Audit logsΒΆ
Most applications where a user processes data related to another user need to log audit statements, detailing which user did what action on which subject. These logs need to follow a specific format and be accessible by ArcSight.
See naudit for how to set up the logging, and details on the log format.