top of page

Assigning Zones to Logger Destinations

  • Writer: Pavan Raja
    Pavan Raja
  • Apr 8, 2025
  • 2 min read

Summary:

The document outlines a method for mapping zones to logger destinations in a connector configuration, ensuring that when new Logger destinations are added, specific XML config files are created for them with relevant zone mappings. These mappings involve copying user-zone-mappings and system-zone-mappings from existing ESM destination folders to the new ones associated with the destination name. After bouncing the connector, it integrates these mappings into forwarded events, which should be properly populated with zone information when sent to Extended Simulation Mode (ESM). The passage also addresses a critical issue in updating network models within ESM by emphasizing that changes must be manually propagated from ESM to connectors. If certain destinations are removed from connectors, a dummy connector is required as an intermediary to maintain the integrity and functionality of the model by carrying over essential user-zone-mappings and system-zone-mappings folders between ESM and connectors.

Details:

The process of assigning zones to logger destinations involves updating a connector's configuration to include zone mappings for each destination, including Logger destinations. When adding a new destination to a connector, such as a Logger destination, the connector creates a unique XML config file for it. To apply zone mappings specific to that destination, simply create a new folder under the AUP folder with the same name as the destination (without the XML extension). Copy the user-zone-mappings and system-zone-mappings folders from an existing ESM destination to this new folder. After bouncing the connector, it will incorporate these mappings into events forwarded to Logger destinations. When forwarding these events to ESM, the zone information should be properly populated due to the assignments made in the connector within ESM. The passage highlights a methodological issue with updating network models in Extended Simulation Mode (ESM). When changes are made to the network model within ESM, these modifications need to be manually propagated to connectors. If the ESM destinations are eventually removed from the connectors for certain use cases, there must be at least one dummy connector registered to act as a link between ESM and the connectors. This dummy connector serves to pull essential user-zone-mappings and system-zone-mappings folders necessary for maintaining the model's integrity and functionality.

Disclaimer:
The content in this post is for informational and educational purposes only. It may reference technologies, configurations, or products that are outdated or no longer supported. If there are any comments or feedback, kindly leave a message and will be responded.

Recent Posts

See All
Zeus Bot Use Case

Summary: "Zeus Bot Version 5.0" is a document detailing ArcSight's enhancements to its Zeus botnet detection capabilities within the...

 
 
 
Windows Unified Connector

Summary: The document "iServe_Demo_System_Usage_for_HP_ESP_Canada_Solution_Architects_v1.1" outlines specific deployment guidelines for...

 
 
 

Comments


@2021 Copyrights reserved.

bottom of page