integration of ATA with Arcsight SIEM

[walid hegazy]

We have configured all the settings to forward events through Syslog through port 514 and network access is also verified. But the events are not  forwarding  to arcsight SIEM.

[#2]

Are there any errors in the center logs that seems related?

https://docs.microsoft.com/en-us/advanced-threat-analytics/troubleshooting-ata-using-logs#ata-center...

I am guessing you are using UDP. if your SIEM supports it I would suggest for troubleshooting switching to TCP. in UDP, if there is a network blocker, We can't tell. for TCP we will generate errors in the logs.

[#3]

Have you tested the connection with Arcsight? If yes, did Arcsight receive the test message? 

There is a test button on the page you configure the settings to send the notifications to your SIEM. 

https://docs.microsoft.com/en-us/advanced-threat-analytics/setting-syslog-email-server-settings#prov...