User`s guide

Technical white paper
18
– Optionally, you can select the “Firewall…” button, select the “Only allow connections from the following networks”
radio button, and specify your HP ArcSight Logger server or external syslog server for added security. (Figure 18)
Figure 18. Restricting outbound syslog traffic from the VMware ESXi Host to HP ArcSight Logger
– Select “OK” on the “Firewall Settings” and/or “Firewall Properties” windows.
• It might take a few minutes for the VMware ESXi Host to send its first event to the HP ArcSight Logger, but you should see
the IP or hostname of the host registered in HP ArcSight Logger in the “Configuration -> Devices” page (Figure 6). You will
need to repeat these steps for all of your VMware ESXi Hosts.
VMware vSphere Web Services
The VMware vSphere Web service is a programming interface that exposes the functionality of VMware vSphere to
customer-written or third party applications. The vSphere Web service is part of vSphere. It is distributed and installed along
with the rest of vSphere and there is no additional cost or licensing required
With HP ArcSight SmartConnector for Windows, you are able to monitor VMware vSphere Web Services. You will first need to
install the SmartConnector as described in the ArcSight documentation - User’s Guide HP ArcSight SmartConnectors. Once
you are at the “Select the connector to configure” window, close the HP ArcSight Connector Setup window and perform the
following steps to complete the setup.
• You first need to obtain the certificate from VMware vSphere vCenter Server and import it so that the connector can see it.
To do so, open Internet Explorer on your vCenter host and browse to your vCenter Server instance, for example
https://localhost
– Next to the address bar, select “Certificate Error” and select “View Certificates” (Figure 19)