ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins. Read more for important details.
ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins.Read more for important details.

Access to SOC manager Dashboard ESM 7.x

Idea ID 2773336

Access to SOC manager Dashboard ESM 7.x

Access to the 3 SOC dashboards – SOC, Cluster View & SOC Manager through ACC is currently limited to Administrators only.  Only users that are placed under the "Administrator" group could access and view these dashboard.


However, there is occasion where organization would like to allow the access to these dashboards by non-admin users, or customer would simple want to display these dashboards in the Console or SOC monitoring center for continuous monitoring on screen.

By using Administrator privilege to access these, will allow the user to have other Admin privilege which is undesirable.  Hence, it would be good if access to these SOC dashboard can be granted to non-Admin user by means of access & control.

5 Comments
Captain
Captain

Before the idea exchange emerged we have requested an enhancement request for this precise issue. Micro Focus has registered JIRA [NGS-28087]. According to customer success management the request will be fulfilled next ESM release, most likely ESM 7.2.1.

Fleet Admiral
Fleet Admiral

I can confirm that the new version of ESM 7.2.1 will fix this inconvenient. 

Micro Focus Frequent Contributor
Micro Focus Frequent Contributor
Status changed to: Accepted

The SOC View can be made available to users in ESM 7.2 and earlier.  This requires giving needed user-groups Read access to the following resource groups:

  • /All Data Monitors/ArcSight Foundation/ArcSight ClusterView
  • /All Filters/ArcSight Administration/ESM/Distributed Correlation Monitoring
  • /All Fields/ArcSight Administration/ESM/Distributed Correlation Monitoring

 

For the April release, ESM v7.2.1, the Cluster View will also be available via the same changes. 

 

As to the SOC Manager View, we will need to do more work to support that for non-Admin users.  Currently that view provides metrics for all users and thus is meant to be limited to Admin users who should be able to see data across the entire platform.  I would definitely appreciate any feedback from customers on how important this view is for all/more users to be able to see this data.

Ensign
Ensign

I disagree with Jeremy's suggestion, as I have tried the workaround by granting access to non-admin users of the following 3 resources, but still unable to view any of the SOC dashboards mentioned in ESM 7.0:

/All Data Monitors/ArcSight Foundation/ArcSight ClusterView

  • /All Filters/ArcSight Administration/ESM/Distributed Correlation Monitoring
  • /All Fields/ArcSight Administration/ESM/Distributed Correlation Monitoring

 

Bottomline is, only user placed under the in-built  "Administrator" group, will be able to access these SOC dashboards.

Also, it's not a matter of how important to allow non-admin user to view these dashboards, but rather these SOC views by nature of definition is meant for SOC monitoring, and likely on console by 24x7 basis, the more  "unlikely" it will be projected on the Console/screen with an Administrator account.

 

 

 

 

 

 

 

Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

As mentioned in my above statement, the Cluster View will be available in April. 

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.