• State Not Answered
  • Replies reply
    1
  • Subscribers subscribers
    23
  • Views views
    433
  • Users 0 members are here
Related
Options

ArcSight ESM EPS License Audit

daei

I want to know about ArcSight ESM 7.0 License Audit (Device Event Class ID=license:106) Log

Whats the meaning of Device Custom Number 2(EPS Breach Count Limit) = -1 and Why Device Custom Number 1(Current EPS Limit Breach Count)=0 while our Current EPS was higher than our EPS License Limit in 2 days?

  • 0

    Hi Daei,

     

    I have the same for ESM v6.9.1, the -1 means that it is disabled which means that you have no EPS breach limit and this is specifically why the other field is 0 because you won't never be up your limit as there is no limit.

    Most of the time, in ADP mode in Logger, when you are over your limit you can still collect events but you cannot launch searches. I don't think there is such limitation with ESM.

    Do not forget that the breach is not instantly but in average in ArcSight.

    Thanks
    Regards

    Michael

Resources

Support
Documentation
Training
CyberRes Academy
Partner Portal
Contact us
Compliance
Help
Company
Privacy Policy
Terms of Use
Accessibility
Anti-Slavery Statement
Support
How To Buy
Careers
Investor Relations
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.