To start --> Love the over all new interface
This question is based on the Web Interface.
A function we used is not apparently available. If they are please point me in the direction so that I can set it up and teach my users. We could filter via the column in the configured active channel. Filtering helped us when looking for a particular user, IP, Device, Reason within the configured active channel.
I understand new active channels can be built or modified via editing the channel. It is teaching the users to do this that makes it a bit tricky. The drop downs helped with the education. There are many of my users that will use the new function and run with it. There are others that will not due to timing, education and fear of breaking something.
There is the option to search via the search page although some managers have asked me to restrict their people to have very limited access. Their access needs to be easy and quick. These are first line support agents.
User is locked out of the AD account.
Typically it is a mobile device with a bad password.
Active channel configured with Failed Logons and Account Lockouts
Fields : name, message and deviceCustomString4, sourceUserName, destinationUserName, sourceMacAddress etc. tell the story.
They used the filtering at the top of the column to find a particular user so that they can tell the user why they are locked out and how to correct the situation. It is quick and efficient assisting in first call resolution.
Is this type of filtering available or will it be forthcoming?
Making solutions look easy
In your scenario, they can click on the UserName in the channel and either create a channel based on just the user or narrow down the existing channel to just that user. This is the equivalent of the Investigate feature in the regular console. Will this take care of it?
ArcSight Pro Services