cyber.hendryadrian.com
Detection & Defense · socprime.com

How to Export ArcSight Logs Using Logger, Syslog, or REST

· Original article ↗

Summary

A practical guide to exporting ArcSight events through Logger searches, CEF forwarding to a syslog collector, or the REST API. Original event text is available only if SmartConnectors preserve raw events.

Key points

  • ArcSight Logger is generally the appropriate source for bulk event exports and historical searches.
  • Logger searches require access to the relevant storage groups, and the data must remain within the retention period.
  • SmartConnectors preserve original event text only when raw event preservation is enabled; otherwise, exports contain normalized CEF fields.
  • Events can be forwarded as CEF over syslog to a collector, and Logger forwarders can send a past time range as a one-off.
  • Logger's REST API supports scripted logins and searches.
  • The guide recommends checking firewall, port, and protocol settings when a collector receives no events, and using TCP if UDP message-size limits truncate long CEF lines.
  • The guide suggests uploading exported logs to logtotal[.]com for sanitization and review.

Article Details

Defense Focus
Exporting, preserving, and reviewing security event data for detection and investigation.
Detection Methods
  • Search normalized event fields over a selected time range, then review the result count and export matching records.
  • Inspect preserved raw-event text when the original event wording or unmapped fields are needed.
  • Use packet capture to troubleshoot whether a collector is receiving syslog traffic on port 514.
Data Sources
  • Normalized CEF event fields
  • Original event text in the rawEvent field, when preservation was enabled
  • CEF records forwarded to a syslog collector
  • Collected CEF log files
Rule Types
  • Field-based event search queries using CEF field names
  • CEF over syslog
Defensive Actions
  • Enable raw-event preservation on connectors when original event text may be needed in future investigations.
  • Check search permissions, storage groups, and retention when expected events are unavailable.
  • Verify the collector’s firewall path, port, and protocol when forwarded events are not received.
  • Use TCP syslog when long CEF records are truncated by UDP message-size limits.
  • Review and sanitize exported files before uploading them for analysis.

Vendors

OpenTextOpenText ArcSight has been running in large SOCs for a long time, which means it often holds years of history nobody else has.

Products

ArcSight LoggerFor history, search in ArcSight Logger and export the results.ESMESM correlates them. Recon is the newer search and analytics layer.LogTotalBelow is how to get events out, sanitize them, and investigate them for free in LogTotal.OpenText ArcSightOpenText ArcSight has been running in large SOCs for a long time, which means it often holds years of history nobody else has.Prime CorePrime Core has 21,311 detection rules for ArcSight, mapped to 664 MITRE ATT&CK techniques.ReconRecon is the newer search and analytics layer.SmartConnectorFor a repeatable route, forward events from Logger or a SmartConnector to a syslog collector as CEF, and export the collector’s file.

Related Articles