I had worked in the past on ArcSight Installation/Configuration/Management,
and Yes, you can configure the Manager to Pull the logs from the Snort,
you will need to have physical access and password and snort.conf details as well ,
also, you need to configure the SmartAgents, and select the "Snort Database"
and finally you will need the MySQL DB password and username from the snort.conf handy in order to get it running.
u can refer to the technical documentation.
if u need any help please email me at:-
Last Wiki Answer Submitted: January 22, 2009 11:02 pm by Blackhat15 pts.