How to Update GeoLite2 Database in ArcSight Manager

To update the GeoLite2 database in your ArcSight Manager environment, follow these steps:

• Visit the MaxMind Portal and log into your account.
• If you don’t have an account, register for one.

1. Once logged in, navigate to the Account Portal.
2. In the sidebar menu, select “Download Files”. This will take you to the page where GeoLite2 databases are available:
3.  <https://www.maxmind.com/en/accounts/<account_ID>/geoip/downloads>
4. Locate the GeoLite2 City section.
5. Click the “Download GZIP” link to start the download.

1. After downloading, locate the file named:
2.  GeoLite2-City_<YYYYMMdd>.tar.gz.
3. Extract the archive.
4. Inside the extracted folder, find the file named GeoLite2-City.mmdb.

1. Stop the ArcSight Manager service:
2. /etc/init.d/arcsight_services stop manager 
3. Navigate to the ArcSight Manager configuration directory:
4. cd $ARCSIGHT_HOME/config/server 
5. Replace $ARCSIGHT_HOME with the path to your ArcSight installation directory.
6. Rename the existing database file ipdataV6.mmdb for backup purposes:
7. mv ipdataV6.mmdb ipdataV6.old_mmdb 
8. Move the extracted GeoLite2-City.mmdb file to this directory and rename it to ipdataV6.mmdb:
9. mv /path/to/GeoLite2-City.mmdb ipdataV6.mmdb 

1. Start the Manager service again:
2. /etc/init.d/arcsight_services start manager 
3. Verify that the service starts correctly and confirm that the updated database is being used.

• Ensure you have appropriate permissions to perform these actions.
• Always back up your existing configuration files before making changes.
• If you encounter any issues, consult the ArcSight documentation or support.

The post How to Update GeoLite2 Database in ArcSight Manager appeared first on SOC Prime.