'String', 'key': False}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Update Active List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Resource Not Found.

Error Sample Data

Update Active List failed.

Status Code: 404.

Message: Resource Not Found.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE

Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the responses from the third-party API calls including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ArcSight Enterprise Security Manager portal. Refer to the HTTP Status Code Registry for details.	Status Code: 500.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Get token failed.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 500.

Message: Get token failed.

Use Case

Create Active Lists, Add and Delete Active List Entries

You can use the Create Active List command to create an active list with defined fields. The Add Active List Entries command can then be used to to assign values to those fields. The values can be removed using the Delete Active List Entries command.

Note:

Fields cannot be modified after an active list has been created.
When updating the field values with the Add Active List Entries command, the input entry fields and their order must match the existing fields and order on the specified active list.