Installing ArcSight SmartConnector by using the console (Linux)
22 August 2024
ID 167454
You can install ArcSight SmartConnector on Linux by using the console instead of the GUI installer.
To install ArcSight SmartConnector by using the console:
- In the console, run the ArcSight SmartConnector installer.
- Read the Introduction section, and then press Enter.
- When prompted, select Choose Install Folder, and type the full path to the directory where ArcSight SmartConnector will be installed (
%ARCSIGHT_HOME%
).The default value of the installation directory is
/root/ArcSightSmartConnectors
. - When prompted, select Choose Link Location, and then specify whether a link to the installation directory must be created.
We recommend that you specify
Don't create links
. - Make sure that the Pre-Installation Summary section lists the correct values of the installation settings. Press Enter if the values are correct.
After ArcSight SmartConnector is installed, the following information will be displayed in the console:
Installation Complete
---------------------
The core components of the ArcSight SmartConnector have been successfully installed to:
%ARCSIGHT_HOME%
To finish the configuration of the SmartAgent, please go to the folder:
%ARCSIGHT_HOME%/current/bin/
and execute the script:
./runagentsetup.sh
- Run
%ARCSIGHT_HOME%/current/bin/runagentsetup.sh
. - Run
Add a Connector
. - Specify
Syslog Daemon
as the connector type. - Specify the following settings of the connector:
- Network Port
Specify the port to which Kaspersky CyberTrace Service sends events. This port is specified on the Settings > Service tab of Kaspersky CyberTrace Web (by default, it is
9998
). - IP Address
Specify the IP address to which Kaspersky CyberTrace Service sends events. This IP address is specified on the Settings > Service tab of Kaspersky CyberTrace Web (by default, it is
127.0.0.1
).You can specify
ALL
if you want Arcsight SmartConnector to receive events from all network interfaces of the computer on which it runs. Note that you cannot specifyALL
in the Kaspersky CyberTrace Service configuration file. - Protocol
Specify
Raw TCP
. - Forwarder
Specify
false
.
- Network Port
- Specify
ArcSight Manager (encrypted)
as the destination type. - Specify whether to mask passwords.
It is recommended to specify
yes
. - Specify the following connection settings of ArcSight Manager:
- Manager Hostname
ArcSight Manager host.
- Manager Port
ArcSight Manager port. By default, it is
8443
. - User
Name of the user that has the right to register a connector in ArcSight.
- Password
Password of the specified user.
- AUP Master Destination
Specify
False
. - Filter Out All Events
Specify
False
. - Enable Demo CA
Specify
False
.
- Manager Hostname
- Specify the following connector settings:
- Name
An arbitrary value can be specified.
- Location
An arbitrary value can be specified.
- DeviceLocation
An arbitrary value can be specified.
- Comment
An arbitrary value can be specified.
After this, the connector will be registered.
- Name
- Specify the following action for importing the certificate:
Import the certificate to connector from destination
. - Make sure that the displayed data is correct.
If the correct data is displayed, type
yes
. - Specify how the connector must be installed:
Install as a service
. - Specify the service settings:
- Service Internal Name
- Service Display Name
- Start the service automatically
Indicates whether the service will start on the system startup. We recommend that you specify
yes
.
- Check the specified data. If it is correct, press Enter.
The connector will be installed as a service.
- Start the connector by calling the following command:
/etc/init.d/arc_$service_name start
In this command,
$service_name
is the service internal name that you specified.
After you have installed ArcSight SmartConnector, you can install Kaspersky CyberTrace and integrate it with ArcSight.