# any ArcSight users? **URL:** \ **Category:** Zeek\ **Created:** [May 15, 2013, 5:22pm UTC](https://community.zeek.org/t/any-arcsight-users/2677 "2013-05-15T17:22:54Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Michael\_Cox](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@Michael\_Cox](https://community.zeek.org/u/Michael_Cox)\ **Post date:** [May 15, 2013, 5:22pm UTC](https://community.zeek.org/t/any-arcsight-users/2677/1 "2013-05-15T17:22:54Z")
Anyone feeding Bro logs to ArcSight? If so, could you ping me back, please? We can take it off-list. I’m having issues with their connector. I know… talk to the vendor… but that’s not always as fruitful as one would like to think. Thanks, Michael ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [May 15, 2013, 5:36pm UTC](https://community.zeek.org/t/any-arcsight-users/2677/2 "2013-05-15T17:36:36Z")
Sounds worthwhile, please keep it on list!   .Seth ---
**Author:** ![Brad\_Doctor](https://avatars.discourse-cdn.com/v4/letter/b/919ad9/32.png) [@Brad\_Doctor](https://community.zeek.org/u/Brad_Doctor)\ **Post date:** [May 15, 2013, 6:28pm UTC](https://community.zeek.org/t/any-arcsight-users/2677/3 "2013-05-15T18:28:11Z")
yup - a flex connector is your answer. -brad ---
**Author:** ![Michael\_Cox](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@Michael\_Cox](https://community.zeek.org/u/Michael_Cox)\ **Post date:** [May 15, 2013, 6:47pm UTC](https://community.zeek.org/t/any-arcsight-users/2677/4 "2013-05-15T18:47:15Z")
Did you try their canned “Bro IDS NG” connector? “NG” is their way of saying v2.1. It parses OK, but I’m having issues with log rotation. Could you share your agent.properties file for the rotation options? Thanks again, Michael ---
**Author:** ![Brad\_Doctor](https://avatars.discourse-cdn.com/v4/letter/b/919ad9/32.png) [@Brad\_Doctor](https://community.zeek.org/u/Brad_Doctor)\ **Post date:** [May 15, 2013, 6:50pm UTC](https://community.zeek.org/t/any-arcsight-users/2677/5 "2013-05-15T18:50:26Z")
we did, but as we customize our format, it didn’t work. and we have a lot of sensors reporting in via syslog forwarding, so the flexconnector was the most reliable way to do this. syslog subagent, basically. -brad ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [May 15, 2013, 7:02pm UTC](https://community.zeek.org/t/any-arcsight-users/2677/6 "2013-05-15T19:02:08Z")
What do you mean you customize your format?   .Seth ---
**Author:** ![Brad\_Doctor](https://avatars.discourse-cdn.com/v4/letter/b/919ad9/32.png) [@Brad\_Doctor](https://community.zeek.org/u/Brad_Doctor)\ **Post date:** [May 15, 2013, 7:08pm UTC](https://community.zeek.org/t/any-arcsight-users/2677/7 "2013-05-15T19:08:26Z")
in the .bro files, some changes have been made to the format to better suite our needs. as such that completely breaks the arcsight connector. ---
**Author:** ![Michael\_Cox](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@Michael\_Cox](https://community.zeek.org/u/Michael_Cox)\ **Post date:** [May 15, 2013, 7:37pm UTC](https://community.zeek.org/t/any-arcsight-users/2677/8 "2013-05-15T19:37:03Z")
I made a quick flex connector (file reader) for just the http.log as a test. It all works fine, and it handles file rotation without the problems I am seeing with the canned connector. There’s a handy function built into the flex connector, \_createLocalTimeStampFromSecondsSinceEpoch(), to convert the time to a format that ESM can deal with. Everything else was very simple and straightforward. Hopefully the thread will help someone else. Regards, Michael ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/any-arcsight-users/2677/9 "2022-05-06T15:40:59Z")