Follow How you export from ArcSight depends on which part of it holds the data. For history, search in ArcSight Logger and export the results. For a repeatable route, forward events from Logger or a SmartConnector to a syslog collector as CEF, and export the collector’s file. One thing decides how useful any export is: the original raw event is kept only if your SmartConnectors were configured to preserve it.
OpenText ArcSight has been running in large SOCs for a long time, which means it often holds years of history nobody else has. Prime Core has 21,311 detection rules for ArcSight, mapped to 664 MITRE ATT&CK techniques. Below is how to get events out, sanitize them, and investigate them for free in LogTotal.
Before you start
Which ArcSight? Logger stores and searches events. ESM correlates them. Recon is the newer search and analytics layer. For bulk export, Logger is usually the right place.
Is the raw event there? SmartConnectors normalize events into CEF fields. They keep the original text only with raw event preservation turned on. If it was off, you can export the normalized CEF events, but not the original lines.
Rights and retention. You need a Logger user that can search the storage groups involved, and the data has to still be within Logger’s retention.
Option 1: Logger search and export
- In Logger, open Search, set the time range, and write the query using CEF field names, for example destinationHostName = “web-03” AND deviceVendor = “Unix”.
- Run it and check the count.
- Export the results.
Option 2: Forward CEF to a syslog collector
Set up a small Linux collector with rsyslog listening on UDP or TCP 514. Then point a Logger forwarder or a SmartConnector destination at it, in CEF over syslog. Logger forwarders can also send a past time range as a one-off. Then cut the window you need from the collector’s file:
grep 'web-03' /var/log/arcsight/cef.log > arcsight_web03.log
Each line is a CEF record: a header with vendor, product and event name, then key=value extensions. If raw event preservation was on, the original text sits in the rawEvent field.
Option 3: Logger REST API
Logger also has a REST API for logging in and running searches, which suits scripted exports.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize. Look it over before you continue.
- Review.
What this looks like on real data.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| No original log text in the export | Raw event preservation was off on the SmartConnector | Export normalized CEF; turn preservation on for the future |
| Search finds nothing | Wrong storage group, or outside retention | Check storage groups and retention |
| Collector receives nothing | Firewall, wrong port or protocol | Check each hop; tcpdump -n port 514 on the collector |
| Long CEF lines cut off | UDP message size limits | Use TCP syslog |
FAQ
Can I export from ESM instead?
ESM active channels can export, but ESM holds correlated and filtered data. For complete history, Logger is the better source.
Is CEF good enough without the raw event?
For many detections, yes: CEF keeps the key fields. You lose fields the connector didn’t map, and the exact original wording.
