This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

L1-Application Monitoring Web Services- Indicators and Warnings

This is the official forum for discussing the basic ArcSight Activate L1-Application Monitoring Web Services- Indicators and Warnings package, as described in the Activate Wiki.

  • Hi,

    Filters in this package use deviceEventClassId=xxx (for example: deviceEventClassId=200) or deviceEventClassId Startswith x (for example: deviceEventClassId Startswith 2), but with new IIS parser, deviceEventClassId is often like this: deviceEventClassId=GET:200. This means no event will be matched. I think this is an issue that can be fix in new version of the package.

    Thanks!