ArcSight Marketplace

FREE

Community

DNS Security Check

SOC Prime

DNS Security Check is a straightforward Use Case that easily finds DNS Misconfigurations and anomalies in network. Despite its maturity and long history, DNS protocol was not designed with security in mind and thus has many means of malicious exploitation.

905

FREE

Micro Focus COMMUNITY

Firewall Monitoring

Micro Focus

The Firewall Monitoring use case has been updated. Firewall Monitoring 1.2 provides improved content and performance, as well as additional resources

1,522

FREE

Community

Zerotect

Polyverse Corporation

Zerotect is an open-source agent that, integrated with Micro Focus ArcSight, detects attempted zero-day attacks with no prior knowledge of the vulnerability or attack being used.

38

FREE

Micro Focus COMMUNITY

Activate P-Blue Coat Proxy

Micro Focus

Product package covering proxy traffic events from Blue Coat.

832

FREE

Community

Endgame

Endgame

Endgame is the comprehensive endpoint security platform that prevents, detects, and responds to known and unknown threats at the earliest and all stages of the attack lifecycle. Endgame prevents breaches and transforms security analysts into Hunters.

96

FREE

Community

Microsoft Sysmon FlexConnector

Kevin Q

FlexConnector for the extraction and categorization of the “Microsoft-Windows-Sysmon/Operational” Windows Event Log using Microfocus ArcSight Windows Native SmartConnector Updated for Sysmon V 10.x

932

FREE

Community

Sysmon Framework

SOC Prime

Sysmon Framework is a set of rules and dashboards for the visualization of multiple security checks on Sysmon’s events on Windows hosts.

480

FREE

Micro Focus COMMUNITY

Activate Framework Wiki

Micro Focus

Everything you need to know about Activate!

359

Micro Focus COMMUNITY

Logger

Micro Focus

ArcSight Logger delivers a cost-effective universal log management solution that unifies searching, reporting, alerting, and analysis across any type of enterprise machine data.

1,768

Micro Focus COMMUNITY

Enterprise Security Manager (ESM)

Micro Focus

ArcSight ESM analyzes and correlates every event that occurs across the organization--every login, logoff, file access, database query--to deliver accurate prioritization of security risks and compliance violations.

3,465

FREE

Micro Focus COMMUNITY

Activate P-Snort

Micro Focus

This product-specific package includes the resources that support the Perimeter and Network Monitoring use case categories. Install this package if you collect Snort or Sourcefire logs for your ESM.

466

FREE

Micro Focus COMMUNITY

Activate P-Websense Security

Micro Focus

This product-specific package includes the resources that support the Perimeter and Network Monitoring use case categories.

600

Micro Focus COMMUNITY

Common Event Format Guide

Micro Focus

Standardize event data at the source using the Common Event Format, an open log management standard.

497

FREE

Micro Focus COMMUNITY

L2-WannaCry Malware Detection - Situational Awareness

Micro Focus

This package is intended to detect WannaCry malware IOCs incidents and provide ArcSight context to them, using both the ArcSight Network and Asset Model to alert the SOC Analyst and Operator of potential WannaCry IOCs in critical hosts.

644

FREE

Micro Focus COMMUNITY

Anomalous Traffic Detection

Micro Focus

The Anomalous Traffic Detection use case helps you identify sudden spikes in network traffic so that you can detect potentially malicious activity. Sudden spikes in traffic can be caused by scheduled backups or virus scanner updates inside your LAN.

1,188

FREE

Micro Focus COMMUNITY

WUC Parser Overrides

Micro Focus

Various overrides for the WUC

312
FREE

Micro Focus COMMUNITY

Activate P-Lenel Onguard2013

Micro Focus

This product-specific package includes the resources that support the Physical Badge Access monitoring Use cases. Install the package once you collect Lenel Onguard2013 events.

185

FREE

Micro Focus COMMUNITY

L3-Base - Threat and Impact Analysis

Micro Focus

This package contains the supporting resources (active lists and rules) for tracking the activity of systems, user accounts, service accounts, system accounts, etc., across the ArcSight Attack Life Cycle phases for this method.

394

FREE

Community

Logstash ArcSight Module

Elastic

The Logstash ArcSight module enables you to easily integrate with the ArcSight Data Platform (ADP) to explore and visualize data in real-time with the Elastic Stack.

363

FREE

Micro Focus COMMUNITY

ESM Default Content

Micro Focus

ESM Default Content includes Security Threat Monitoring package and Threat Intelligence Platform package, It also includes resources for tracking Techniques from the MITRE ATT& CK framework.

2,906

FREE

Community

Cofense Triage

Cofense, Inc.

Cofense Triage provides security operations center (SOC) analysts and incident responders insight into ongoing spear-phishing attacks by automating the analysis and orchestrating the workflow associated with employee reported suspicious emails.

