ArcSight Marketplace

FREE

Micro Focus COMMUNITY

Firewall Monitoring

Micro Focus

The Firewall Monitoring use case has been updated. Firewall Monitoring 1.2 provides improved content and performance, as well as additional resources

1,463

FREE

Community

DNS Security Check

SOC Prime

DNS Security Check is a straightforward Use Case that easily finds DNS Misconfigurations and anomalies in network. Despite its maturity and long history, DNS protocol was not designed with security in mind and thus has many means of malicious exploitation.

890

Community

Endgame

Endgame

Endgame is the comprehensive endpoint security platform that prevents, detects, and responds to known and unknown threats at the earliest and all stages of the attack lifecycle. Endgame prevents breaches and transforms security analysts into Hunters.

95

FREE

Micro Focus COMMUNITY

Activate P-Blue Coat Proxy

Micro Focus

Product package covering proxy traffic events from Blue Coat.

808

FREE

Community

Zerotect

Polyverse Corporation

Zerotect is an open-source agent that, integrated with Micro Focus ArcSight, detects attempted zero-day attacks with no prior knowledge of the vulnerability or attack being used.

33

FREE

Community

SOC Prime SSL Framework for Arcsight

SOC Prime

SOC Prime SSL Framework combines the capabilities of Qualys SSL Labs and SIEM systems. As a result, this integration enables automatic tracking of the status of SSL certificates and web servers security in the corporate domain.

254

FREE

Micro Focus COMMUNITY

Activate P-MobileIron Sentry

Micro Focus

The P-MobileIron Sentry package offers an easy way to monitor product-specific, host, and entity related individual incidents.

50

Micro Focus COMMUNITY

Enterprise Security Manager (ESM)

Micro Focus

ArcSight ESM analyzes and correlates every event that occurs across the organization--every login, logoff, file access, database query--to deliver accurate prioritization of security risks and compliance violations.

3,268

Micro Focus COMMUNITY

Logger

Micro Focus

ArcSight Logger delivers a cost-effective universal log management solution that unifies searching, reporting, alerting, and analysis across any type of enterprise machine data.

1,721

FREE

Micro Focus COMMUNITY

Activate P-Snort

Micro Focus

This product-specific package includes the resources that support the Perimeter and Network Monitoring use case categories. Install this package if you collect Snort or Sourcefire logs for your ESM.

464

FREE

Micro Focus COMMUNITY

Activate P-Websense Security

Micro Focus

This product-specific package includes the resources that support the Perimeter and Network Monitoring use case categories.

598

Micro Focus COMMUNITY

Common Event Format Guide

Micro Focus

Standardize event data at the source using the Common Event Format, an open log management standard.

481

FREE

Micro Focus COMMUNITY

Reconnaissance

Micro Focus

The Reconnaissance use case uncovers and tracks, in real time, scans from external and internal sources with the goal of uncovering weaknesses in hosts and network ports.

915

FREE

Micro Focus COMMUNITY

L2-WannaCry Malware Detection - Situational Awareness

Micro Focus

This package is intended to detect WannaCry malware IOCs incidents and provide ArcSight context to them, using both the ArcSight Network and Asset Model to alert the SOC Analyst and Operator of potential WannaCry IOCs in critical hosts.

643

FREE

Micro Focus COMMUNITY

Anomalous Traffic Detection

Micro Focus

The Anomalous Traffic Detection use case helps you identify sudden spikes in network traffic so that you can detect potential malicious activity. Sudden spikes in traffic can be caused by scheduled backups or virus scanner updates inside your LAN.

1,154

FREE

Micro Focus COMMUNITY

WUC Parser Overrides

Micro Focus

Various overrides for the WUC

311
FREE

Micro Focus COMMUNITY

Activate P-Lenel Onguard2013

Micro Focus

This product-specific package includes the resources that support the Physical Badge Access monitoring Use cases. Install the package once you collect Lenel Onguard2013 events.

184

$600

Community

File Hash Analytics

SOC Prime

File Hash Analytics case works by tracking hashes of potentially harmful software, files and processes their start across the Company hosts. Also, use case allows you to track rare hashes, whether the same file names with different hashes.

FREE

Community

Cofense Triage

Cofense, Inc.

Cofense Triage provides security operations center (SOC) analysts and incident responders insight into ongoing spear phishing attacks by automating the analysis and orchestrating the workflow associated with employee reported suspicious emails.

45

$450

Community

Ransomware Hunter

SOC Prime

Ransomware Hunter natively integrates with ArcSight ESM and leverages statistical profiling and behavioral analysis methods, OSINT feeds including Ransomware Tracker by Abuse.ch and Detect Tor feed as well as strictly defined correlation rules.

FREE

Micro Focus COMMUNITY

ESM Default Content

Micro Focus

ESM Default Content includes Security Threat Monitoring package and Threat Intelligence Platform package, It also includes resources for tracking Techniques from the MITRE ATT& CK framework.

2,566

FREE

Community

Logstash ArcSight Module

Elastic

The Logstash ArcSight module enables you to easily integrate with the ArcSight Data Platform (ADP) to explore and visualize data in real-time with the Elastic Stack.

