ArcSight
Automatic deploy
Supported by community
Detection & Response Enablement
Overview
Sync IOCs from OpenCTI to an ArcSight ESM Active List in real time.
The OpenCTI ArcSight connector synchronises indicators of compromise from OpenCTI to an ArcSight ESM Active List in real time. Leveraging OpenCTI live streams, IPv4/IPv6 addresses, domain names, URLs and file hashes are added to (and removed from) a configurable Active List through the ESM Service Layer REST API, so correlation rules can match events against the threat intelligence curated in OpenCTI.
Basic information
Connectors
7.260706.0
7.260706.0
0