SN59: Tips and Tricks in ESM

Document created by jmerrill on Sep 28, 2009Last modified by jmerrill on Jul 8, 2014
Version 2Show Document
  • View in full screen mode
SN59
Tips and Tricks in ESM
Speaker: Raju Gottumukkala, ArcSight Expert-ArcSight
In this very advanced session you will learn super user tricks that address displaying the same field in a correlation event from multiple base events; using Negative events; checking and populating a field in an Active List from another field in a different Active List; manipulating Date type field in an Active List; and understanding the quirks in Every Threshold and Time Unit triggers.
Level: Advanced

Attachments

Outcomes