arcsight2ts.py

#
# pip install --user python-dateutil
#
import sys
import csv
import time
from dateutil import parser
from dateutil import tz


def arcsight_to_timesketch(dict_row):
    message = dict_row['Name']

    parsed_date = parser.parse(dict_row['End Time'])
    current_zone = tz.gettz(dict_row['Device Time Zone'])
    utc_date = parsed_date.replace(tzinfo=current_zone)

    timestamp = time.mktime(utc_date.timetuple())*1000000
    datetime = utc_date.isoformat()

    timestamp_desc = dict_row['Device Severity']

    return dict_row.values() + [datetime, timestamp, timestamp_desc, message]


with open(sys.argv[1]) as csv_in, open(sys.argv[2], 'w') as csv_out:
    reader = csv.DictReader(csv_in)
    reader.fieldnames = ['ArcsightMessage' if n == 'Message' else n for n in reader.fieldnames]

    ts_writer = csv.writer(csv_out)
    ts_writer.writerow(reader.fieldnames +
                       ['datetime',
                        'timestamp',
                        'timestamp_desc',
                        'message'])

    for row in reader:
        ts_writer.writerow(arcsight_to_timesketch(row))