Create and name the profile for ArcSight ESM event ingestion integration

You can set up a profile to ingest correlation events.

始める前に

Role required: sn_si.admin

手順

1. To create an event profile for a correlation event in your ServiceNow AI Platform instance, navigate to ArcSight ESM Integration > ArcSight ESM Event Profile.
2. Click New.
3. Fill in the fields.

   An example of a completed form follows the table.

   Field	Description
   Name	Unique name for the profile. If names are not unique, an error will be displayed and duplicate profile names are not saved. Profile names in your ServiceNow AI Platform instance must be unique.
   Active	heck box is cleared by default. If this option is disabled, the profile is not active and ingestion will not take place. 注: You should complete all sections in the profile before making it active.
   ArcSight Source	The ArcSight ESM server configured during the initial authentication step. If you have multiple ArcSight ESM servers configured, select the appropriate server for the correlation event types that will be ingested for the profile. You are required to select a value.
   Query Viewer ID	Enter the Resource ID of the configured Query Viewer in the ArcSight ESM Console. The Resource ID is a unique identifier for any Query Viewer configured in the ArcSight ESM server. Once the Resource ID is submitted, the name of the Query View will be returned to ensure that the right Query Viewer has been selected. See the section below for screen shot view of how to determine the Resource ID for the selected Query Viewer in ArcSight ESM.
   Order	Default is 100. If you have created multiple profiles, this value provides a run time execution priority when two or more profiles share the same triggering conditions. The workflow in the profile with the lowest number has the highest priority.
   (Optional) Description	Additional text to help you distinguish this profile from other profiles.

   The following figure is an example of a completed form.
   
   

   After you have entered the profile details, click Continue. The Query Viewer ID is validated and if a corresponding Resource ID is present in the ArcSight ESM Query Viewer, the name of the Query Viewer will be returned as shown below. If the validation fails, check if the Resource ID exists in the ArcSight ESM console. If the Resource ID is not found, find the correct Resource ID and enter it in the profile.
   
   

次のタスク

The next step is to select the correlation event types for ingestion from the Query Viewer that was selected in the prior step.