Documentation Center
AlienVault® USM Anywhere™


When you configure ObserveIT to send logs through NXLog to USM Anywhere, you can use the ObserveIT plugin to translate the raw log data into normalized events for analysis.

Device Details
Device vendor ObserveIT
Device type Unified Threat Management
Connection type Syslog

Integrating ObserveIT Logs

The USM Anywhere ObserveIT plugin leverages the integration support that ObserveIT provides for the HP ArcSight SIEM monitoring software. Follow the ObserveIT documentation to configure the SIEM Log Integration.

Important: Follow the steps closely and keep all the default values even though they contain the word "ArcSight". The NXLog configuration file that you download from AlienVault has been specified to parse logs in the default location.

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure NXLog to send log data to USM Anywhere

Plugin Enablement

The ObserverIT plugin automatically processes all messages when the raw message contains ObserveIT.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. The USM Anywhere reports use these fields, and you can also reference them when creating custom reports. In addition to reporting, the USM Anywhere correlation rules make use of these fields.

  • customfield_0 → EventCategory or Area or AlertDetails or SessionId
  • customfield_1 → EventSource or Item or OS
  • customfield_2 → EventTypeCode or Action
  • customfield_3 → ConfigProprtyName
  • customfield_4 → TypeOfChangeStr
  • customfield_5 → NewValue
  • customfield_6 → Printer
  • destination_hostname
  • destination_ntdomain
  • destination_process
  • destination_service_name
  • destination_userid
  • destination_username
  • device_event_category
  • device_process_name
  • event_category
  • event_description
  • event_name
  • event_receipt_time
  • event_severity
  • external_id
  • file_name
  • plugin_device
  • rep_device_address
  • rep_device_hostname
  • rep_device_rule_id
  • rep_device_type
  • rep_device_vendor
  • rep_device_version
  • request_method
  • source_address
  • source_hostname
  • source_process
  • source_service_name
  • source_userid
  • source_username
  • time_end
  • time_start


For troubleshooting, refer to the vendor documentation: