ArcSight Command Center direct link to event

[RomaN]

Hello, everyone

Is it possible to create direct link for event or Case in Command Center Interface (ofcourse i mean 6.8 ver) as it realized in "9443" web (for example https://esmip:9443/arcsight/app?service=external/EventInspector&sp=S9K2sjkwBABDnTUTco4BDqw%3D%3D&sp=F&sp=F. for event  and https://emsip:9443/arcsight/app?service=external/CasesTop&sp=S(ResourceID)%3D%3D for cases)

[a.sanchezhinojo]

It probably won't work if you have to provide login information.

[RomaN]

In 9443 you also get event page after success authentication. So it`s acceptable deviation from "direct conception" for me.

[balahasan.v1]

Hi RomaN,

What are u trying to achieve. Command Center is mostly for Administration. Why u need the alert/event information on that

[RomaN]

Hi Balahasan,

The main goal is providing friendly interface to view correlated (base) events for web-users who receive incident notifications by e-mail. Since "8443" interface is more clear and useful for me, I would like to generate "8443 event link" for this notifications.

[AdamHarris]

You should be able to can reference the event ID and use the API to put the event ID into a query. Since cases use eventId reference to know what events are attached this information will be available to you.

You can see it by using eventId = "<eventId goes here>" as your query.

[lless]

Hello, who have solution?

[RomaN]

Nope, Adam`s solution should works and protect contains some example, but it`s seems no way through "official" web interface

[AdamHarris]

I'll be a bit more specific without doing the whole thing for you since this is months old...

Example URI you can give to ESM Command Center  (6.5c) - :

https://yourESM:8443/logger/search.ftl?ausm_query=eventId=123456789&from=$Now - 10m&$to=$Now

Don't get thrown off by the logger reference above. Build other bits into your URI what you need. You could pull the timestamps out from the event.