47

FREE

Micro Focus COMMUNITY

L1-Threat Intelligence – Indicators and Warnings

Micro Focus

This package populates, displays, and monitors the Threat Model, which is used to detect and contextualize potential malicious activity based on intelligence derived from a site-specific mix of threat intelligence sources.

2,089

$1100

Community

Web Application Security Framework

SOC Prime

The goal of Web Application Security Framework is to minimize risks related to the usage of publicly accessible web applications. The main business task of public web applications is to provide service access to as many people as possible.

FREE

Micro Focus COMMUNITY

Activate P-Websense Security

Micro Focus

This product-specific package includes the resources that support the Perimeter and Network Monitoring use case categories.

600
FREE

Community

HAFNIUM Targeting Microsoft Exchange Servers

Yun Peng

This package detects zero-day vulnerabilities affecting Microsoft Exchange Servers attacks related to HAFNIUM hacks.

22

FREE

Micro Focus COMMUNITY

NetIQ eDirectory FlexConnector with parser generator sc...

Micro Focus

This FlexConnector is for eDirectory events sent through Syslog. The bundle includes a script for generating the parser file based on customer events.

104

FREE

Community

MITRE ATTACK Evaluations Round 3 - Carbanak and FIN7 Ad...

Yun Peng

This package was used during MITRE ATT&CK Carbanak+FIN7 emulation enterprise evaluation in October 2020.

62

FREE

Micro Focus

NetIQ Identity Manager

Micro Focus

This NetIQ Sentinel Collector provides event-capture capabilities for NetIQ Identity Manager and related products.

21

FREE

Micro Focus COMMUNITY

ESM Default Content

Micro Focus

ESM Default Content includes Security Threat Monitoring package and Threat Intelligence Platform package, It also includes resources for tracking Techniques from the MITRE ATT& CK framework.

2,906

FREE

Micro Focus

Agent Manager

Micro Focus

This Connector allows you to receive data from Agent manager event sources and collect generated events.

15

FREE

Community

Dragos

Dipali Shah

The Dragos Platform ArcSight Integration allows customers to forward notifications from the Dragos Platform to ArcSight ESM.

6

FREE

Community

Anomali Link for ArcSight ESM

Anomali

Anomali offers the most comprehensive security solution for threat intelligence data for organizations of any size. Anomali's award-winning ThreatStream threat intelligence platform helps you manage the curation and lifecycle of the threat intelligence.

450

Community

Blue Coat Security Analytics Platform

Blue Coat

Like a security camera for the network, the Blue Coat Security Analytics Platform records, indexes and classifies every network packet, flow, and file for full security visibility, advanced network forensics, and real-time threat detection.

279

Community

Damballa Failsafe

Damballa

Damballa, pioneers in detection, have been harvesting big data since 2006. Daily, we train our machine learning systems on more than 23 billion Internet records and 15TB of commercial traffic.

180
Micro Focus COMMUNITY

Connector

Micro Focus

ArcSight Connectors automate the process of collecting and managing logs from any device and in any format through normalization and categorization of logs into a unified format known as Common Event Format (CEF)

6,671

FREE

Micro Focus COMMUNITY

ESM Default Content

Micro Focus

ESM Default Content includes Security Threat Monitoring package and Threat Intelligence Platform package, It also includes resources for tracking Techniques from the MITRE ATT& CK framework.

2,906

FREE

Micro Focus COMMUNITY

ArcSight SmartConnector Parser Update

Micro Focus

Monthly SmartConnector Parser Release

11,629

Micro Focus COMMUNITY

Enterprise Security Manager (ESM)

Micro Focus

ArcSight ESM analyzes and correlates every event that occurs across the organization--every login, logoff, file access, database query--to deliver accurate prioritization of security risks and compliance violations.

3,465

FREE

Community

MITRE ATTACK Evaluations Round 3 - Carbanak and FIN7 Ad...

Yun Peng

This package was used during MITRE ATT&CK Carbanak+FIN7 emulation enterprise evaluation in October 2020.

62

FREE

Partner

Cisco Firepower (eStreamer and eNcore)

Cisco

Cisco Firepower Management Center Integration with ArcSight

600

FREE

Community

Customizing Rules to Work with ArcSight MITRE Package

Sliman Mansour

How to customize your rules so it will work with the ArcSight MITRE ATT& CK content

660

FREE

Community

Palo Alto Networks Next-Generation Firewalls

Palo Alto Networks

This guide provides information for configuring the Palo Alto Networks next-generation firewalls for CEF-formatted Syslog event collection.

1,024

Micro Focus COMMUNITY

Logger

Micro Focus

ArcSight Logger delivers a cost-effective universal log management solution that unifies searching, reporting, alerting, and analysis across any type of enterprise machine data.

