topic Re: Integrate with RSA Archer in Getting Data In

How do I send events from SPLUNK to be sent to RSA archer?

ofernandes — Fri, 01 Apr 2022 15:28:21 GMT

Hello everyone,

I am looking so send events from SPLUNK to be sent to RSA archer. does anyone have an idea what the best way to do it would be?

Thanks,
Oliver

Re: Integrate with RSA Archer

pylanch — Tue, 16 Sep 2014 16:33:32 GMT

This really becomes a programming question because both tools have a web API, so you just need to be able to interface with them. Splunk uses a REST API but has a good development kit to make things easier, and Archer uses a SOAP API.

A good place to start is the Splunk SDK:
http://dev.splunk.com/view/sdks/SP-CAAADP7

And here is the Archer documentation:
https://community.emc.com/community/connect/grc_ecosystem/rsa_archer

Adding records to Archer is slightly more complicated than pulling them out of Splunk, but essentially you just create a session token (general.CreateUserSessionFromInstance) and then add a record (record.CreateRecord) with your fields.

Re: Integrate with RSA Archer

nithin_shubhana — Fri, 15 May 2015 15:42:39 GMT

Now Integration between Splunk and RSA Archer is available. You can make use of the RSA Security Operations Solutions solution to integrate Splunk and RSA Archer.

Records will be created in the Security Incidents, Security alerts application in RSA Archer.

RSA Archer Security Operations Management helps you do the following:
a>Prioritize and respond faster to security incidents by leveraging business context and actionable threat intelligence.
b>Engage key business and IT stakeholders in the incident management process
c>Simplify incident investigation and breach response procedures through industry best practice methodologies and response procedures.
d>Optimize SOC investments through SOC KPI (key performance indicators)monitoring and staff time management tracking.

Also customers can make use of the Devices application present in the Enterprise management solution to add more business context for the devices, mention the criticality of the device, link the device to the Business Unit and have full fledged enterprise solution integrated with RSA SecOps solution.

More information about the integration can be found in the following link:
https://community.emc.com/docs/DOC-36270

To know more about RSA Security Operations Management solution refer to the following link:
https://community.emc.com/docs/DOC-39988

Regards,
Nithin Shubhananda

Re: Integrate with RSA Archer

Lindaiyu — Mon, 12 Sep 2016 16:03:58 GMT

Hello Nithin,

Thank you for sharing the information.
However, the link is not available now.
Could you please update the link? This subject is very intresting for us as a client of Archer.
Thank you very much.

Daiyu

Re: Integrate with RSA Archer

danglim — Tue, 27 Dec 2016 21:55:36 GMT

https://community.emc.com/docs/DOC-36270 This link is restricted. any chance you can grant access ?

Re: Integrate with RSA Archer

monteirolopes — Thu, 06 Jul 2017 18:05:35 GMT

Did you get the document? Is it possible to share?

Re: Integrate with RSA Archer

michael_daoust — Fri, 21 Jul 2017 16:13:59 GMT

I am unable to view the integration document also, I receive a restricted message. Can we get an updated location or make the document accessible?

Re: Integrate with RSA Archer

volkerstrecke — Wed, 24 Jan 2018 15:03:36 GMT

Here are some updated links:

Updated Links:

Splunk Technology Integration to RSA Netwitness (Security Analytics) (Event Source Configuration) (which then integrates to RSA Archer Security Operations & Breach Management):
https://community.rsa.com/docs/DOC-76132

RSA Netwitness Integration to RSA Archer (with Unified Collector Framework UCF):
https://community.rsa.com/docs/DOC-80978
https://community.rsa.com/docs/DOC-81705
https://community.rsa.com/docs/DOC-43085
https://community.rsa.com/docs/DOC-74023

RSA Archer Use-Cases Documentations:
https://community.rsa.com/docs/DOC-40093

RSA Archer Security Operations & Breach Management Use-Case:
https://community.rsa.com/docs/DOC-32889 (english)
https://community.rsa.com/docs/DOC-54512 (german)

RSA Archer Community:
https://community.rsa.com/community/products/archer-grc

RSA Archer Documentation & Downloads:
https://community.rsa.com/community/products/archer-grc/exchange/documentation-downloads
https://community.rsa.com/community/products/archer-grc/archer-customer-partner-community/platform/63

RSA Archer Community News Update:
https://community.rsa.com/docs/DOC-22846

Re: Integrate with RSA Archer

alohsleoj — Mon, 17 Jun 2019 21:19:26 GMT

These are just random docs that really does not answer the question asked.

Re: Integrate with RSA Archer

david09 — Fri, 01 Apr 2022 13:14:39 GMT

Hi Everyone,

Administrators can integrate RSA NetWitness Suite with RSA NetWitness Security Operations (SecOps) Manager to send alerts and incidents from NetWitness Suite to Archer for incident management and remediation. This guide provides a high-level workflow for configuring this integration.

System integration brings different programs together to work smoothly without interfering with each other or demanding duplicate actions from the users so that data can flow seamlessly and uninterruptedly. For more information about Integration with RSA Archer.

Click here: RSA Archer Training

I hope it solves your issue.

Regards,

David