This is my attempt to parse out events for the ISE flex connector. It's a work in progress - It's nowhere near extensive since there are so many different ID's to parse. Feel free to use this for your own "starter" template.
- Create the CISE.subagent.sdkrfilereader.properties in the $ARCSIGHT_HOME/user/agent/flexagent/syslog/
On connector Appliance: /opt/arcsight/Connector_(number)/current/user/agent/flexagent/syslog/CISE.subagent.sdkrfilereader.properties
- Restart the connector after the file has been created.