ArcSight ESM - Reports & Variables - Online Expert Day
First off ---> Love the new interfaces.
When running reports in Logger a person can configure the base report to ask the user for a variable. Is this function available for ESM?
Or is there a function from ArcMC(?) that would allow a user to run a report from either ESM or Logger and input a variable? I have access to ArcMC but time constraints have me only holding off on the installation.
I have always had to include the variable if I am running a report from ESM.
My question stems from seeking a "One Stop Access" for users without them knowing a report comes from here and an active channel comes from there. Currently if they need to input a variable they need access to Logger and then to ESM for a different view on events. Some get a bit confused.
User "badDay" is around. User "OpenEyes" is watching "badDay" and is worried. User "OpenEyes" has a report that shows all the activity for a user on ESM. They edit the report and send it off to "badDay"'s manager. Each time "OpenEyes" is asked to report on someone similar to "badDay" they need to edit the report and enter in the username.
Currently user "OpenEyes" does not have or want access to Logger due to a new learning curve and too many tools.
Helping "OpenEyes" stay focused on the prize
Re: ArcSight ESM - Reports & Variables - Online Expert Day
I'm with the HPE PS team. We have a parameterized report option in ESM as well. If your condition include a criteria like sourceUserName =badDay, you can replace it with this syntax sourceUserName=@User= in the query. Now when you run the report you will be prompted for User as a report parameter with all the other conditions in your query. Hope this helps.