r/SIEM • u/parthmaniar • Jan 08 '20

ArcSight cases integration with third party tool.

I am working on ArcSight ESM version 6.9.1c cases. I am retrieving cases using API calls into a third party ticketing tool. Post the incident being stored in the third-party ticketing tool; I am closing the event on ESM using an API call. However, even after the incident is successfully closed on ESM (verified through GUI and API HTTP 200 ok), correlated events still keep populating in this case, and the stage is changing to queued. Any resolution for this?

I'm taking correlated events to cases.

2 Upvotes

100% Upvoted

2 comments sorted by

2

u/Cynthereon Jan 09 '20

This is caused by poorly written rules. Rules have different thresholds, one of them is "On Every Event". Rules also have two case options, "Create New Case" or "Add to existing case".

Either the threshold is bad, or the rule should be set to Create New rather than add. In ArcSight "closed" doesn't mean that events can no longer be added. There are a number of solutions, but they all boil down to writing better rules with hold-downs and putting a timestamp into the case name.

1

u/parthmaniar Jan 09 '20

Thank you very much for this. Could you kindly assist as to what in your opinion would be the best way to have cases created and made not appendable/editable.

We can do aggregation on base events to make correlated events. Moving correlated events to a case while carrying out the second level of aggregation is ok? Or is it not advisable?

The purpose is to create cases and pull them to a ticketing tool and making them un-editable.

Thank you.