Highlighted
kgraham Super Contributor.
Super Contributor.
402 views

ArcSight ESM - Reports & Variables - Online Expert Day

First off ---> Love the new interfaces.

When running reports in Logger a person can configure the base report to ask the user for a variable.   Is this function available for ESM?

Or is there a function from ArcMC(?) that would allow a user to run a report from either ESM or Logger and input a variable?  I have access to ArcMC but time constraints have me only holding off on the installation.

I have always had to include the variable if I am running a report from ESM.

My question stems from seeking a "One Stop Access" for users without them knowing a report comes from here and an active channel comes from there.  Currently if they need to input a variable they need access to Logger and then to ESM for a different view on events.    Some get a bit confused.

Scenario:

User "badDay" is around.   User "OpenEyes" is watching "badDay" and is worried.  User "OpenEyes" has a report that shows all the activity for a user on ESM. They edit the report and send it off to "badDay"'s manager.  Each time "OpenEyes" is asked to report on someone similar to "badDay" they need to edit the report and enter in the username. 

Currently user "OpenEyes" does not have or want access to Logger due to a new learning curve and too many tools.

Kim

Helping "OpenEyes" stay focused on the prize

Labels (3)
0 Likes
2 Replies
Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

Re: ArcSight ESM - Reports & Variables - Online Expert Day

Hi Kim,

I'm with the HPE PS team. We have a parameterized report option in ESM as well. If your condition include a criteria like sourceUserName =badDay, you can replace it with this syntax sourceUserName=@User= in the query. Now when  you run the report you will be prompted for User as a report parameter with all the other conditions in your query. Hope this helps.

0 Likes
kgraham Super Contributor.
Super Contributor.

Re: ArcSight ESM - Reports & Variables - Online Expert Day

Thank you.  I will give that a try today and see how it goes.

Kim

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.