360

FREE

Micro Focus COMMUNITY

L3-Base - Threat and Impact Analysis

Micro Focus

This package contains the supporting resources (active lists and rules) for tracking the activity of systems, user accounts, service accounts, system accounts, etc., across the ArcSight Attack Life Cycle phases for this method.

390

FREE

Micro Focus COMMUNITY

L1-Threat Intelligence – Indicators and Warnings

Micro Focus

This package populates, displays, and monitors the Threat Model, which is used to detect and contextualize potential malicious activity based on intelligence derived from a site-specific mix of threat intelligence sources.

2,076

$1100

Community

Web Application Security Framework

SOC Prime

The goal of Web Application Security Framework is to minimize risks related to the usage of publicly accessible web applications. The main business task of public web applications is to provide service access to as many people as possible.

FREE

Micro Focus COMMUNITY

Activate P-Websense Security

Micro Focus

This product-specific package includes the resources that support the Perimeter and Network Monitoring use case categories.

598
FREE

Community

AQUA CONTAINER SECURITY PLATFORM

Aqua Security

Aqua Security enables enterprises to secure their virtual container environments from development to production, accelerating container adoption and bridging the gap between DevOps and IT security.

96

FREE

Community

Absolute SIEM Connector

Absolute Software

Absolute Data & Device Security (DDS) is an adaptive endpoint security solution. It provides you with a persistent connection to all of your endpoints and the data they contain. Alert data generated by Absolute DDS and other security solutions can be fed into the HPE ArcSight SIEM solution and analyzed in context, offering a holistic view of the entire security posture of your organization.

95

FREE

Community

Attivo Networks Common Event Format Integration Guide

Helena Kuly

This guide provides information for configuring Attivo BOTSink for the Syslog event collection. This integration is supported on Linux platforms. Device versions starting at 4.0 are supported.

70

FREE

Micro Focus COMMUNITY

IDS-IPS Monitoring Package for Logger

Micro Focus

The IDS - IPS Monitoring use case provides an overview of the activity identified by the Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS).

435

FREE

Micro Focus COMMUNITY

Spamming Zombies Activity

Micro Focus

This solution leverages ArcSight Logger to identify and detect spam zombie activity in the organization.

383

FREE

Micro Focus COMMUNITY

Ransomware Activity

Micro Focus

The Ransomware Activity content package leverages ArcSight Logger to monitor ransomware activity on the organization using ransomwaretracker.abuse.ch threat intelligence.

817

FREE

Micro Focus COMMUNITY

Compromised Host

Micro Focus

The Compromised Host Security Use Case is a Logger solution that provides resources to investigate whether a host is compromised, using information from Arcsight Logger and Arcsight Events.

528

FREE

Micro Focus COMMUNITY

Bad User Agent Activity

Micro Focus

The Detecting Bad User Agents Content Package leverages ArcSight Logger to identify and detect bad user agents’ activity in the organization.

567

Micro Focus COMMUNITY

Connector

Micro Focus

ArcSight Connectors automate the process of collecting and managing logs from any device and in any format through normalization and categorization of logs into a unified format known as Common Event Format (CEF)

6,413

FREE

Micro Focus COMMUNITY

Cloud Hopper for Logger

Micro Focus

The package leverages ArcSight Logger to search different Indicators of Compromise (IOCs) which are related to APT10’s Cloud Hopper and reports the results.

134
FREE

Micro Focus COMMUNITY

ESM Default Content

Micro Focus

ESM Default Content includes Security Threat Monitoring package and Threat Intelligence Platform package, It also includes resources for tracking Techniques from the MITRE ATT& CK framework.

2,566

FREE

Micro Focus COMMUNITY

ArcSight SmartConnector Parser Update

Micro Focus

Monthly SmartConnector Parser Release

11,329

Micro Focus COMMUNITY

Connector

Micro Focus

ArcSight Connectors automate the process of collecting and managing logs from any device and in any format through normalization and categorization of logs into a unified format known as Common Event Format (CEF)

6,413

Micro Focus COMMUNITY

Enterprise Security Manager (ESM)

Micro Focus

ArcSight ESM analyzes and correlates every event that occurs across the organization--every login, logoff, file access, database query--to deliver accurate prioritization of security risks and compliance violations.

3,268

FREE

Community

Customizing Rules to Work with ArcSight MITRE Package

Sliman Mansour

How to customize your rules so it will work with the ArcSight MITRE ATT& CK content

586

FREE

Partner

Cisco Firepower (eStreamer and eNcore)

Cisco

Cisco Firepower Management Center Integration with ArcSight

510

FREE

Micro Focus COMMUNITY

Activate Base

Micro Focus

ArcSight Activate is a modular content development method designed to quickly deploy actionable use cases. The framework will unify our development methodology, allowing us to create portable content packages.

5,394

FREE

Community

MITRE ATTACK Package for ArcSight Logger

Sliman Mansour

The Logger MITRE ATT&CK Package is a set of Logger Searches which let you hunt MITRE ATT&CK related activity.

