More Automated Features on the ArcSight Cases

Document created by Balahasan V on Jun 17, 2015
Version 1Show Document
  • View in full screen mode

Hi Guys,


The ArcSight Internal case management features are not widely used. So deploying more automation like


Auto appending the Case creation with more of the Alert Information.

Add existing case feature to append the new correlation event information to the existing Case.

Auto Case assignment and improved workflow process from Rules

Bulk Case deletion from Console

Cases getting appended even after being Closed/Moved -> Not a good thing . We don't want to have the case to append a closed case.

Include Correlation event Annotation in the Case fields

Case fields customization feature like the report template customization from Console itself specific to each correlation category.


This is from the More Automated Features on the ArcSight Cases. If you have more suggestions. This blog is open for suggestions specific to the same.