1,768

FREE

Micro Focus COMMUNITY

Firewall Monitoring

Micro Focus

The Firewall Monitoring use case has been updated. Firewall Monitoring 1.2 provides improved content and performance, as well as additional resources

1,522

FREE

Micro Focus COMMUNITY

Brute Force Attack

Micro Focus

The Brute Force Attack use case uncovers and tracks, in real-time, attempts and confirmed attacks using a brute force technique on network assets and applications.

1,594

FREE

Micro Focus COMMUNITY

Playbook-Phishing Email

Micro Focus

A Playbook for Phishing Email Usecase

63

FREE

Micro Focus COMMUNITY

Activate Base

Micro Focus

ArcSight Activate is a modular content development method designed to quickly deploy actionable use cases. The framework will unify our development methodology, allowing us to create portable content packages.

5,454

Community

CyberArk Privileged Account Security

CyberArk

CyberArk Privileged Account Security provides the most comprehensive solution for protecting, monitoring, detecting, and responding to all privileged account activity.

524

FREE

Community

MITRE ATTACK Package for ArcSight Logger

Sliman Mansour

The Logger MITRE ATT&CK Package is a set of Logger Searches which let you hunt MITRE ATT&CK related activity.

359

FREE

Micro Focus

Syslog

Micro Focus

This Connector allows you to receive data from Syslog event sources and collect generated events.

36
Resource Center

View 17 items

Products

View 9 items

ArcSight

View 182 items

Sentinel

View 169 items

Partner Integrations

View 88 items

News & more

ArcSight Recon

ArcSight Recon is a comprehensive log management and security analytics solution that eases compliance burdens and accelerates forensic investigation for security professionals. It combines the compliance, storage and reporting needs of log management with the capabilities of big-data search and analysis. Recon is built for security event logs and is therefore more intuitive and accessible for security analysts, and it doesn’t require a DBA to operate.

Learn More

ArcSight Acquires SOAR

We are very excited to announce the acquisition of Atar Labs as they join the Micro Focus family! As long time SOAR partner with deep integrations into our ArcSight SIEM platform, you can enable your SOC to automate repetitive activities, improve analyst efficiency, and monitor and govern security operations performance with ease. Moving into the future, the full integration of SOAR into ArcSight’s unified platform will empower you with a holistic security posture to better detect, respond, and remediate threats.

Read the SOAR blog post

ArcSight’s Latest and Greatest

Read news, features and information about the latest ArcSight release. Learn about our newest products and the overall direction for security operations. Key highlights for each product within the portfolio give a quick overview of what’s new with ArcSight. Links to the newest product documentation are listed for more information. A version reference table helps you keep track of the latest versions for all your ArcSight products.

Sign in

ArcSight Recon is Here!

COVID-19 Cyber Threats

Micro Focus MITRE ATT&CK Navigator

Unmatched Security with ArcSight Interset Behavioral Analytics

DNS Security Check

Firewall Monitoring

Zerotect

Activate P-Blue Coat Proxy

Endgame

Microsoft Sysmon FlexConnector

Sysmon Framework

Activate Framework Wiki

Logger

Enterprise Security Manager (ESM)

Activate P-Snort

Activate P-Websense Security

Common Event Format Guide

L2-WannaCry Malware Detection - Situational Awareness

Anomalous Traffic Detection

WUC Parser Overrides

Activate P-Lenel Onguard2013

L3-Base - Threat and Impact Analysis

Logstash ArcSight Module

ESM Default Content

Cofense Triage

L1-Threat Intelligence – Indicators and Warnings

Web Application Security Framework

Activate P-Websense Security

HAFNIUM Targeting Microsoft Exchange Servers

NetIQ eDirectory FlexConnector with parser generator sc...

MITRE ATTACK Evaluations Round 3 - Carbanak and FIN7 Ad...

NetIQ Identity Manager

ESM Default Content

Agent Manager

Dragos

Anomali Link for ArcSight ESM

Blue Coat Security Analytics Platform

Damballa Failsafe

Connector

ESM Default Content

ArcSight SmartConnector Parser Update

Enterprise Security Manager (ESM)

MITRE ATTACK Evaluations Round 3 - Carbanak and FIN7 Ad...

Cisco Firepower (eStreamer and eNcore)

Customizing Rules to Work with ArcSight MITRE Package

Palo Alto Networks Next-Generation Firewalls

Logger

Firewall Monitoring

Brute Force Attack

Playbook-Phishing Email

Activate Base

CyberArk Privileged Account Security

MITRE ATTACK Package for ArcSight Logger

Syslog

Resource Center

Products

ArcSight

Sentinel

Partner Integrations

News & more

ArcSight Recon

ArcSight Acquires SOAR

ArcSight’s Latest and Greatest

Want to Contribute to the ArcSight Marketplace?

Sign up now, or contact us for more information.