https://community.splunk.com/t5/Getting-Data-In/ArcSight-and-Splunk/m-p/91435#M19013 <P>Have a look at this document. <A href="http://www.splunk.com/web_assets/pdfs/resources/Integrating_Splunk_with_Arcsight.pdf" target="_blank">http://www.splunk.com/web_assets/pdfs/resources/Integrating_Splunk_with_Arcsight.pdf</A> While this provides the basics, I believe that more in depth work would be needed to properly map the Windows audit logs.</P> Mon, 28 Sep 2020 14:42:01 GMT mlulmer 2020-09-28T14:42:01Z https://community.splunk.com/t5/Getting-Data-In/ArcSight-and-Splunk/m-p/91433#M19011 <P>Hi,</P> <P>From you earlier post, I understand that you have integrated Splunk with ArcSight and so I would request if you please help me to understand a few question here,</P> <P>What should be the SIEM architecture in a scenario where I have ArcSight Manager, Logger and connector and now I want to integrate Splunk for long term data retention purpose. I find that long term data retention is not a good cost effective option with ArcSight Logger and also searching performance is very slow in archived data since it does not contain index information. Also please send me the integration document between ArcSight and Splunk.</P> Tue, 16 Oct 2012 09:19:45 GMT https://community.splunk.com/t5/Getting-Data-In/ArcSight-and-Splunk/m-p/91433#M19011 rakeshmukherjee 2012-10-16T09:19:45Z https://community.splunk.com/t5/Getting-Data-In/ArcSight-and-Splunk/m-p/91434#M19012 <P>I think you've misunderstood the purpose of splunkbase. It is not a general forum for communicating requests to Splunk sales. It is a questions/answers sites where volunteers help out with issues and queries regarding designing, implementing and operating Splunk installations. As such, my suggestion is that you get in contact with Splunk sales.</P> Tue, 16 Oct 2012 10:25:50 GMT https://community.splunk.com/t5/Getting-Data-In/ArcSight-and-Splunk/m-p/91434#M19012 Ayn 2012-10-16T10:25:50Z https://community.splunk.com/t5/Getting-Data-In/ArcSight-and-Splunk/m-p/91435#M19013 <P>Have a look at this document. <A href="http://www.splunk.com/web_assets/pdfs/resources/Integrating_Splunk_with_Arcsight.pdf" target="_blank">http://www.splunk.com/web_assets/pdfs/resources/Integrating_Splunk_with_Arcsight.pdf</A> While this provides the basics, I believe that more in depth work would be needed to properly map the Windows audit logs.</P> Mon, 28 Sep 2020 14:42:01 GMT https://community.splunk.com/t5/Getting-Data-In/ArcSight-and-Splunk/m-p/91435#M19013 mlulmer 2020-09-28T14:42:01Z