Automate - MSSP- New Customer Deployment

File uploaded by akhandekar@arcsight.com on May 6, 2015
Version 1Show Document
  • View in full screen mode

The Tool helps MSSP to reduce the complexity and possibilities of human error while on-boarding new customers to ESM. Also the tool drastically reduces your new customer on-boarding time and basically eliminated  the below problems to major extend :

  1. Extended deployment time due to Complex filters required to restrict data exposure between clients
  2. High potential for data leakage between clients due to complexity
  3. Performance issues due to shared platform and increased complexity

Package name- MSSP- New Customer Depolyment.zip (attached) Purpose:  Automate manual task required for New MSSP Customer on-boarding using dynamic user specific arb files. Deployment and use:Step 1- Copy and unzip the package “MSSP- New Customer Depolyment.zip” on the ESM or any Linux system.Step 2- Change directory and make the script file executable -  chmod +x mssp_import_new_customer.shStep 3-  Run the script – ./mssp_import_new_customer.sh <your customer name here>Step 4-  Import the  create package “<your customer name here>.arb”  to ESM. Tool Highlights:

  1. Creates a Custom Customer specific arb.
  2. Creates a Custom User group and New Customer URI
  3. Assigns all resource required for on-boarding the customer.
  4. Restricts/prevent data exposure by assigning event filters based on the new customer name only.
  5. Creates a structure for MSSP share/common content and dedicated /custom content for specific customer.
  6. Provides read only access to MSSP share common content and  custom customer specific resources.


Screenshots:  Customer name was set="mynewcsutomer" for test/demo purpose.

  • Auto Resource created and Access assigned the user group

Resource created and Access assigned the user group.jpg

  • Auto Event Restriction:
  • Event Restriction.jpg
  • Auto Customer Event Filter definition
  • Customer Event Filter definition.jpgEvent Filter.gif

Outcomes