The SIEM example in this section describes how to integrate the Trellix Endpoint Security (HX)-specific integration connector with ArcSight's Flex CounterACT SDK (SmartConnector). After this integration has been established, it can be used for communication from the ArcSight Security Information and Event Management (SIEM) solution to the Endpoint Security (HX) appliance.
Follow the steps below, along with your vendor documentation, to install and configure the integration connector. If you need help setting up an integration connector with your SIEM, contact Trellix Customer Support.
This guide refers to ArcSight and its ESM manager or console as examples of SIEM integration methods and objectives. For example, analysts can use the ArcSight ESM console's Integration Command menu or rules to automate the process of requesting acquisitions for a SIEM event. Your ArcSight vendor can provide information about creating and using ArcSight integration commands. Trellix Support can provide you with information about using the integration connector with other SIEM solutions.
Note
Trellix supports the use of the ArcSight Smart Connector type 10.0.5. The ArcSight to Endpoint Security (HX) connector port must be 3000 (TCP). The Endpoint Security (HX) to ArcSight syslog port is configurable.
Important
Trellix recommends that you use Java 7 or later with ArcSight and that your Java class path is updated to point to this Java version. If you use an earlier version of Java, SSL errors may occur.
Administrative permissions to the machine on which you are installing the integration connector.
An Endpoint Security (HX) Admin or Operator account.
An Endpoint Security (HX) API Analyst account you have created specifically for the connector.
A copy of the integration connector installation package (
FireEye\ArcSight\Connector\Install\10.0.5.zipavailable on SFDC).Either of the following types of certificates:
A self-signed development certificate created using OpenSSL (according to the procedure described in Creating a self-signed development certificate).
A valid certificate that you have purchased from your chosen provider.
Creating a self-signed development certificate
Follow these steps to create a self-signed development certificate for installing the integration connector.
Note
The certificate must be in .pem format, and it must match the hostname of the Endpoint Security (HX) server.
On a machine on which you have installed OpenSSL, enter the following command:
C:\OpenSSL\bin> openssl req -x509 -nodes -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3000
At the end of each line, enter the appropriate information for your enterprise in the format indicated. For example:
Country Name (2 letter code) [XX]: US State or Province Name (full name) []: Virginia Locality Name (e.g., city) [Default City]: Bristol Organization Name (e.g., company) [Default Company Ltd]: Trellix Organizational Unit Name (e.g., section) []: IT Common Name (e.g., your name or your server's hostname) []: dti-hx-dev Email Address []: abc@trellix.com
OpenSSL generates two files: a self-signed certificate (named cert.pem) and a key (named key.pem).
Download and save the certificate and key files.
Installing the integration connector
Follow these steps to install and configure the integration connector.
On the machine where you are installing the connector, extract the files from the HX Connector Installer .zip package to a local folder.
Copy the certificate and key files that you generated, or the ones supplied by your chosen provider into the same folder as the installer files.
Rename the certificate:
certname.pem.Log in to the server Web UI as an administrator.
On the Admin menu, select Appliance Settings.
Select Certificates on the sidebar. The Certificate Management page appears.
On the Certificate Management page, install the certificate:
To install the self-signed certificate that you created in Creating a self-signed development certificate, upload the Certificate and Private Key.
To install a certificate provided by your chosen provider, upload the Certificate, Private Key, and CA Certificate.
Click Update.
You are logged out of the Endpoint Security (HX) server, and the login screen reloads with the following message:
1 notice
The Web Server is currently restarting
Please wait for about 20 seconds and try again
If this condition persists, please contact Trellix Support
On the machine where you installed the connector, edit the
fireeye-connector.propertiesfile, and enter the appropriate parameters for the Endpoint Security (HX) target:appliance
HX
hostname
The hostname of the Endpoint Security (HX) server
username
The username of the API Analyst account
password
The password of the API Analyst account
cert
certname.pemImportant
The hostname you enter must match the hostname in the certificate.
If the hostname you enter is not registered in the DNS, then you must connect the hostname and IP address in your operating system's host file on the machine where you are installing the connector.
Run the ArcSight SmartConnector installation package installer.
Important
Record the full path of the directory and folder that you use for this installation. You will need it later. If your enterprise will be using more than one ArcSight SmartConnector, make sure to choose a unique folder name.
When the installation is complete, the SmartConnector Configuration Wizard opens.
Before you configure the SmartConnector, run the
install.batfile located in the HX Connector Installer package. Enter the full path for the ArcSight SmartConnector installation folder that you recorded in Step 9.Enter 2, when you are asked which Connector type you are installing.
If you are using ArcSight ESM 6, export an ArcSight certificate from your ESM server and transfer the certificate to the server where the ArcSight SmartConnector is installed.
If you are using ArcSight ESM 6, import the certificate.
In Windows environments, run
cmd.exeusing an account with read/write access to the directory where you are installing the certificate.In Linux environments, open a command terminal using an account with read/write access to the directory where you are installing the certificate.
In the SmartConnector's bin directory, execute the appropriate command:
arcsight.bat agent keytoolgui(Windows)./arcsight agent keytoolgui(Linux)Open the keystore under
jre/lib/security/cacerts.Note
The default password is
changeit.Import the certificate, navigate to the certificate file, and then save the keystore.
Return to the ArcSight SmartConnector Configuration Wizard.
In the Configuration File box, enter
HXFlexConnector, and then click Next.Finish performing the steps in the ArcSight SmartConnector Configuration Wizard, choosing default settings or customizing for your enterprise's SIEM solution, as appropriate.
If you want the SmartConnector to run as a service, choose the following options:
Select Yes to start the service automatically when you restart the server on which it is running.
Enter unique names for Service Internal Name and Service Display Name, if your enterprise will have more than one SmartConnector on the server where you are installing this Connector.
Tip
If you want to run the SmartConnector service before the server restarts, you must start the service manually.
You can validate the success of the installation by using your SIEM console to view events or perform other actions, such as requesting a triage collection.