Hello ArcSight community,
Does anybody know if ArcSight is capable to use information from the outside database for correlation process? Let's say we want to have a rule which compares the ongoing event stream with the data in some outside database. Is it possible? The thing is that this database contains a lot of enties (few millions) and it can not be imported to a single Active List. I would appreciate a lot if someone could share their experience encountering similar problem(s).