Mapping App Control Events to ArcSight CEF

App Control supports integration of its event information with Syslog servers using several formats.

One of the Syslog formats supported is ArcSight CEF (Common Event Format), which you can use to integrate App Control event logs with ArcSight ESM or ArcSight Logger. You configure Syslog integration on the System Configuration/Events page, described in the “System Configuration” chapter of Using App Control.

This section describes the mapping of App Control event fields to ArcSight CEF fields. See your ArcSight documentation for full information about ArcSight CEF and its capabilities.