This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

L1-Data Security Monitoring - Data Loss Prevention (DLP) - Indicators and Warnings

Teju Sundaresan OpenText Employee

over 8 years ago

This is the official forum for discussing the basic ArcSight Activate L1-Data Security Monitoring - Data Loss Prevention (DLP) - Indicators and Warnings package, as described in Activate Wiki page for the package.

Tags:

ESM

activate

L1-Data Security Monitoring

data security

DLP

0 Beirne over 7 years ago

I'm implementing the package and noticed something. The Device Event Category should start with "/Rule/Fire/Activate" instead of "/All Rules/ArcSight Activate/Solutions"
Cancel
Vote Up 0 Vote Down

Cancel
0 oswaldo.dimas@h over 7 years ago in reply to Beirne

Hi Bernie,

Thanks your your comments, we will make the necessary changes and apply them for the next version. Also, we may need to change the package resources to add the root for every resource type.
Cancel
Vote Up 0 Vote Down

Cancel
0 oswaldo.dimas@h over 7 years ago in reply to oswaldo.dimas@h
1.0.0.1 Release is published in the Marketplace:
Removed Resources Tab modified in Package Resource to suit Activate Framework Best Practices
Device Event Category field was fixed.
Cancel
Vote Up 0 Vote Down

Cancel
0 ricardoraza51 over 6 years ago in reply to Beirne

Hi I have a doubt, what is the reason when I install this package all the filter have the condition False
Cancel
Vote Up 0 Vote Down

Cancel
0 steve-m over 6 years ago in reply to ricardoraza51

You will need to hook in the product packages to the L1 content. When L1 packages are installed, by default, no product packages are hooked in and that's why the filter conditions are false. The Marketplace link does not have a link to the Wiki on how to do that, I will report that and get that addressed. To hook product packages in, see this link: https://sec.microfocus.com/foswiki/bin/view/ArcSightActivate/L1DataSecurityMonitoringDLP#Content_Hooks_for_Product_Packages.
edit: link was updated
Cancel
Vote Up 0 Vote Down

Cancel
0 angelo cappelli over 5 years ago in reply to steve-m

Broken Link on how to set up the hooks
Cancel
Vote Up 0 Vote Down

Cancel

Menu

ArcSight User Discussions

L1-Data Security Monitoring - Data Loss Prevention (DLP) - Indicators and Warnings

Tags:

Resources