When manipulating variables inside of queries and rules, ArcSight limits acceptable choices to standard fields or global variables. This makes the $Now variable inaccessible in some situations where we need it. We discovered an ArcSight event that fires every minute. Using this event as a trigger, we can populate an active list and then read this value in a global variable. This allows us to effectively replicate the use of $Now in global variables.