Additional Data in ArcSight ESM

Everyone who had ever installed a single ArcSight SmartConnector knows about ‘Device Event Mapping to ArcSight Fields’ chapter in the installation guide where you can find information on mapping of Device-Specific fields to ArcSight Event Scheme. It’s an essential chapter for Analysts, right? Certainly, you noticed that for some SmartConnectors there are ‘Additional Data’ fields. For example:

Where do they come from? Why do we need them? How to use them?

Well, during parsing, connector knows how to process and get data from the event. Important values are mapped to ArcSight fields at once, but the rest, let’s assume they are not widely used or whatever, are not mapped. Ignoring them is not right, so ArcSight provides the ability for a user to decide whether or not those values are needed for him, and he can map them if needed.
Using Additional Data allows saving bandwidth, storage space and connector load.

The SmartConnector tracks whatever additional data names it encounters and reports this information to the ArcSight Console.

Manipulations with ‘Additional Data’ fields are performed through SmartConnector commands from the ArcSight Console, as shown:

Let’s take an example. By default, Windows Unified Connector doesn’t map Windows version to any ArcSight field. But I want to have it. What should I do?
Select ‘Get Additional Data Names’ (from the menu shown above).
You’ll get something like the following on Viewer Panel, the list of all available additional data fields:

As you can see, there is a field called ‘WindowsVersion.’ And I want to have this value in Device Version ArcSight field.

Select ‘Map Additional Data Name…’ command. It will open the following dialog:

Specify requested information. ‘ArcSight field’ is a field where you want to map Additional Data (in our example – Device Version in camel case).

Note: The Device vendor and Device product fields can be left blank to create a generic mapping, or filled in for a specific mapping. The additional data name is usually one of the names shown in the Get Additional Data Names output. The ArcSight field must be a valid ArcSight event field.

The command output for a successful mapping looks as follows:
Successfully mapped additional data name [WindowsVersion] to event field [deviceVersion] for vendor/product [Microsoft/Microsoft_Windows]

Let’s check newly come events. Here we go:

If you don’t need that value anymore, you can unmap it. To unmap Additional Data values use ‘Unmap Additional Data Name…’ command. It will open the following dialog:

Specify requested information. The additional data name should be one that was previously mapped for the specified device vendor and product combination. Click ‘OK.’

The command output for successful unmapping looks as follows:
Successfully unmapped additional data name [WindowsVersion] for vendor/product [Microsoft/Microsoft_Windows]

Done.