You can send an SNMP trap or Syslog message from NetWitness Informer to ArcSight with alerts details. The SIEM link allows you to view events from ArcSight, an IDS/IPS or other security device in NetWitness Investigator. Basically you are taking a date time group and a source and destination IP and running that as a query in Investigator to show ALL sessions between those hosts over a predefined time period, 10 minutes, 10 hours, 10 days whatever you like depending on how long you are storing sessions for.
I have sent you a white paper on SIEM link for your info.
Regards

Chris

By installing Guidance Software’ Information Assurance on top of EnCase Enterprise, I had access to A.I.R.S (Automated Incident Response Solution) to do on demand snapshots on systems running the EnCase servlet.

Then I defined a custom data source for AIRS where to look for IPs to be polled and the next thing was to get ArcSight to insert IP addresses in that database. Not very complicated, but it works very well.

So now I have a new tool defined in ArcSight Console which sends the highlighted cell (must be an IP) to EnCase for a forensic snapshot. The same can be used in a correlation rule. However, the analyst has to look into AIRS console to see the snapshot details… I couldn’t find a way to get data back in ArcSight but I think it’s doable . ( my goal was to set up a demo incident response architecture for an event).

As for new sources of information to be sent in ArcSight. I’m looking forward to work with NetWitness (i think a SNMP flex connector is needed).

Let me know if you want to go any further with the EnCase / ArcSight integration.