306

FREE

Micro Focus COMMUNITY

Playbook-Block Malicious IPs on Checkpoint R80 NGFW

Micro Focus

A Playbook for Block Malicious IPs on Checkpoint R80 NGFW Usecase

39

FREE

Micro Focus COMMUNITY

Anomalous Traffic Detection

Micro Focus

The Anomalous Traffic Detection use case helps you identify sudden spikes in network traffic so that you can detect potential malicious activity. Sudden spikes in traffic can be caused by scheduled backups or virus scanner updates inside your LAN.

1,154

FREE

Micro Focus COMMUNITY

Playbook-Phishing Email

Micro Focus

A Playbook for Phishing Email Usecase

32

FREE

Micro Focus COMMUNITY

Playbook-Command and Control Traffic-2

Micro Focus

A Playbook for Command and Control Traffic Use case

29

FREE

Community

ESM and Recon - Alerting and Responding to Zero-Day Att...

Sliman Mansour

Polyverse Zerotect is an open-source agent which detects attempted zero-day attacks, with no prior knowledge of the vulnerability or attack being used. This Package contains ArcSight Content based on events report from Polyverse Zerotect.

28

FREE

Micro Focus COMMUNITY

Playbook-Command and Control Traffic-1

Micro Focus

A Playbook for Command and Control Traffic Usecase

27

FREE

Micro Focus COMMUNITY

L1-Entity Monitoring

Micro Focus

The L1-Entity Monitoring - Indicators and Warnings package is designed to identify anomalies dealing with account authentication and management.

1,362

FREE

Micro Focus COMMUNITY

Playbook-Virus Traffic in the Network

Micro Focus

A Playbook for Virus Traffic in the Network Usecase

25
Products

View 9 items

ArcSight

View 184 items

Partner Integrations

View 101 items

Sentinel

View 168 items

Resource Center

View 17 items

News & more

ArcSight Recon

ArcSight Recon is a comprehensive log management and security analytics solution that eases compliance burdens and accelerates forensic investigation for security professionals. It combines the compliance, storage and reporting needs of log management with the capabilities of big-data search and analysis. Recon is built for security event logs and is therefore more intuitive and accessible for security analysts, and it doesn’t require a DBA to operate.

Learn More

ArcSight Acquires SOAR

We are very excited to announce the acquisition of Atar Labs as they join the Micro Focus family! As long time SOAR partner with deep integrations into our ArcSight SIEM platform, you can enable your SOC to automate repetitive activities, improve analyst efficiency, and monitor and govern security operations performance with ease. Moving into the future, the full integration of SOAR into ArcSight’s unified platform will empower you with a holistic security posture to better detect, respond, and remediate threats.

Read the SOAR blog post

ArcSight’s Latest and Greatest

Read news, features and information about the latest ArcSight release. Learn about our newest products and the overall direction for security operations. Key highlights for each product within the portfolio give a quick overview of what’s new with ArcSight. Links to the newest product documentation are listed for more information. A version reference table helps you keep track of the latest versions for all your ArcSight products.

Sign in

ArcSight Recon is Here!

COVID-19 Cyber Threats

Micro Focus MITRE ATT&CK Navigator

Unmatched Security with ArcSight Interset Behavioral Analytics

Firewall Monitoring

DNS Security Check

Endgame

Activate P-Blue Coat Proxy

Zerotect

SOC Prime SSL Framework for Arcsight

Activate P-MobileIron Sentry

Enterprise Security Manager (ESM)

Logger

Activate P-Snort

Activate P-Websense Security

Common Event Format Guide

Reconnaissance

L2-WannaCry Malware Detection - Situational Awareness

Anomalous Traffic Detection

WUC Parser Overrides

Activate P-Lenel Onguard2013

File Hash Analytics

Cofense Triage

Ransomware Hunter

ESM Default Content

Logstash ArcSight Module

L3-Base - Threat and Impact Analysis

L1-Threat Intelligence – Indicators and Warnings

Web Application Security Framework

Activate P-Websense Security

AQUA CONTAINER SECURITY PLATFORM

Absolute SIEM Connector

Attivo Networks Common Event Format Integration Guide

IDS-IPS Monitoring Package for Logger

Spamming Zombies Activity

Ransomware Activity

Compromised Host

Bad User Agent Activity

Connector

Cloud Hopper for Logger

ESM Default Content

ArcSight SmartConnector Parser Update

Connector

Enterprise Security Manager (ESM)

Customizing Rules to Work with ArcSight MITRE Package

Cisco Firepower (eStreamer and eNcore)

Activate Base

MITRE ATTACK Package for ArcSight Logger

Playbook-Block Malicious IPs on Checkpoint R80 NGFW

Anomalous Traffic Detection

Playbook-Phishing Email

Playbook-Command and Control Traffic-2

ESM and Recon - Alerting and Responding to Zero-Day Att...

Playbook-Command and Control Traffic-1

L1-Entity Monitoring

Playbook-Virus Traffic in the Network

Products

ArcSight

Partner Integrations

Sentinel

Resource Center

News & more

ArcSight Recon

ArcSight Acquires SOAR

ArcSight’s Latest and Greatest

Want to Contribute to the ArcSight Marketplace?

Sign up now, or contact us for more information.