OpenText ArcSight

Connection methods

• REST API for searches and dashboards
• Webhook or email alert forwarding
• Scheduled report exports
• SOAR playbook status APIs

Documentation topics

Review the following areas in OpenText ArcSight admin and product documentation before connecting to ComplAI:

• Admin console setup and service account creation
• API authentication, scopes, and rate limits
• Audit log export and retention settings
• Security hardening and least-privilege configuration

ComplAI integration overview

OpenText ArcSight integrates with ComplAI to support Propel Ready Solutions's GRC program. Enterprise SIEM with CEF normalization and correlation. This guide covers product context, the recommended connection process, prerequisites, and verification steps for audit-ready evidence collection.

Last updated: 2026-06-24

GRC evidence available

• Log source health and ingestion volume
• Detection rule coverage
• Open and closed incident counts
• Mean time to detect/respond
• CEF metrics and configuration evidence
• Correlation metrics and configuration evidence

Prerequisites

• Named integration owner and backup contact at Propel Ready Solutions
• Change request approved per Propel Ready Solutions change management policy
• Network egress allowlisting completed if required by vendor
• ComplAI organization administrator access
• Admin or integration-builder role in OpenText ArcSight
• OpenText ArcSight product documentation reviewed (see Documentation topics below)
• On-premises connector or agent deployed in approved network zone

Integration process

1. Step 1

   Plan OpenText ArcSight integration scope

   Confirm which CEF and Correlation capabilities will be connected first. Start with read-only ingestion before enabling write actions.

2. Step 2

   Identify log sources and parsing requirements

   Inventory systems whose logs must reach the SIEM (IdP, EDR, cloud audit, firewalls, applications) and confirm parsing/normalization.

3. Step 3

   Connect ComplAI to SIEM export or API

   Configure API keys or webhook forwarding so ComplAI can read detection metrics, case status, and log ingestion health.

   • Enable read access to dashboards or saved searches for control evidence
   • Document retention periods aligned to policy (typically 12+ months)
   • Validate timezone and timestamp normalization (UTC recommended)

4. Step 4

   Align detections to control objectives

   Map critical detection rules to ISO A.8.15/A.8.16 and incident response procedures.

5. Step 5

   Establish SOC runbooks

   Document triage, escalation, and closure steps; store runbook links in ComplAI control evidence.

6. Step 6

   Mark integration complete in ComplAI

   Update integration status to Connected, attach configuration evidence, and link mapped controls in the Controls library.

GRC benefits

• Log retention and monitoring evidence for A.8.15–A.8.16 and SOC 2 CC7.2
• Incident detection and response workflow integration
• SOC metrics and detection coverage for leadership dashboards

Related controls

Verification checklist

• ☐Integration credentials stored securely and rotation scheduled
• ☐Test sync completed successfully with sample records
• ☐Error alerting configured for failed sync or API rate limits
• ☐Control mappings documented in ComplAI
• ☐Evidence sample exported and reviewed by control owner
• ☐Runbook link attached to related controls

Troubleshooting