Custom Connector Code Repository

This repository allows those interested in writing a custom connector to view existing scripts, as well as providing a rudimentary version control system.

	File	Modified
Labels No labels Preview View	File sdksnmp.1.snmptrap.properties trendmicro flex connector - working, no severity map. 2011-06-22. Eric Gustavson wrote.	Jun 22, 2011 by Former user
Labels No labels Preview View	File psoft_appsrv.sdkrfilereader.properties Peoplesoft AppServ FlexConnector - works but needs tweaking. Categorization map in separate file. v1.	Jun 23, 2011 by Former user
Labels No labels Preview View	File Peoplesoft_Financials.csv Categorization Map for Peoplesoft AppServ FlexConnector. Very very minimal for now. v1.	Jun 23, 2011 by Former user
Labels No labels Preview View	File agent.properties agent.properties file for UITFlex on finch. Currently used for FMQA appserver only. Warning: Re-parses all APPSRV_* logs every time connector is started. v1.	Jun 23, 2011 by Branden
Labels No labels Preview View	File weblogic.csv WebLogic FC Categorization File. v1.	Jun 29, 2011 by Branden
Labels No labels Preview View	File weblogic.sdkrfilereader.properties Hot custom-made FC for WebLogic. v1.	Jun 29, 2011 by Branden
Labels No labels Preview View	File weblogic-finch-agent.properties agent.properties file for Finch/Weblogic FC. v1.	Jun 29, 2011 by Branden
Labels No labels Preview View	File trendmicroregex.rtf	Jul 11, 2011 by Benjamin.Walther

Download All

Specific Comments

H/T Eric Gustavson:

A few notes:

   - \\
   - In *regular* regular expressions the whitespace character is: \w
      - In arcsight regex, it's: \\w
      - Arcsight rule of thumb: make every backslash a double backslash
   - __stringConstant("asdf")
      - You will need to use this function to declare that your string constant is indeed a string constant, which is required for ArcSight 'String' fields. Go figure.
   - The flexconnector documentation covers most of this, but probably won't help you put the pieces together from scratch very well
   - The filename is important. The '1' in the filename is the SNMP trap type.
--Eric